Ten weeks ago we had an idea. Today, nine AI agents run our company. They scan our endpoints, score our leads, draft our content, triage our support tickets, and send us a weekly executive summary. None of this was planned in advance. We didn't raise money, write a product spec, or hire a team. Two brothers built the whole thing — 48 phases, shipped sequentially, each one solving whatever problem was screaming loudest.
This isn't a victory lap. It's a build log. Here's exactly how we went from an empty repo to an autonomous fleet — and every wrong turn we took along the way.
Weeks 1–2: The foundation nobody sees
The first two weeks were invisible work. Auth, database schema, the onboarding flow, initial integrations. Nothing you could demo. Nothing that felt like progress. We burned four days getting Supabase row-level security right and another two wiring OAuth for third-party services. It felt slow. It was slow.
But we made one decision in week one that shaped everything after: the first agent we built was Security. Not a lead gen bot, not a chatbot, not anything customer-facing. A security agent. Security's job was to scan every API endpoint and audit vault tokens daily. We built the watchdog before we built the thing it was watching.
This sounds paranoid. It was. But it meant that from day one, every new endpoint, every new integration, every new feature got automatically audited by something that wasn't us. When you're two people shipping fast, you need a third pair of eyes that never sleeps. Security was that.
By the end of week two we had auth, onboarding, a handful of integrations, the Orion chat interface, OAuth, basic workflows, and Security running on a cron. Eleven phases. The platform existed, barely. You could sign in and talk to an agent, but the agent couldn't do much yet.
Weeks 3–4: Autonomy and the first real agents
Week three was when things got interesting. We built the three-tier autonomy system — the idea that agents shouldn't start fully autonomous. They start on deterministic workflows, graduate to smart rules, and earn full AI autonomy over time. We wrote about this in detail in a separate post, but the short version: binary autonomy is a trap. Trust is earned, not granted.
With autonomy tiers in place, we activated the fleet. Pipeline came online — our lead generation agent. It scores inbound contacts against an ideal customer profile, scouts Hacker News for relevant threads, and sends cold outreach via Gmail. It ran on smart rules for the first week before we promoted it to full autonomy.
Uptime followed immediately. Health monitoring. It checks every service endpoint every fifteen minutes and alerts us before users notice anything is down. Boring work. Critical work. The kind of task a human forgets to do at 2 AM on a Sunday. Uptime doesn't forget.
We also built the Pipeline dual pipeline during this stretch — splitting lead handling into user acquisition and investor outreach. Same agent, two modes. This was the first time we realized that agents don't need to be single-purpose. One agent with context-switching logic can handle multiple pipelines if the data boundaries are clean.
Weeks 5–6: The social layer
This is where we almost lost the plot. We'd been heads-down on infrastructure and suddenly realized we had a platform with no marketing engine. No content pipeline. No social presence. So we built the Drift Engine.
The Drift Engine is Oceum's autonomous content system. It generates posts, manages a social calendar, and publishes to Instagram, Facebook, LinkedIn, and Twitter. The agent behind it — Content — uses a reputation score that starts at zero. Below 40, every post requires human approval. Between 40 and 69, some platforms auto-publish. Above 70, everything goes out automatically.
We also integrated AI image generation during this stretch. Content doesn't just write copy; it creates the accompanying visuals, tags them with brand context, and schedules them against an editorial calendar. The Drift Engine Asset Library came later (phase 35), but the core content loop was running by week six.
The mistake we made here: we underestimated how much brand context matters. Content's early output was technically correct but tonally wrong. It sounded like a press release, not a startup. We had to build an entire brand context system — voice guidelines, messaging frameworks, audience definitions — and feed it into the agent's prompt chain before the output felt like us. That cost us three days we hadn't budgeted.
Week 7: Enterprise or it's just a demo
Week seven was a gut check. We had a working platform with five agents running. We could have started marketing. Instead, we stopped and asked a hard question: would we trust this in production?
The honest answer was no. Not yet. So we spent the entire week on enterprise hardening. We wrote 329 tests (now 927). We built a full CI/CD pipeline. We generated an OpenAPI spec for every endpoint. We containerized the whole platform into a Docker setup that runs on Postgres without any Supabase dependency — because if a customer wants to self-host, they shouldn't need our infrastructure choices.
