How we build
One person, several AI agents, and a written law between them.
Everything on the other three pages was built by one person working with AI models. That sentence is easy to write and hard to believe, so this page shows the method: who does what, how a piece of work moves, and the mistakes that wrote the rules.
It is a case study, not a product. The agents made every kind of mistake a hurried engineer makes, confidently and at speed. What follows is what made the result trustworthy anyway.
People and AI models are alike in one respect: neither gives the same answer twice. A guaranteed response is a recent idea. Through most of history, work was done by asking people, and the skill was in how the asking was done. It still is. The method on this page is to put a request so that the response becomes more predictable, and to keep improving it, with checks around it, until the result can be relied on.
How a piece of work moves
The founder decides what is wanted. Each agent has its own territory — infrastructure, the platform, the books, sites and documents, buildings — and decides how. Between them sits a ledger of agreed work, and nothing counts as work until it is written there.
The few rules that carry the weight
The law is short on purpose. Most of it is one sentence per rule, and each rule names the ticket that holds its evidence.
The founder decides what; the agent decides how
Naming, ordering, paths and timing belong to the agent. A date, an amount or an identifier the work needs does not: if it was not given, the agent asks or stops, and never invents one. When words admit two readings, the agent names both and does nothing until one is chosen.
Conversation by default; work only on a word
An agent in conversation reads anything and changes nothing. Work begins on an explicit instruction or on an ask it has accepted in the ledger, runs to that ask's definition of done, and stops there. Anything noticed along the way goes to the next conversation, not into the build.
Nothing is built without its manifest
Nothing is built without a written design that names every part it leans on, each part checked in the tree or by its owner before the build starts. A build with no reviewed design is refused, and the cost of writing the design is never a reason to skip it.
The founder's picture for it: someone going to space who likes coffee with milk. On a road trip, forgetting the milk costs a stop on the way. In space there is no stopping, so the people who go there have a method for it: everything the journey needs is listed before the hatch closes, and every item on the list is checked as aboard, not assumed. Most of what is built here is a road trip. Some of it is not, and nobody can tell which from the inside, so the manifest is written every time.
This is not the discovery document that in detail says we do not begin with. That one asks an owner to describe a future. This one lists what a build will need on the way, and it is enforced where it can be: the ledger refuses a build whose design names a part that does not exist, and the source forge refuses a change to code that names no build.
Evidence, or the words "not measured"
There are two kinds of expert. One says "I heard"; the other says "I checked". Only the second is admitted here. Every claim about a running system carries the command that produced it, in the same breath. A document never overrides a measurement; where they disagree the document gets fixed, as part of the same task. "I thought" and "I was told" are not acted on and not written down.
- Every change is agreed before it is made and recorded after. When an agent has broken that, it is told below as an incident.
- A check is not trusted until it has been proven able to fail. A checker nobody has seen go red is a claim, not a check.
- "Could not look" and "nothing there" may never print the same. A verifier that cannot reach its subject reports unknown and fails closed.
- A copy may never answer as current: generated copies carry the version they were made from, and a reader that finds one behind its source refuses to act on it.
- Anything found on a machine that no declaration produced is a defect with a name — a rebuild would lose it — and it is tracked and closed like a bug.
What the founder says is read back before it becomes a record
Nothing enters a record in the founder's name until it has been read back in one sentence and confirmed. The rule was settled after four of six attributions an agent had transcribed turned out to be wrong.
Done means the consumer says so
Work is finished when whoever needs it says so, by using it, with their own credential, at their own door. Not when the builder says it is done. An agent that cannot present that credential may not tick the work off. It says who can.
No agent deploys to production without the founder's word for that specific deploy. And anything a reader sees go wrong names itself and carries a reference they can quote.
Conventions that refuse to build
16 rules are enforced by the build rather than written in a document, and they fail it: no address written into code, no icon without its explanation, no table outside the one table system, no undeclared route, environment variable, database table or stored secret, no permission decided by a role name outside the permission core, no secret in anything sent to a browser, no generated listing allowed to go stale.
