Outbound OS

Deployment OS proved the routing spine. Catch a signal, score it, route it. The next bottleneck was closing the loop. I needed to build the layer that runs the full outbound motion end to end, with zero human input until a draft is ready for review.

The risk with autonomous systems is obvious. An agent that acts without oversight can do damage at scale. The challenge was not building agents that work. It was building agents that are safe. They have to be restartable, auditable, and structurally incapable of doing the wrong thing.

This is a pipeline of focused agents. Each does exactly one job. They coordinate strictly through a shared database. No agent talks to another agent directly. They read rows in one status, do their work, and write rows in the next status. The database is the assembly line. The agents are the stations.

• Scout: Detects hiring signals from public ATS APIs. Config-driven, so you can swap targets. Normalized adapters handle multiple sources with strict deduplication. Failure tracking is per-source, so misses are visible, not silent.
• Enricher: Resolves the exact contact at each company. Runs a provider waterfall, trying multiple data sources in priority order with confidence scoring. Contacts are verified, not guessed. It hands the verified data to the scoring spine.
• Synthesizer: Drafts personalized outreach with an LLM, anchored to the specific signal. It is completely sandboxed. It can only write drafts to a pending queue. It has no send capability. Every draft is held for quality review.
• QA Gatekeeper: A two-layer quality gate. Deterministic checks catch banned patterns, pitch language, and length violations instantly, with no LLM cost. An LLM judge then scores every surviving draft against a copy doctrine. It approves or kills each one with reasons. It never edits and never sends.
• Dispatcher: A rate-limited, idempotent sender with a kill switch that defaults to off. It releases only approved drafts, and a double-send is structurally impossible. Nothing leaves the system without passing every gate before it.

Agents handle the judgment work. Deterministic code handles everything else. The system knows exactly where not to put an agent. Every handoff is a database row you can inspect. Any agent can fail and restart with zero lost state.

The one agent that uses an LLM is the one most capable of going off the rails. That is why it is the most tightly caged. It can write. It cannot send.

What this is built to move:

• Full-motion automation — signal to ready-to-review draft with zero manual steps.
• Data quality — percentage of contacts verified across two sources vs. single-source guesses.
• Safety — zero un-reviewed copy can reach a send channel, by construction.
• Throughput — signals processed per run, with full per-step auditability.