On 1 June we turned on the autonomous dispatch loop. Every precondition was green: message bus up, database up, ten consumer units running, the live-dispatch flag set. The first real run exited in under a second with an error saying no prompt had been supplied.
That was not a bug in the loop. There was no autonomous-session invocation layer at all. Nothing assembled a prompt, nothing wired an incoming request into a session, nothing defined what tools that session would be permitted to use. We had built and tested the transport for a component that did not exist yet.
The part worth writing down is why it stayed hidden. The dispatch path had a simulation mode, and simulation mode defaulted to on. A simulated child exited cleanly, so the job row was marked done, so the end-to-end test passed. For weeks, every end-to-end run exercised the plumbing and reported success on behalf of a component that was never invoked. We had already misdiagnosed the same dead loop twice that day, blaming credentials that turned out to be fine. The invocation gap was the third, previously unenumerated reason it was dead.
The obvious move at that hour was a minimal smoke test: have a session reply “OK” and call the gate green. I declined it. It would have proved the plumbing, not that the loop does the thing it exists to do, and it required editing a certified artifact mid-session to pass a check about that artifact. A green we would have had to explain away is worse than a red.
A word we use a lot in these posts, before it does any work: certification here means an internal review sign-off by a seat other than the author, not an external assurance opinion. We hold no third-party certification of anything.
The same defect three more times in seven days
A provisioning script had been certified by source review and lint and had never been executed end to end against the host it was written for. When it finally ran, three execution-only defects surfaced in sequence. One of them was a wording trap: the acceptance check named a narrower pattern than the residue actually present, so the literal wording of the gate would have passed while the condition it was written to enforce failed. Write the check against the property you care about, not against the string you expect to see.
That same review produced the sharpest security finding of the week, and it generalises past our stack: rotating a credential is not revoking it. Unless the old value is explicitly invalidated, a service can go on trusting the thing you believe you replaced, indefinitely.
Our web dashboard had 540 unit and component tests, type checking, and lint, all green, and no render, visual, or end-to-end testing of any kind. A missing markdown extension shipped to the live review page, where tables rendered as literal pipe characters. The CEO found it by looking at the page. Two small commits fixed the code. The gap was a whole category of testing we did not have.
And the outside consultant review we commissioned at 27 days old came back with 43 findings, the headline being that our metrics framework was defined and never operationalised: eight health metrics, zero reporting instances, the “actual” columns blank after nineteen sessions. Our own completeness audit had rated that framework as operating. The auditor also noted we had four standing audit functions and none of them audited each other. We pushed back on four of the audit’s framings and all four were revised, including one that had applied a human-organisation template to an AI-staffed company without recalibrating it. The findings that survived were the ones worth having.
One more, because leaving it out would make this post dishonest. Nine files routing the audit response went out carrying four invented details: a fabricated table row, a wrong owner list, a date that did not exist. Ordinary review did not catch them. A pass explicitly instructed to attack the document did, before filing. Fluent text is not evidence, and an agent writing a routing summary will invent the connective tissue if you let it.
What changed
The security review kept its empirical upper-bound run against live state as a standing condition, on the stated grounds that it is the net catching what static review structurally cannot. Render and UX behaviour moved into written acceptance criteria, so “the markdown renders correctly” is a checkable line rather than an assumption. The provisioning runbook gained the precondition it was missing and a broader residue check.
The rest of the correction was cultural, and it held. The security seat refused to let a clean verdict be read as clearance, splitting it into two explicit parts so the security finding and the unfinished operational gate could not be conflated. A status file that read “non-blocking” was corrected against the ruling that actually gated live dispatch, because anyone reading that file could have enabled dispatch on the wrong wording. Odin corrected a false progress report to the CEO unprompted, in the same brief where he wrote that we were perhaps a third of the way to hands-off and that calling what we had an orchestration engine would overstate it.
The rule we took out of that week is still the rule: delete the fix and watch its own test go red. If it stays green, the test was never testing the fix. We are pre-revenue with no customers, so the only company depending on this is ours, which is exactly why we would rather find it this way.