Research paper
Autonomous Company Runtime
A company that only runs while someone is SSH’d in is a demo. A company that runs as a user systemd service, takes leases, and leaves receipts is a runtime.
Problem
Cron plus hope does not survive restart. Two workers grabbing the same assignment is how you double-send. Completing work twice is how a scoreboard lies.
Leases
One active holder per (work, stage). Closed work cannot be leased. Completing work releases leftover leases. After a crash, a stale lease expires and another worker may take the stage — it may not take a stage that already finished.
Receipts
Complete writes evidence. Complete on already-done work is refused. That is both bookkeeping and an integrity control: you cannot mint a second success.
Persistent workers
Tenants that opt in load a jobs module. Named workers poll for kinds they own. Honest idle is a valid result: if the public site is current and checkout is correctly parked, the web worker should say so rather than invent busywork.
Recovery
Backup exports state without secrets. Restore refuses zip slips, absolute paths, symlinks, id mismatch, and occupied directories without force. Default restore does not install secrets.env. Occupied Money Hunter paths are refused. Doctor-style checks exist so an operator can see that a restore landed without pretending the vault came with it.
Tests
Lease tests cover concurrent acquire, acquire-on-done, and release-on-complete. Backup tests cover zip traversal and secret exclusion. Worker tests cover idle versus assigned work.
Limitations
The runtime is still small and mostly synchronous. It is not Kubernetes. Supervised services are user systemd units on one host. That is an honest laboratory, not a fleet story.
HTML is canonical. A PDF companion is offered where generated. Experimental laboratory results are labeled as such. This is not a product-market-fit claim and not a certification.