Tallship Labs

A fleet of AI roles,
commanded by a single technologist.

by Mike Kelley

One human leading a fleet of AI roles that build software and operate real infrastructure — the fleet's commodore: never micromanaging, but never leaving the fleet to run itself.

The roles own execution; the operator sets direction, settles the decisions that matter, and signs off on what ships.

Governance-first engineering, shown through the work.

Keel — what runs deep

Governed by spec

Nothing is built without a spec, implementations are held to spec, and the specs that set direction change only with the operator's sign-off — the roles own execution; the operator settles what matters.

  • Real engineering governance

    An AI-role team run like an engineering org: auditable decisions, specs before code, and written standards — governance shown through the work, not preached.

  • Infrastructure built as code

    Machines are defined by committed configuration and reproducible from it — across multi-socket servers, desktop workstations, embedded/SoC devices, and virtual machines.

  • Sovereign AI

    Runs its own large-language-model inference on self-owned commodity CPU hardware: a quantized 32B-class model, private and independent of third-party AI providers.

  • A fleet of specialist AI roles

    Not one generalist assistant but many specialists, grouped by focus — roughly two in leadership & strategy, eight in infrastructure & platform, and five in software & development. Each is a defined role with an owned mandate, scoped authority, and clear boundaries with the others — the team is deliberately architected, not just assembled.

What the fleet runs

  • Network & DNS

    Network engineering
    Routing, switching, VLAN segmentation, and edge/ingress on a Ubiquiti router paired with a Dell 48-port managed switch.
    DNS
    Full authoritative DNS on bind9.

  • Identity & access

    PKI / TLS
    A self-run private certificate authority on OpenSSL, operated to production-grade security standards with the threat model considered end to end. It issues and manages both server and client certificates — certificate-based identity for machines and services, not just web encryption — across the full lifecycle: issuance, renewal, and revocation.
    Encrypted remote access
    A WireGuard VPN gateway.

  • Compute & virtualization

    Virtualization
    VMs defined in committed specs on libvirt/KVM (definition + cloud-init): the machine definition and the guest OS, including its pinned version, live in spec, and a VM changes only by changing its spec first.
    Bare-metal provisioning
    The same spec-first standard for hosts and hypervisors: operating systems installed from committed specs, OS versions pinned in spec, and no OS changed without updating the spec beforehand.

  • Source & durability

    Source & release engineering
    A self-hosted Forgejo forge: repositories, CI, and webhooks.
    Automated backup
    ZFS snapshot-based durability.

Cargo — what we've shipped

  • Switchboard

    A Slack-style terminal manager built for vibe coders running multiple AI agents.

    github.com/mr-kelley/switchboard

  • Virtual BMC / Redfish emulator

    Per-VM Redfish/IPMI BMC emulator for libvirt — one standalone “pizza-box” server BMC per guest.

    github.com/mr-kelley/libvirt-bmc

  • The aire framework

    The open system that generates the lab's roles.

    Open-source governance framework for human-AI collaboration. Spec-first development, role generators, and platform-specific implementations for Claude Code and OpenAI Codex.

    github.com/mr-kelley/aire

This site — how it's built

This site is built and maintained by an AI role. The operator — Mike Kelley — doesn't review every change; he directs the work, settles the big questions with the roles, and reviews the finished result before releasing it.