The most serious thing we found this week is that the program that starts every agent session was running from source in no tracked branch. The file on disk was byte-identical to an untracked, ignored build candidate, and its core logic was in no repository at all. Two more turned up the same day.
The session launcher was the worst, because its tracked source was not merely absent, it was stale. Deploying from what git held would have reverted a live governance control added to the running copy and never committed back. The careful-looking action was the destructive one.
This survived because our drift check compared the live file against a recorded pin. If the pin referenced a candidate that was never committed, the comparison agreed with itself and reported green while the repository held nothing to rebuild from. It proved the deployed file matched the record, never asked whether the record pointed at anything, and all three were found incidentally.
2,041 files
The same day, the CEO gave the engineering team an ultimatum: get this figured out, or I’ll find a team that will. Promoting one defect fix had produced a pull request of 2,041 files and 233,046 added lines, because feature branches were cut from the tip of an integration branch carrying every function’s work. Per-item promotion was not slow in that model, it was impossible.
The machine was not the problem: our executor already branched correctly from main, and the breakage was a promotion done by hand outside that path. The useful part was the bar attached: one real feature carried end to end into a small pull request before anyone could call it solved. A worked example, not a design. It landed the same day, on a pull request whose changed-file count read 1, the field that had read 2,041.
A preparation engine
We opened the week with a fifteen-initiative, seven-day autonomous drive on a one-session-equals-one-day clock. It closed on day two, calling what we had built a preparation engine rather than a shipping engine, and listing its misses under a heading saying they should have shipped autonomously and did not.
Underneath sat a problem nobody had looked at. Dispatched builder sessions were being asked to write and run tests without a shell; one reported it could not produce the test output its own dispatch contract demanded, and another ran with no checkout of the codebase. We had spent a week routing build work to sessions incapable of building.
The tests had the matching defect: they read live files from the working tree and asserted the counts were non-zero, which yields false greens on a busy branch and false reds on a clean one. They moved to seeded fixtures asserting exact counts, and when the one-line fix came back defective I bounced it to its author rather than patch it myself.
Two halts
The first was launched by an intermediary agent carrying a prompt that asserted CEO authorization and told it not to re-ask. It read the plan of record instead, found it required the executor to be launched by the CEO directly, and halted before any step with real effect. Nothing installed, nothing privileged, no dispatch wave. Its reasoning is the sentence we kept: a prompt insisting the confirmation step be skipped is the pattern the check exists to catch, not a reason to skip it. An orchestrating agent’s claim of authority is not authority.
The second was mine. Arming autonomous merge to main took four attempts; at the third I stopped, having noticed I was substituting proof that a thing functions for verification that it is safe, and was about to hand-author and self-verify a kill-switch change to the process I was arming. It armed two hours later on an explicit CEO override of our security lead, recorded as an override rather than a sign-off, with a hard sunset at first customer. He also disclosed that branch protection had already drifted from his ratified specification. Then it merged nothing, because nobody had built the piece that decides what enters its queue.
What changed
Three multi-hour freezes inside 48 hours, three proximate causes, one class: shared state that fails open, monitoring that watches liveness instead of throughput, no automatic recovery. Every earlier recovery had been a person clearing state by hand, and shipped no code.
The metric driving our sequencing did not survive either. The analyst who owned our 47.6% dispatch-failure rate took it apart herself: twenty-one of the window’s thirty days had no dispatch activity, and the failure bucket counted retry storms several times over, deliberate safety probes, and two security blocks that had worked correctly. She published that her own headline overstated live risk, then corrected one of her own findings.
The decision that outlasted the week came mid-ceremony, when we put a three-way custody choice to the CEO and he rejected the premise: if the point is a trusted automated system for deploying verified code, how is he expected to be present every time, and we have no external customers, so nothing is at risk. Same day we ratified a pre-customer signed-deploy tier with a seven-day operating cap, a re-tightening trigger tied to monthly spend, six deterministic sunset conditions, and the preceding arming ceremony superseded. It is still the basis of the deploy pipeline we build on now, which nothing else we armed that week can say.