What was built in three days?

A working path from an agent's request to a check at the destination, running on Kubernetes:

1. Authenticated agenta signed assertion, replay-proof
2. Policy graphmay it, and by which legal routes?
3. Partition-owned capacityall-or-nothing leases, never overspent
4. Signed path grantnames the lease, the route and its hops
5. Sidecar verificationat the destination, before any data moves

Here's the unusual part: most of the implementation and review work was done by coding agents operating under a rulebook. A human set the goals, made the consequential calls and held the keys to anything that costs money or leaves the machine.

How the system itself works is on the Docs page. This page is about how it was made, what changed on the way, and what evidence backs it.

1How did we build it?

A file at the root of the repository, the agent working agreement, binds every agent. It is policy, not magic: the project's living record states separately which rules are enforced by code and which are only followed. The agents run inside a harness that routes each job to a suitable model (strong models for hard work and review, light ones for searches and mechanical edits), loads written procedures (skills) when a task needs them, and checks that the living record still matches the code.

Two code rules: the runtime uses the Python standard library only, except the member that signs tokens (two pinned, hash-locked cryptography packages that passed a supply-chain check); and imports flow one way through layers, enforced by tests in each member.

2Timeline

One line per phase. Open a line for the detail.

1. before 29 SepBaseline · a single-constraint lease ledger

   A single-constraint lease ledger with 10 tests and one recorded 14-worker benchmark already existed. The repository history starts from it.

2. 29–30 SepGraph algorithms · every algorithm against its own oracle

   A 197-row canonical fixture with five fictional customers, then BFS, strongly connected components, topological order, Dijkstra, Dinic max-flow, bounded path enumeration and an exact assignment search. A census records the policy gap (4 → 2). Fitted scaling exponents came out at 0.98–1.00. The whole-branch review covered 40 commits and a 606-test suite: 0 critical, 0 important, 11 should-fix. Of 25 planted mutation probes, 23 were caught; new tests now catch the other 2.

3. 30 SepPolicy bitmaps · a fast index that must agree with a plain scan

   25 mutants, 0 survivors. Review found one important hole: an allow without the owner-scope condition fired for any tenant's agent. Such rules are now refused at compile time.

4. 30 SepRules for unattended runs · the night loop, a spend cap, a dependency check

   The rulebook gained its unattended-mode section, the standing cloud authorization with its spend cap, and a security check for any new dependency.

5. 30 Sep – 1 OctMulti-constraint lease · all-or-nothing across many limits

   Built beside the untouched original so the two can be compared. The lease suite grew from 10 to 72 tests, with 20 of 20 mutants killed.

6. night → 1 OctFirst unattended run · one controller per track

   Finish the lease, then the PCA maths, then log evidence. Every blocker went through the one-advisor procedure (§5).

7. 1 OctPCA maths · drift detection as a library

   Windows, scaling, covariance, Jacobi eigenvectors, drift between windows and a whitened distance. Every degenerate case returns a named status. On the long benchmark Jacobi was 19× faster than power iteration at 4 features and 5.2× at 64.

8. 1 OctLog evidence · results checkable from saved files alone

   Name-only evidence files plus an independent checker that re-derives every invariant. A separate advisor model reproduced 2,767 answers from the files alone, and all agreed. Closed PARTIAL: same model family, isolation by instruction only.

9. 1 OctDesign drafts · seven designs, reviewed twice, still DRAFT

   Seven designs for the rest of the system. Seven reviews all said "revise". The drafts contradicted each other in 49 places, so one integration contract reconciled them. A follow-up review found most findings addressed and some new ones; the one-follow-up limit stopped the track there (§4).

10. 1 OctThe POC sprint · 8/8 end to end on two clusters

    The human pre-approved the recommended options and asked for a working POC. A thin spec cut the designs to the smallest slice that runs end to end; four implementers built it in parallel. 8/8 on Minikube, twice, then 8/8 on a managed cluster created inside the spend cap. An independent review found four important issues; all were reproduced and fixed the same day, and 8/8 passed again on both clusters.

11. 1 OctUI and these pages · a simulator and a read-only live view

    A standard-library web server and a single-page simulator on the canonical fixture, with a read-only snapshot of the live services. It runs in the cluster as the seventh core process under a strict content security policy.

12. 1 OctAgents on the data plane · seven task-named agents and a grant-gated store

    Six agents train small models on public datasets fetched through grants; a seventh is always denied. The node was upsized one tier (1 vCPU / 2 GiB → 2 vCPU / 4 GiB) under a cap the human raised for it, and 8/8 passed on the new node. A default-deny network policy went in with them.

13. 1 OctPublic UI · the read-only site behind one TLS load balancer

    After the human confirmed the DNS plan, the read-only UI was published over TLS only through one connection-throttled cloud load balancer, serving synthetic data. The DNS record was still pending when this page was written.

3What hypotheses changed?

The early working notes warned that the most interesting drift would be architectural, not statistical: an invariant that is correct on its own stops being enough once time, retries, replicas and stale state appear. That is what happened.