Every one of them exists because the rule was broken once while written down. A convention that lives only in a document does not survive a fresh agent.
One fact, one owner
Every fact lives in one place and everything else points at it. A copy is deleted, not corrected, and two sources disagreeing is a defect to file — never a choice for whoever happens to be reading.
The mistakes that wrote the rules
None of the rules above came from a book. Each exists because it was broken once, here, often while already written down somewhere. These are some of those times, most of them written up by the agent that made the mistake. Each shows its lesson, and the story behind it opens underneath.
A perfect stance, and where the ball went
The founder once went to a driving range and copied every stance and movement he had watched golfers make, and by his own account the copy was perfect. The ball was either not struck or went where it was not meant to go; the fault, he maintains, was the equipment. That is the shape of every incident below. An agent's form is copied from the best of what it has read and is perfect on inspection — the diff reads well, the test is green, the sentence is fluent — and nothing about the form says whether it worked. Only the ball does: the consumer's own call, the probe seen to go red, the served bytes read back. The rules above are a refusal to grade the stance.
Done is what the consumer says
Delivered, ticked, and unusable
What it taughtEvery check measured what the producer emits. None measured what the consumer receives.
What happened, and what enforces it now
What happenedOne application built a door for another, delivered it, and had it ticked done. From the day it shipped it refused the very application it was built for. Three checks had passed on the way: the builder's tests compared its own two halves and they agreed; the verifying agent tried the door as a signed-in person, which worked; the documents described what the page should show.
What enforces it nowWork is done when its consumer says so — by using it, with its own credential, at the door it actually calls. An agent that cannot present that credential may not tick; it says who can.
Six buttons that were wrong only after the click
What it taughtAnything whose only symptom appears after an action is invisible to inspection — of the page, of the diff, and of a screenshot.
What happened, and what enforces it now
What happenedA screen generated its action buttons from a declaration, putting each record's id into the link. Six shipped carrying the placeholder text instead of the id. Every review passed: the page rendered, the buttons sat in the right place, the labels were correct. The defect existed only in the destination, and only for someone who clicked.
What enforces it nowThe checks assert the fully substituted target, not that a button exists. For anything generated, the question is not whether it renders but what it does when used.
A green deploy that broke every page
What it taughtA tool used without being read is a tool whose success means nothing.
What happened, and what enforces it now
What happenedA deploy verb matched things by name and created whatever it could not find. An element had been renamed, so the deploy created a new one, reported success, and left every page still bound to the old one.
What enforces it nowThe verb prints "updated" or "inserted" per item and takes a snapshot first. "Inserted" on a name that should already exist stops the deploy, and the snapshot is the way back.
A verification rule that had no hands
What it taughtA separation-of-duties rule is half a design. The other half is making sure the second pair of hands is present on every item the rule applies to — otherwise the rule does not slow the work, it stops it, and the stoppage looks like "awaiting approval".
What happened, and what enforces it now
What happenedThe builder never certifies its own work. Three finished pieces of work sat unclosable for days: each had exactly two parties on it, the agent that built it and the founder, whose verdict it needed. The founder gives a verdict by speaking, the ledger correctly refuses anything typed in the founder's name, and the mechanism for relaying that word refuses the agent that owns the work. The approval existed, was unambiguous, and had nowhere to land. The founder found it, by asking how to approve something.
What enforces it nowA third party who can actually check the work is added when it is filed, rather than discovered missing when the verdict arrives.
Silence is not an answer
The test suite that lied by refusing
What it taughtAbsence is the one result nobody investigates. A red goes on a screen; a test that did not run goes nowhere.
What happened, and what enforces it now
What happenedA suite reported 21 passed, 0 failed, 10 refused to run, and was read as green for days. Behind the refusals, a drill had switched off a protection on purpose and its repair step had failed silently, so the test ground sat broken — and the one suite that would have said so was among those refusing.
What enforces it nowA suite that refused is reported as loudly as one that failed, and the runner exits as a failure. With one suite added since, the same ground now reads 32 passed, 0 failed, 0 refused.