We also built the database adapter pattern during this phase. The platform had been hardcoded to Supabase. We abstracted every database call behind a pluggable adapter so enterprise customers could swap in their own Postgres instance with zero code changes. This wasn't glamorous work. It was the kind of refactoring that makes you question your life choices on a Tuesday night. But it's the difference between a product and a demo.
Triage (support triage) and Briefing (KPI reporting) both came online this week too. Triage triages incoming tickets and drafts responses. Briefing compiles a weekly executive summary by reading from all seven other agents' memory. That cross-agent memory read is the most underrated feature in the entire platform, but more on that later.
Weeks 8–9: Polish and paranoia
Weeks eight and nine were about making things solid. We built the premium UI layer — glassmorphism, spring physics animations, skeleton loaders, stagger effects. Purely cosmetic. But when you're asking people to trust their operations to your platform, looking like a weekend project is a liability.
The bigger story was security. We built the Zero-Knowledge Vault Proxy, which means Oceum never sees or stores customer API keys in plaintext. Tokens go through an encrypted proxy layer, and the platform operates on scoped access tokens that can be revoked instantly. Security audits the vault daily.
We also ran a security audit and fixed 13 findings: prompt injection defenses, API key prefix validation, fetch timeouts, rate limiting, error message leakage, dynamic agent ID validation. None of these were active exploits. All of them were attack surfaces we hadn't thought about until we forced ourselves to think like an attacker.
Revenue (revenue tracking) and Deploys (deploy monitoring) came online during this stretch, completing the fleet. Revenue watches Stripe MRR and churn. Deploys monitors Vercel deploys and feeds changelogs into fleet memory. Eight agents, all running, all audited by Security, all feeding data into Briefing's weekly report.
Week 10: Ship it
Week ten was the flip. We published the npm SDK. We set up pricing. We toggled DRY_RUN to false in production and let the fleet run live against real workloads. The admin portal went live. Cost tracking went live. The BYO agent story went live — customers can bring pre-existing agents into the fleet and manage them alongside native Oceum agents.
The npm package hit 344+ downloads in the first wave. Not explosive growth. But real people installing a real SDK and building real integrations. That's the only metric that matters when you're two people with zero funding.
What we actually learned
Agents that watch themselves solve the oldest problem in security. Security audits Security. Every morning, the security agent scans its own execution logs from the previous day. If its cron missed a run, if its vault check threw an error, if anything in its own pipeline failed — it catches it and alerts us. This is the "quis custodiet ipsos custodes" problem, and the answer turns out to be recursive self-monitoring. The watchdog watches itself.
Cross-agent memory is the feature nobody asks for and everybody needs. Briefing's weekly report reads from the memory of all seven other agents. It knows what leads Pipeline scored, what endpoints Uptime flagged, what content Content published, what tickets Triage triaged, what deploys Deploys tracked, what revenue Revenue calculated, and what security events Security found. A single agent synthesizing fleet-wide memory produces insights that no individual agent could generate alone. We didn't plan this. We built Briefing as a reporting bot and realized it was actually an intelligence layer.
Dogfooding is not optional — it's the product strategy. Every feature in Oceum exists because we needed it. The Drift Engine exists because we had no content pipeline. The vault proxy exists because we didn't trust ourselves to handle keys safely at 1 AM. The admin portal exists because we couldn't debug fleet issues without one. Voice chat, Gmail integration, cost tracking — all of it came from our own pain. When your product runs on itself, the feedback loop is instant. You find bugs in minutes, not sprints.
Two people can ship a platform if you refuse to abstract too early. We have 35 API endpoints, 23 crons, 28 integrations, and 329 tests. None of it uses a microservice architecture. There's no message queue, no service mesh, no Kubernetes. It's serverless functions, a Postgres database, and cron jobs. We added the database adapter pattern when we actually needed it for enterprise — not because some architecture diagram said we should. Every abstraction we introduced was in response to a real problem, not a hypothetical one. Staying lean isn't about writing less code. It's about writing code only when the pain demands it.
The numbers
48 phases shipped. 40 API endpoints. 35 cron jobs. 28 integrations. 927 tests. 344+ npm downloads. 9 autonomous agents. 2 founders. 0 funding.
The product runs on itself. The agents that manage our company are the same agents our customers deploy. Every bug we find, we find first. Every feature we ship, we use first. That's not a tagline — it's the architecture.
Ten weeks. One repo. Two brothers. An autonomous fleet.
We're just getting started.