• Ledger safety became distributed ownership. The static split keeps "never overspend" per partition, because no unit has two owners. Review then found the retry hazard the notes predicted (§4).
• Classic DRR became capacity-aware DRR in design review: credit that piles up while nothing fits turns into a future burst, so the draft caps it.
• "Same spectrum" is not a real null. Two matrices with the same eigenvalues can have different eigenvectors, so the drift-penalty design's null test now uses one fixed matrix and two sample seeds.
• Algorithmic versus systems correctness. Max-flow is exact on the canonical graph, while the partition split can still strand capacity (fragmentation).

4What did reviews catch?

Each of these passed its author's own tests and was caught by a reviewer, an oracle or a mutant. Red is before, green after.

Design reviews: better, not perfect

The drafts contradicted each other in 49 places, mapped onto 16 topics in one integration contract, with 8 decisions left for the human. The re-review also flagged 32 places where a draft had settled something that should have been the human's call. The design track then stopped, because one follow-up round is the limit. The POC review of the running code found no critical issue and the four important ones above, all fixed.

5Why were decisions changed?

Most changes of plan came from one of three places: evidence from a test or review, the one-advisor procedure during unattended runs, or a decision by the human.

The disagreement shows why the rule exists. The recommended fix (refuse an empty request rate when loading data) looked clean. The advisor tried it and got 35 test errors, all in policy tests, because policy fixtures legitimately leave the rate empty. The adopted alternative refused the empty value only where a rate is actually used.

Decisions the human made: pre-approving the recommended options for the POC; mutual TLS deferred, so claims are scoped to clients that use the front door; one node size up and a raised spend cap when the agents arrived; fetching the public datasets on the human's own machine, so no dataset credentials ever reach the cluster; a work cap for the evidence checker rather than waiving the check; the PCA tolerance bound; and publishing the read-only UI behind one load balancer.

6What evidence exists?

Hypothesis register

Test suites grew with every stage

Tests were written before code, so suite sizes track the work. All bars share one scale.

End to end, on two clusters

Every later recorded run, after the review fixes, on the upsized node and with the agent workload deployed, also passed 8 of 8. The clusters use different processor architectures (arm64 locally, amd64 in the cloud) and run the same pinned base image.

The cloud footprint

On the smaller node the seven core pods alone already requested 760m of 940m allocatable CPU (80%), so the node went up one size before the agents were added. Billable extras: one load balancer for the public UI; no volumes.

What the agents measured

A 5-minute window on the managed cluster after warm-up, from the logs of all 15 pods. Times are in milliseconds, median / 95th percentile.

The per-agent rows count stats records (142 OK loops); authn and the store count their own log lines (140). The manager logged 140 admits but 142 releases in the window, so two loops had been granted just before it opened. The one extra denial at authn (44 against 43) is likely the same edge effect at the window's end (ASSUMED). Locally, over a 5-minute window of 406 loops, the six allowed agents were 100% OK and the denied agent was refused 67 of 67 times.

• Startup failures before seeding finished. Until the datasets are copied in, the store correctly answers NOT_SEEDED (19 times on the managed cluster, 8 on Minikube, by its own counters). No bytes are served; the window above starts after warm-up.
• The first bottleneck is the download. The 10.6 MB file takes about 3.6 s (median) against 0.8 s locally. The store is held to 100 millicores of CPU and spends about 1.7 s streaming it. More CPU should help, but that has not been tried (ASSUMED).
• Training is about 6–7 times slower than locally (agent-mnist 23.8 s against 3.7 s). Both clusters give each agent the same small CPU limit; the cause has not been isolated (ASSUMED: a slice of a shared cloud vCPU does less work).
• No FULL contention yet. Six agents holding at most one lease each never exceed a route with 6 units per link.
• Smaller observations. One agent-mnist release found its lease already expired (NOT_LIVE), because its training comes close to the lease's 30-second maximum; capacity was freed by expiry, not overspent. Signing one assertion takes about 0.7–1.1 s (median) per allowed agent on the managed node, far more than the grant round trip (about 30–50 ms).

Where these numbers come from

The scenario result files and the agent-workload stats files from both clusters (per-agent records, the store's own counters and the manager's overspend check), the living state-of-the-world record, the POC summary, the unattended-run log, the three design-review data files and the specs. Where a count comes only from an implementer's own run (recorded in a commit message), the data table says so. Memory is resident set size, reported in MiB. Figures that could not be checked are marked ASSUMED or left out.

7What did AI agents do?

"Agents" means two different things in this project. The workload agents on the Docs page are small programs that exercise the system. The coding agents below are AI models that built and reviewed it.

Almost every review was by the same model family as the authors. Agreement there is independence of context, not vendor-independent verification.

8Outcome and what's next

Next

1. Tighten the PCA tolerance bound and add the missing regression test.
2. Decide on mutual TLS and real hop attestation now that the network policy is in place.
3. Give the dataset store more CPU; add agents or lower capacity until FULL contention appears.
4. Measure partition scaling and fragmentation on the local cluster.
5. Get the human's rulings on the pending design decisions; then build fair queuing and wire telemetry into routing.
6. Get one cross-family review.

AuthNZ Lab · a proof of concept. All organization names in the fixture are fictional; all keys are synthetic. See Docs for the system itself and the Simulator to explore the canonical fixture.