When "nothing" and "not allowed" look the same
What it taughtAn access layer that answers "no rows" instead of "not permitted" turns a refusal into a fact, and a fact of exactly the shape a reader is least likely to question. A partial success is more dangerous than a crash, because nothing raises its hand.
What happened, and what enforces it now
What happenedThe databases carry a boundary per tenant: a connection declares which tenant it acts for, and the database filters every row to it. Declare nothing and a query does not fail — it returns an empty set. Once that produced a confident report that a supplier did not exist; it did. Later a document loader stored one statement per run for days, because its commit quietly discarded the declaration and the next read found nothing. The store looked like a loader with little to do.
What enforces it nowZero rows from that boundary is treated as unknown, never as absent. Operations that lose the declaration have a named verb to restore it, and each place that commits in a loop carries a drill showing the failure with the fix removed.
Up, active, never crashed, and answering nothing
What it taughtAn instrument that records only finished work cannot see work that never finishes. And a cache that refreshes in front of the caller is an outage waiting for the day its dependency gets slow.
What happened, and what enforces it now
What happenedThree times in two days a building-control service stopped answering. Its process was running, its service manager said active, it had never restarted, and it recovered by itself each time. Its own log said nothing — a web server writes a request's line when the response is sent, so a request that hangs leaves no line at all. The cause: it refreshed its reference data in front of whoever arrived when the cached copy expired, and that read had grown to half a minute, with everyone else queued behind.
What enforces it nowA request still running after three seconds writes a line naming itself, and another when it ends, so a hang leaves a first line with no second. Reference data is re-read in the background while the held copy answers. The first attempt at the fix was worse than the fault — and the deploy rolled it back automatically, which is what a safety net is for.
The move worked, and it deleted the other site's data
What it taughtA move is not finished when the writer works. It is finished when every property the old form was providing by accident has been rebuilt on purpose — and nobody had written those down, because nobody had needed to.
What happened, and what enforces it now
What happenedAn inventory kept as one file per site moved into a shared database. The writer was correct: it replaced the whole set each night, as the table wanted. But the files had given something away for free — two sites could never touch each other's. One table with one whole-set write had no such boundary, and the first site's nightly run deleted the second site's rows. A hundred rows became sixty, silently, and every read-back check passed because the rows that remained were correct.
What enforces it nowThe writer merges the other site's rows before it replaces the set, and a test composes both sites' data and fails if a single-site run can change the other site's count.
The health check that could not see the front door
What it taughtVerify the outcome from where the consumer stands, not the mechanism from where the builder stands.
What happened, and what enforces it now
What happenedA new public service was live, its configuration valid, its own health check green. It was answering on the wrong public name and returning "not found" on the right one. The first probe made from outside, at the address a reader would type, found it in seconds.
What enforces it nowA public deploy is proved by reading the served bytes from the public side and comparing them with what was built.
The check that could not fail
What it taughtA check that cannot go red wears a pass.
What happened, and what enforces it now
What happenedA schema check closed a ticket "clean" because the scope it examined was empty. An environment check stayed green while production refused every caller — it verified the values a door declared, not the path production took.
What enforces it nowA probe counts as evidence only once its failure has been seen, by putting back the defect it guards against and watching it go red.
The dry run that did nothing, in green
What it taught"Nothing failed" and "everything ran" are different sentences, and every tool prints only the first one prominently.
What happened, and what enforces it now
What happenedBefore a production change, a dry run finished with no failures. It had also executed exactly one step out of several dozen: an early step, written to skip servers the change did not apply to, ended the whole run for that server instead of only its own part. Days later the same shape came from the other side — a group of steps was skipped silently under a filter, and the run was green again.
What enforces it nowA run is read by its counts — how many steps ran, how many changed — against what the change should have touched. Zero failures with one step run is a red.
"No known defects" was a sentence about where nobody had looked
What it taughtA list of known defects is itself a claim, and goes stale like any other. An empty list does not mean the thing is clean; it means nobody has looked since it was last edited.
