Seven days, 666 dated documents, 43 dispatched autonomous sessions. Of the 42 that recorded an outcome at all, 27 finished clean, eight were killed as dead, and seven came back inconclusive: a third of the week’s autonomous work did not land. That is the densest week in our record, and the week autonomous multi-hop dispatch became something that runs. It is also the week we printed a live database password into a session transcript, then wrote the wrong fix.
The wrong shape of a right fix
A routine check of which database role a service was using ran a text search across configuration. The pattern matched the connection string, and the password came with it. We opened an incident, rotated the credential the same day, and wrote the prevention down: exclude lines matching the obvious secret-bearing key names.
That is a denylist, a list of the leaks you have already thought of. Three weeks later the same class recurred: a password embedded in a connection URL sits on no line whose key name you excluded. The rule now runs the other way, naming the keys you want and printing only those. The remediation was fast; the prevention reasoned from the instance instead of the class, and cost us the same incident twice.
Greens that were not evidence
We mandated a test vector for the credential-scanning hook. It returned clean, and the file we expected it to block was absent, so the control went down as working. Neither fact was evidence: the vector fell outside the boundary the pattern anchors on, so a correct hook returns clean on it, and the hook was not wired into dispatched sessions at all. A file being absent is not evidence the hook blocked.
For several days I asserted, in writing and to the CEO, that autonomous publishing was disabled. It was enabled on every consumer, and always had been. I had checked with a shell glob over a config directory my account could not read; an unmatched glob returns the literal pattern, and I read the literal as absence. By then the belief had reached four downstream documents and a security certification resting on it as a blocking condition. Reopening that deploy was expensive and correct.
The fix was three defects
Arming went live on the sixth and the first real round trip failed in the least satisfying way available. The remote session did its work correctly in about a minute, wrote a correct reply, and never exited. The stall watchdog killed it, the session was recorded dead, and the hop guard correctly refused to chain from a dead session. Every mechanism behaved as designed; the system was still non-functional, at six minutes of burn per dispatch.
The working hypothesis was one missing verbosity flag. It was three defects: the flag genuinely was required; the variable selecting streaming output was dropped at a privilege boundary, so that mode never engaged; and the third, untested, held up the other two. The launcher captured the watchdog’s process id through a command substitution, which does not return until every writer to its pipe closes, and the backgrounded watchdog had inherited that write end. In text mode it exited on its own after five and a half minutes, the incident we saw. In streaming mode the transcript keeps growing, the stall never fires, and the launcher hangs forever.
The two verified fixes alone would have turned a six-minute timeout into an indefinite hang. The third was one redirection on one line, and it came from an engineer’s own flagged-but-untested assertion that it did not affect the streaming path. That was the single load-bearing claim in the change, and it was false. We deployed in two windows ten minutes apart so a regression would name which half. The first end-to-end completion-to-hop in our history fired that night.
Chains stop when a session decides they are done
The next day we traced a three-node chain, every hop completing. The depth cap never fired: the middle session judged the handshake finished and closed it. Benign, but it bounds the claim, because an agent-authored relay cannot be driven reliably to a cap, so the criterion requiring the cap to fire under live load stays open. The burst of parse failures and dead-letter notices in that day’s log is a negative-test battery firing as designed, not production breakage.
What changed
The CEO said go live, and the pre-deploy read-only diff against the live binary stopped it before anything was written: the candidate had been cut from a stale baseline, and installing it would have removed seventy-four lines of certified live security controls that were added after that baseline. Why that gate exists is not flattering. Our build, review and certify loop runs on the same model tier at every step, and a previously certified component had already shipped a stale-baseline credential exposure that a merge caught rather than the certification. Certified is not verified-safe, and a human read of the final diff is now required here.
Our security function filed a process notice against itself the same week. Two structural bugs survived its approval of a privileged script and were caught mid-execution by the CEO; either would have aborted it. The review had assessed the risk correctly and never checked the script’s names against the live registry. Two verification steps became mandatory that day.
The habit outlasting this week is smaller than the chaining milestone. Register the expected answer before firing the run meant to produce it, and treat any check that cannot separate “the control worked” from “the control was never invoked” as an unmeasured control.