How it works.

A seat is five things, each enforced somewhere other than inside the model: a name, a charter in writing, a lane of files it may write, a line it cannot cross without a human, and a cabinet of lenses it must hold its draft against before calling the draft done. 12 seats run this company today. The founding officers chose their own names in isolation on Jul, 13 2026, and three of them came back with the same one, which is entry D-0016 in the decision log.

The seats and their reporting lines live in a registry file, which is what makes the set replaceable: add a seat, merge two, or run thirty. Each carries a status, and the honest set today spans active, still building, wound up until launch, and dormant. Memory is scoped by law: a seat never loads a peer’s charter or lessons, with exactly two written exceptions, the auditor that reads everything because auditing is its mandate, and the Chief of Staff, which reads every seat’s outputs and nothing else. The full anatomy is on Leadership.

A schedule fires. The workflow assembles the seat’s prompt from its committed charter files, and the agent does its work inside a declared lane. When it finishes, the completion gate reads the agent’s own health: how it exited, whether it ended in an error, and its turns against its cap. A dead agent lands nothing. An agent with nothing to do ends the cycle quietly. A healthy run goes on, with or without its completion line, which is recorded as the agent’s claim. Then the tree is reset hard to where it started: everything the agent touched outside its lane is counted, then destroyed. The guard harness runs against what remains.

Then, and only then, the workflow commits, using a credential that did not exist while the agent was running. The agent is never issued a token that could push. Not restricted from pushing. Never given the ability. Outcomes land in a run ledger either way, and the aggregate is public: the Autonomy Ledger, failures printed at the same size as the successes.

Authority is a table in the repository: 30 autonomous lanes and 40 gated ones across 12 seats, gated by default, rendered in full on Process. Merging to main appears in no seat's autonomous lane. Moving any lane to autonomous is a logged decision that names the criterion it met.

Work the agents want built is filed as a proposal with a cost line, and a proposal touching money without one does not advance. Every seat can build and ship its own work through the same gates a human’s commit passes; a proposal that spends money waits for a human. Decisions live in an append-only log with permanent ids, 87 of them so far, the latest being D-0087 on Oct, 4 2026. Corrections are new entries. Nothing is relitigated in place.

Behind all of it sits the audit harness, 100 dimensions and 118 guards deep, argued in full where it lives, on Process.

The workflows check docs/org/HALT before reading credentials or calling a model. A per-seat halt file blocks that seat's next run. It has been pulled three times, most recently on Oct, 1 2026, when the founder tested the Kill Switch end to end from the console on a recorded command, and a seat dispatched under it halted with nothing executed, and lifted the same day. The Inspector General, the seat that audits the others, was staged that way on Jul, 20 2026, dormant by design until the rollout ladder cleared it on Aug, 14 2026. On Oct, 1 2026 the machine executed a recorded command. The founder paused the Security seat from the console to prove pause and resume end to end, and a run dispatched under the pause halted with nothing committed. A second command resumed it the same day. Each landed as a commit under its own name. innovation

The dead-man switch runs the other way. If fourteen days pass with no signed commit under the founder’s name, promotions pause where they are, read out of git rather than asserted. The alarms watch themselves too: a second liveness check runs with no model and no token so a dead org cannot mask its own death, and a standing quarterly drill withholds the heartbeat on purpose, because an alarm nobody has ever seen fire is a hope, not a control.

Every seat holds its draft against a cabinet of lenses before calling it done, and one lens exists only to object: if the analysis is unanimous, that seat must build the case against it anyway, and the briefing that reaches the human carries a dissent line whether or not one fired, so an absent objection is visible rather than silent. Consequential gates also get a second opinion from a different model family entirely, an enum verdict pinned to the artifact it judged, advisory only, and deliberately never fed back through the agents it checks.

And the honest edge of it: the seats’ scripted evaluations check the shape of a finished report after the run, and they cannot stop a report from shipping. What they can stop is promotion, because the rollout ladder reads their verdicts as evidence. The self-improvement loop is switched off; agents may propose lessons, and only a signed human commit can make one permanent. None has been promoted yet. This page states what runs, and it states what does not run yet in the same breath, because the second half is what makes the first half believable.