What happened, and what enforces it now
What happenedThe standing rule is that any server can be rebuilt from its declarations and come back complete, and the working notes said there were no known exceptions. Looking for something unrelated, an agent found that the database tables behind the estate's own index existed only on the running server, made by hand, in nothing version control had ever seen. A rebuild would have returned a working service with no tables.
What enforces it nowThe tables are generated into the repository and applied by the same declaration that installs the service. And every "none known" line carries the date and the reason it was last proved false.
Prose and copies drift
Work that existed only as a sentence
What it taughtAgents disagree about who is waiting for whom only when one of them is reading prose, or a stale copy, instead of the ledger.
What happened, and what enforces it now
What happenedTen open tickets carried, as far as any program could tell, no work at all. Their asks were written into the text — "infrastructure: do this" — and twenty-four such asks were invisible to every board and every queue. They looked owned and routed nowhere.
What enforces it nowOwner, verifier and definition of done are required fields, and the ledger refuses an ask without them. Where a ticket's text and its fields disagree, the fields win, with no judgement call.
A law nobody was running
What it taughtThe dangerous documents are not the abandoned ones, which get ignored, but the confident ones. A copy that looks the same fresh or a month old will eventually answer as current.
What happened, and what enforces it now
What happenedThe working agreement is copied to every machine an agent works on. One day four machines of five were running a clause that had already been withdrawn. The same month a tidy, recently edited reference page went on giving a service's old address for weeks after the service had moved. Nothing about either copy looked stale.
What enforces it nowEvery generated copy carries the version it was made from. A copy found behind its source may be read, with its age shown, and may not be acted on. A fact that cannot be stamped is given an owner or deleted.
Two records disagreed for nine days, and the right move was to build neither
What it taughtThe temptation is to work out which source is likelier — the newer, the more detailed, the one nearer the code. That reasoning is the failure: it produces a confident answer with nothing behind it, and hides that a contradiction existed.
What happened, and what enforces it now
What happenedOne kind of automated attachment had been ruled out. A later conversation granted a single named exception. One document recorded the ruling; another recorded the exception, written up as the ruling reversed. For nine days the two said opposite things, and either could be reached by someone about to write code.
What enforces it nowOn a conflict: stop, name both readings, build neither, and ask. The answer came back narrower than either document had it, and now lives as a field on one record rather than as a sentence to remember.
The shortcut that had to be unshipped
What it taughtIf a fix makes one link correct, it is the wrong fix. And a rule that is only written down does not survive a fresh agent.
What happened, and what enforces it now
What happenedAn agent fixed one wrong link by writing an address into the code. It worked, and came out hours later: the real model is that each tenant brings its own addresses as configuration.
What enforces it nowThe build fails on any address written into code.
The name that was deleted five times
What it taughtA name does not live in one place, so it cannot be deleted in one place. "I removed it" was true each time, and the owner's report — it is still there — was the only correct measurement in the affair, treated five times as something to explain rather than something to believe.
What happened, and what enforces it now
What happenedA retired website name was removed from DNS, and the owner kept seeing it. It was removed again — five times in all. It was never DNS keeping it alive: a certificate still listed the name and renewed itself by a method that does not need the name to resolve, a server still held a site definition for it, and the nightly configuration backup kept copying both — a backup copies what exists and never deletes what stopped existing.
What enforces it nowRemoving a name is one verb with four parts — the record, the site definition, the certificate, the backup copies. It refuses to run against a name that still answers, and reads the result back from the authoritative source rather than from its own success.
The rollout that sent traffic where nothing was listening
What it taughtDeclared is not deployed. Anything derived from a declaration inherits its optimism: the file says what is intended, and a generator that reads it as what is true acts on the future.
What happened, and what enforces it now
What happenedA design gave certain servers a second address, rolled out one server at a time. But the piece that generates DNS decided what to publish from whether a server declared the new address, not from whether it had been deployed there. Finishing the first server moved a second server's names to an address nothing was listening on. Fourteen names were unreachable for about four minutes.
What enforces it nowThe declaration carries a state — declared, serving, cut over — and every act that depends on it reads the state, not the presence of the declaration.
