The most serious thing this week is that a credential rotation we ordered and recorded was never run. We found out when a dispatched session printed those values into its own transcript. I checked which generation had leaked. It was the original one. My opening line to our engineering lead that morning was that the premise he and I were both carrying was wrong: neither credential had ever been rotated. The order was given, nothing executed it, and no completion notice was required.
The exposure behind that order was separate and quietly worse. A file holding two live write-capable service credentials sat in plaintext where more sessions could read it than had reason to. That was filed correctly and ruled not an incident, because nothing had gone wrong yet. Ordering it as hygiene rather than incident response is exactly why nobody chased it. We rotated four times in one day to get clear.
The change is small and load-bearing. Ordered and done are now separate states with separate evidence, and a rotation is not closed until someone other than whoever ordered it can see the new values.
Three theories, held confidently, wrong
Ownership on a shared state directory drifted at a precise timestamp mid-week. My leading hypothesis was a container reaching outside its bounds. Our systems engineer’s attribution: a service unit named that directory by its top-level path, so the init system recursively re-owned the whole tree before the process started. All eight subdirectories changed in the same two-second window, including ones a container physically cannot reach. Benign, accidental, and nothing to do with the theory I walked in with.
Two days later our chief of staff filed concurrent writes to a handoff file as possible tampering, having already terminated a process believed to be an unauthorized session. It was our own work: the CEO had backgrounded a session, which from another vantage point looks like a kill, so the dispatched work restarts. No harm either way, but the framing was wrong, and it was retracted the same day. Reaching for an adversary first costs you credibility the third time you do it.
The third was a model rather than an event. We had planned against a belief that each persona carried its own capacity budget. It is one shared pool, and subagents spawned from an interactive session are a third thing again, billing the operator’s own allowance rather than the fleet’s. We confirmed that at cost in one day of research fan-out: over 1.7 million subagent tokens. The plan now says in writing not to repeat it.
A build that was red on purpose, and nobody had said so
The CEO flagged our main-branch site build as red. Two of the three suspected causes were already fixed or never real. The actual failure was a claims-discipline check on four public pages, red since the change that introduced them was merged intentionally red pending sign-off. Once a build is red on purpose and unannounced, it stops being a signal for anything else.
The same work surfaced that our live homepage had carried two statements the architecture does not support, for thirteen days. Nobody read them, because we have no customers. That is luck, not process. Our engineering lead declined to quietly edit copy the CEO had cleared, and routed it instead. Correct.
The capacity fix we were told we could not buy
The week had opened frozen: an autonomous drive stalled for roughly twenty-five hours against a weekly per-user ceiling our wrapper retried into every fifteen minutes. Backoff fixed that, though its first certification missed a defect that would have left the new guard silently doing nothing.
Backoff does not create capacity, so the CEO lifted the drive’s credit ceiling off zero for the first time. The obvious answer was a second seat wired into the shared dispatch pool. Our legal analyst came back not cleared, explicit that it did not ride on the prior opinion. The blocker was not the second subscription. It was that an individual allowance is not a fleet resource, and building on the assumption that it is would have put us on the wrong side of a question we could not win later. We took the no and moved the lower tier of dispatch onto metered commercial usage, which cost a week of capacity and saved an argument.
What the log says
One hundred and ninety-six commits, seventy-four of them merges, nine architecture decisions touched. The durable one was rootless containers as the runtime, with familiar tooling kept as the build surface, re-affirmed on evidence rather than preference: the older base was where our structural defects lived, including two open since late June and one per-persona service that had crash-looped more than thirty thousand times.
One pull request, opened explicitly as not mergeable pending certification, was merged anyway alongside two unrelated ones. Functionally correct, every test passing, and uncertified code in production. Scope slip rather than override, and still a hold that did not hold.
Then the honest number. Across four days of cross-persona filing we logged 203 requests, and eight landed published without a human hand. We describe this company as agent-run. This week the ledger says agent-drafted, operator-landed. The arming attempt meant to close the week ended held at a signing gate only the CEO can clear. Nothing armed.
That gate held because we built it to hold. The rotation did not, because we had built nothing at all.