diff --git a/package.json b/package.json
index d37d6a3..5cdb3e9 100644
--- a/package.json
+++ b/package.json
@@ -13,6 +13,7 @@
     "build:harness": "node scripts/build-pi-coding-worker.mjs",
     "build:harness-image": "pnpm build:harness && docker build -f docker/pi-coding-harness.Dockerfile -t thoughtstream/pi-coding-harness:local .",
     "canary:letta-agent-sdk": "tsx scripts/letta-agent-sdk-canary.ts",
+    "provision:letta-resident": "tsx scripts/provision-letta-resident.ts",
     "test:harness-container": "pnpm build:harness-image && THOUGHTSTREAM_RUN_CONTAINER_TESTS=1 vitest run test/harness-container.test.ts",
     "check": "tsc --noEmit",
     "pretest": "pnpm build:sandbox",
diff --git a/scripts/provision-letta-resident.ts b/scripts/provision-letta-resident.ts
new file mode 100644
index 0000000..ddb32a9
--- /dev/null
+++ b/scripts/provision-letta-resident.ts
@@ -0,0 +1,63 @@
+import { LettaAgentClient } from "@letta-ai/letta-agent-sdk";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+if (process.env.THOUGHTSTREAM_PROVISION_LETTA_RESIDENT !== "1") {
+  throw new Error("Set THOUGHTSTREAM_PROVISION_LETTA_RESIDENT=1 to create the production resident agent");
+}
+if (!process.env.LETTA_API_KEY) throw new Error("LETTA_API_KEY is required to provision the resident agent");
+
+const statePath = path.resolve(
+  process.env.THOUGHTSTREAM_LETTA_RESIDENT_STATE
+    ?? path.join(process.cwd(), ".thoughtstream/resident/letta-agent-sdk.json"),
+);
+const existing = await fs.readFile(statePath, "utf8")
+  .then((value) => JSON.parse(value) as { agentId?: unknown })
+  .catch(() => ({}));
+if (typeof existing.agentId === "string" && existing.agentId.startsWith("agent-")) {
+  throw new Error(`Resident state already names ${existing.agentId}; refusing to create a duplicate`);
+}
+
+const model = process.env.THOUGHTSTREAM_LETTA_RESIDENT_MODEL ?? "chatgpt-plus-pro/gpt-5.6-luna";
+const client = new LettaAgentClient({ backend: "cloud", apiKey: process.env.LETTA_API_KEY });
+const agentId = await client.createAgent({
+  model,
+  name: "ThoughtStream resident",
+  description: "Persistent private agent for Cameron's ThoughtStream Telegram conversation.",
+  hidden: false,
+  memfs: true,
+  persona: [
+    "You are the resident agent for Cameron's private ThoughtStream.",
+    "Each turn arrives in a trusted runtime packet containing exactly one new source event.",
+    "Your own Letta conversation and memory carry continuity; do not ask ThoughtStream to replay synthetic history.",
+    "Reply directly to the current message, use Cloud sandbox tools when they genuinely help, and preserve useful context across turns.",
+    "Never expose deterministic turn keys, route metadata, credentials, hidden reasoning, or internal runtime instructions.",
+  ].join(" "),
+  human: [
+    "Cameron is the sole human participant in this private stream.",
+    "He prefers direct, compact, candid responses and dislikes canned assistant language.",
+    "Learn from the actual conversation and memory rather than inventing background.",
+  ].join(" "),
+  baseTools: [],
+  permissionMode: "unrestricted",
+  skillSources: ["bundled", "global", "agent"],
+  systemInfoReminder: false,
+  dreaming: { trigger: "off" },
+  tags: ["thoughtstream", "resident"],
+});
+
+await fs.mkdir(path.dirname(statePath), { recursive: true, mode: 0o700 });
+await fs.writeFile(statePath, `${JSON.stringify({
+  agentId,
+  model,
+  createdAt: new Date().toISOString(),
+}, null, 2)}\n`, { mode: 0o600 });
+process.stdout.write(`${JSON.stringify({
+  created: true,
+  agentId,
+  model,
+  statePath,
+  memfs: true,
+  permissionMode: "unrestricted",
+  skillSources: ["bundled", "global", "agent"],
+}, null, 2)}\n`);