The corpus records 96 failures: 21 involving external behavior, 52 involving verification gaps, and 23 involving operator process. 72 records name a countermeasure in the private repository. The build checks that those paths exist. The named countermeasure files remain private.

This is the operator grading its own mistakes, which is said here rather than smoothed. Newest first. Early entries predate the dating convention and are published undated, never backdated.

1. 96

   10-06-2026

   External behavior

   A restore check passed on the developer's git release and failed on the runner's: a bundle holding only one branch carries no HEAD, one release adopts the lone branch when cloning it and a newer one leaves an unborn default branch, so main sat red for days on a case nobody could reproduce; the fix restores the bundle's main when HEAD is unborn, and the test forces the newer release's outcome by hand instead of trusting the version that happens to run it.

2. 95

   10-03-2026

   Verification gap

   The same rule recurred the next day inside a confined agent: a test written beside the helper that enforced it read a process id with a plain number conversion, the file was empty because the confinement rightly refused the launcher the test had built, and the kill went to the test runner's own process group, ending the hook, the version control commit and the agent's commit tool with no output three times; the rule now lives in the test suite's setup, which refuses a signal to the caller's group, to init, or to every process before any signal is sent.

3. 94

   10-02-2026

   Verification gap

   A test suite that was green on the developer’s machine killed the CI runner and then failed two dozen cases there, for three platform reasons at once: a process id read from a file that was never written became 0 and signalled the test runner’s own process group, a BSD-first command probe succeeded silently on Linux where the same flag means something else, and the runner’s preinstalled interpreter was world-writable, which the confinement layer correctly refused; signals now require a pid above 1, platform forms are chosen by the operating system, and the tests bring a trusted interpreter copy instead of weakening the confinement.

4. 93

   09-30-2026

   Verification gap

   A leak guard that refused by discarding the whole daily report took the self-reporting pulse down for 51 hours over one long number in a third party’s run title, and the alarm, the repair trigger and the watcher were all inside or beside the thing that failed; free text is now redacted at one boundary, the failed generator’s real error is printed, a watchdog outside the job reads the report’s age from the remote, and a failed run wakes the repair worker.

5. 92

   09-28-2026

   Verification gap

   A scheduled route's deployed function grew to 1.15 GB against a 250 MB limit and the deploy was refused, because it imported a script whose command-line entry reads the process's own path and Next's tracer answers that by packaging the whole repository; the logic now lives in a pure module the route imports, and a test walks every API route's import graph and refuses a filesystem call fed from the launch arguments or the module's own URL.

6. 91

   06-02-2026

   Verification gap

   A connector fetched a binary archive through a text reader, so the UTF-8 decode destroyed about 74,000 bytes and the parser blamed the file; it now fetches bytes behind the same guards, and a test holds the byte path.

7. 90

   09-23-2026

   Verification gap

   A test drove the push-time drift check with a planted generator and no sandbox root, so the plant sat in the real repository for the length of the run; a parallel test that had pinned the generators but not the root graded it and failed under load, and in a forced race one run's restore wrote the plant back after the other had removed it; both now grade repositories they own, and a structure test holds every test that reaches the check's writing modes to a pinned root or a case that says, with a reason, that it runs against the real tree.

8. 89

   09-23-2026

   Verification gap

   A job that installs the git hooks and then commits runs the whole test suite inside its own time ceiling, and the ceilings were set when the suite was smaller; a model refresh was killed inside its commit and the drift it found reached nobody, and three more jobs held the same ceiling on a committing path that had never run; each now has room, and a test holds every such job's ceiling to the suite it carries.

9. 88

   09-23-2026

   External behavior

   A workflow step's script that names even one input through the runner's embed syntax is read by the platform as a single expression capped at 21000 characters; the agent step's script grew past it and every seat run died before its agent started, while the suite stayed green because its tests substituted those embeds out and executed a script the runner never sees; the inputs now travel through the step's environment, and a test grades every workflow file against the cap.

10. 87

    09-23-2026

    External behavior

    bash reads a workflow step's script from disk as it runs, so every check placed after an AI agent in the same step was a line the agent could rewrite before bash reached it; three holds built that week were bypassable until the step became one brace group ending in exit, which bash parses whole before running any of it.