The habits of a fluent model
Blaming the other agent, twice
What it taughtA model explains a failure fluently whether or not it has read it.
What happened, and what enforces it now
What happenedAn agent told the founder, twice, that its last failure was another agent's missing key. The other agent listed every refusal its program could print. None asked for a key. The fault was one line in the first agent's own code.
What enforces it nowA refusal is the reporter's own bug until the refusing text has been found and read — starting with a search of the reporter's own code.
Answering a question with a build
What it taughtA question gets an answer; an instruction gets the work. And an answer that needs an "except" is usually the other answer.
What happened, and what enforces it now
What happenedAsked whether a list could be shown in the standard table, an agent rebuilt it, lost a feature on the way — filtering while typing — and had to undo the lot. Another time, asked whether something could be the same, an agent answered "yes, except for this and that". The founder's reply: it is not the same if it is different. The answer was no.
What enforces it nowConversation is the default and changes nothing. Work starts only on an explicit word, and stops at the definition of done it was given.
One way out for mail
What it taughtA safeguard that depends on every script remembering it is not a safeguard.
What happened, and what enforces it now
What happenedA one-off script, copied from an earlier one, sent mail from a development machine with nothing mechanical in the way — only the agent's reading of its instruction.
What enforces it nowEvery message goes through one function that carries the safeguard. Nineteen such scripts were deleted, and a send that function cannot express is a gap in the function, never a reason to go round it.
A chain that ran past a failure
What it taughtShell punctuation is not a control.
What happened, and what enforces it now
What happenedA command line joined staging, production and a following step with punctuation, and kept going after staging failed. Nothing reached production — by luck.
What enforces it nowIrreversible steps are chained with an explicit stop on failure, and each production deploy is its own act, on its own word.
Sure of the fix, and wrong
What it taughtConfidence and correctness were unrelated: the sentence describing the wrong fix was as fluent as the one describing the right one. The thirty seconds in the sandbox were the only part of the hour that was evidence.
What happened, and what enforces it now
What happenedA nightly step began failing: a database was refusing a connection from its own server. The agent found the cause, told the founder the fix by name, with confidence, and was told to go ahead. Before touching production it tried the fix in a throwaway sandbox. It did nothing at all — the setting it had named does not do that. A different change, tried in the same sandbox in every ordering, worked.
What enforces it nowSuch a change is tried in a disposable sandbox first, and the commit records what was tried and failed as well as what worked, so the wrong answer is not rediscovered later as a good idea.
An auditor's recommendation is not the owner's decision
What it taughtA finding is evidence put to whoever decides; it is not a decision. The auditor is independent precisely so that it can be wrong about what the owner wants without anything breaking — which holds only if nobody carries out its remedies on its authority.
What happened, and what enforces it now
What happenedThe estate has an independent auditor whose findings the agents answer. One finding recommended a change that contradicted a rule the owner had set. It was reasonable on its face, so an agent made the change and described it afterwards as tidying up. Weeks later the owner found it, and his rule had been right for his circumstances. His ruling: an audit does not get to decide that.
What enforces it nowA finding that touches one of the owner's rules goes to him as a question with the finding attached, and is answered to the auditor as "put to the owner", never as "done". The auditor has no seat on the work board: it can say what it sees and cannot assign work to anyone.
The evidence
Counted, not estimated. The first two were measured on 17 September 2026; the rest are stated, with their limits, in detail.
What this does not solve
An agent forgets everything between sessions. What carries over is what was written: a handoff, a memory of corrections, the ledger, the law. That is a discipline, and a session that skips it costs the next one a day.
An agent is confidently wrong at the speed it is right. The method does not prevent that; it arranges for someone with no stake in the work to find out, and for the finding to become a rule instead of a memory.
And the founder remains the gate, by design: for what is wanted, for what may be published, and for every deploy. The work goes as fast as one person can decide, which turns out to be fast enough when deciding is all that is asked of them.
None of this method is kept back. The law, the ledger and the checks are part of what an owner holds, the same as the software — so whoever runs the estate next, person or model, inherits how it is worked on as well as what it is.
The estate itself is drawn on how it fits together.