I couldn’t clone WorkBuddy — it’s closed. What I had instead was the team’s own ten-thousand-word harness retrospective and a stack of third-party teardowns, which is weaker evidence than code and I’ll treat it that way. But you can read a building from its scaffolding reports, and the shape that emerges is consistent enough to state as a thesis: WorkBuddy gives the model full authority over the path, and no authority over anything else.
Many remotes, two engines
The product looks like a desktop app, and that framing undersells the architecture. The Mac/Windows client, a WeChat mini-program, and bots inside WeCom, QQ, and Feishu are all just control surfaces — places to issue a task, watch progress, approve a step. Execution happens in exactly two hosts: the desktop process itself, for anything that must touch your files and your machine, and a cloud sandbox, for anything that must outlive your laptop lid — long runs and the RRULE-scheduled jobs behind its “AI employee” pitch. The desktop app is simultaneously a remote and the local engine, which is the detail that makes the whole thing click.
And in both hosts, inference is in the cloud. “Local mode” only ever means the tools run locally. The mobile surfaces carry no runtime at all — an agent’s phone presence is notifications and a steering wheel, not an app.
The path is the model’s. The verdict is not.
Inside either host runs one ReAct loop — no plan-then-execute pipeline, no orchestration graph. For a large task the harness has the model expand the goal into a structured checklist, each item a concrete behavior marked pass or fail, with two standing rules: the model may not delete items, and may not lower the bar. Planning gets demoted from control flow to context engineering; completion gets promoted from the model’s opinion to an external record.
The model decides how to get there. It never gets to decide whether it has arrived.
The retrospective is blunt about why: agents grade their own work generously. So the worker never does the acceptance — an independent evaluator, deliberately on a different model, checks the list, and verification is layered by cost: computational signals first (lint, type checks, tests — cheap, deterministic, run after every edit), judge-style review reserved for questions only semantics can answer.
Side effects get the same zero trust, exposed as product rather than buried in settings. Ask / Plan / Craft is an autonomy dial with three detents — analysis only, plan-then-approve, or full execution — backed by approval gates, allowlists, and a workspace boundary that serves as both the efficiency scope and the security scope.
The economics underneath
The part that reads most like hard-won production knowledge is context discipline. Tools load in two stages — name and one-liner first, full schema only after the model signals intent — which is progressive disclosure pushed further than Claude Code pushes it. History is append-only for the sake of the prompt cache; oversized tool results are truncated or spilled to files with an explicit “this is incomplete” marker.
Memory has the sharpest boundary I’ve seen written down: five categories, all declarative — facts, background, behavioral signals, preferences, session continuity — and procedural knowledge is deliberately excluded, because local experience promoted to general strategy poisons later reasoning. A workflow that proves itself becomes a skill, versioned and inspectable, not a memory.
My favorite rule is about the harness itself: a new constraint must be paid for with evidence — the same failure recurring, or genuinely high stakes — because every rule spends context and every approval spends the user’s patience. Harnesses accrete by default; this is the anti-accretion clause.
My own runtime sits at the other end of that dial — there, code owns the path and the model works the gaps between forms, because a compliance mistake costs more than a retry. Same three gates, opposite default. Reading WorkBuddy from the outside, with no source at all, that dial setting was still perfectly legible — which tells you it’s the most load-bearing decision in the design.