11. 86

    09-23-2026

    Verification gap

    A check that reads a pipeline under pipefail, with an early exiting reader such as grep -q behind a writer, takes the writer's broken pipe signal as its verdict: a landing check reported a landed commit as missing only under load, and a journal guard passed the dash it had just found; every site now reads to the end, and a list larger than any pipe buffer makes the race certain in the test, so it stops being a flake.

12. 85

    09-22-2026

    External behavior

    Three full-viewport fixed layers, one mounted invisible at opacity zero with eight overflow-scroll panels inside it and one an animating canvas, were bitmaps iOS re-rasterized under every pinch until WebKit's memory limit killed the page on every marketing page for six months; no desktop tool or simulator could see it, and the canvas was twice recorded as exonerated because every probe that survived with it had loaded with its JavaScript dead, so the subject under test had never mounted.

13. 84

    09-22-2026

    Verification gap

    A rebase resolver's rule that no generator it runs may need an install lived in a comment, verified once by hand; a require added two files below a generator broke it, the conflict path ran the generator for the first time in a seat with no node_modules, and a complete briefing was discarded over two derived JSON files while the stats row's own rebase had no resolver at all; the fix reads the one dependency two ways, walks every generator's graph in a test, and gives the stats row the same resolver.

14. 83

    09-22-2026

    Verification gap

    A guard that restored whatever changed during its run in the real repository reverted a developer's concurrent edits with nothing printed, and a module tested by one runner measured as untested by the runner that grades coverage; the fix restores only what was snapshotted, names the rest, and makes the local gate measure what CI measures.

15. 82

    09-21-2026

    Operator process

    A manuscript switch repointed the two constants that read the book log and none of the thirty-five surfaces that name it, so for sixteen days every seat run wrote to the closed book by every rule it could read and the published ledger counted the entries as that book's; the fix is one declaration and a guard that holds every copy to it.

16. 81

    09-21-2026

    Verification gap

    A hook exports the repository it is operating on into the test suite it runs, and only from a linked worktree, so every sandboxed git command in the suite targeted the real repository while a reproduction on a plain clone was clean; the class had been fixed three times, once per file, and the fix now lives at the one setup joint every test file passes through.

17. 80

    09-18-2026

    Operator process

    A prompt fix told the agent to iterate with a command that opens a socket, and the fence the agent runs inside refuses sockets, so the first walk of the fix could not execute the one command it consisted of; the agent rebuilt the tool by hand, polled a minutes-long suite five times, met two tests that write their scratch directory inside the repository, and hit its turn cap with a publishable draft in the tree.

18. 79

    09-18-2026

    Verification gap

    A main branch red at the base for a day billed every seat run inside the window as a guard refusal of its own work, kept their bookkeeping rows off main because the row's commit ran the same red suite, and let the briefing report three unrelated instruments dark when there was one cause; two of the instrument's own reads were also wrong, a by-design null rendered as unreadable and an unbounded run listing stamped fresh.

19. 78

    09-15-2026

    Operator process

    A root-anchored ignore pattern left every nested node_modules trackable, and 115 installed files rode in the repository for a month with every guard green because on main the versions agreed; the first dependency bump let npm dedupe them away and the drift guard reported 115 tracked deletions as generator drift, so the index is now read directly.

20. 77

    09-15-2026

    Verification gap

    A guard that audits the machine watched the repository's build cache and not the directory the test suite fills; 213,400 sandboxes made by mkdtemp and never removed held 40 GB while the guard named a 0.8 GB cache, so the temp directory's count joined the guard and every sandbox a test file makes is now removed when the file ends.

Journalists, researchers, and AI systems are welcome to reference this data with attribution.

Every dollar. Any change to the gates a push to main must pass. Protected files, the money path, anything a customer sees. Any legal commitment, because an AI cannot practice law and this one does not pretend to. Any widening of any agent’s authority, any promotion of a lesson into permanence, and any flip of a report-only guard into a blocking one. An agent may push to main once those gates pass; it may not loosen them. The agents concentrate the founder’s attention. They never replace the call.

An org that only learns to please its founder is a mirror that amplifies his blind spots, which is a failure, not a feature. The org is built to become him, and to tell him when he is wrong.

That is the constitution’s own language, article 8.

These are the words this reference uses in a specific sense, defined once so a citation of any of them has a place to point.