A terminal-native runner looks like a CLI task: parse flags, call a host, print a result. That framing hides the real problem. The surface sits beside lifecycle authority, process dispatch, durable operational records, and mutable worktrees. If it can start workspace-writing work, it needs a structu...

Adding a bounded AI worker looks like a subprocess feature. It rarely is. The real work is integrating package identity, lifecycle admission, host authority, provider capability enforcement, process supervision, payload storage, and empirical CLI behaviour — without turning the worker layer into a s...

A control that has only ever returned green has not yet proven it can catch what it claims to catch. Passing results are necessary. They are not sufficient. The missing half is executable negative evidence: a mechanism that fails against the real unfixed baseline, runs on the content you claim to ha...

The failure that blocked a usable package was not a missing file export. It was structural: no root contract, no compiled output or declarations in the shipped artifact, and an install from the published tarball that could not run. Opening the existing engine barrel would have made the package “work...

A test suite going green tells you one thing: the assertions you wrote passed. It does not tell you that the property you actually care about holds. Those two things usually overlap. On a recent piece of infrastructure work — a system meant to coordinate independent actors under a set of hard invari...

When a long-running worker times out, cancels, or fails, the obvious response is to kill the process you started. That often looks like progress and leaves the real hazard intact: shell wrappers, package managers, builds, and pipelines keep running — or get reparented under something that no longer ...

Long-running automated work usually persists its position as a stage name. That is enough to describe where the work got to, and not enough to describe what it was doing. When a single stage can stand for more than one pending operation, a crash in the wrong moment leaves you holding a label instead...

When a system's own audit output was mistakenly treated as a source-code change, every audit run invalidated itself the moment it completed. The fix wasn't excluding a folder — it was building a principled boundary between the thing being verified and the evidence describing it.

The problem

Any sy...

Post-audit normalization that asks a producer to emit structured output without supplying the actual schema, valid examples, or trusted identities will fail unpredictably. Treat schema, validation, identity binding, and failure evidence as one versioned contract surface.

The problem

A common patte...

When a team allows work to be revised and reworked — a document, a plan, a piece of code — there is an easy trap: assuming that "prevent stale overwrites" is a small file-comparison problem. It isn't. It's a lifecycle-contract problem, and treating it as anything smaller tends to produce a fix that ...

When an actionable review disposition never reaches the router, the defect looks like a broken route. Often the lifecycle already works. The real failure is a producer–consumer contract mismatch: the review emits a disposition the controller does not recognise, so an actionable result collapses to u...

When you add a way to re-enter a long-running workflow, the natural instinct is to design around the stopping point you can see. Usually that is the place where the process is visibly waiting for a human. But a workflow that pauses in one obvious place almost certainly also parks work in several les...