Agent Operations Platform
Making a fleet of AI agents fail loudly
An operating layer that makes a fleet of AI coding agents accountable: routed by cost, stopped at an approval gate before anything irreversible, and measured against its own goals. It exists because of one failure. A tool that returns nothing looks exactly like a world where nothing exists.
The short version
5 beats · about a minute
- 01
The failure
A search across four thousand files found nothing, and reported success.
An ignore rule the agent could not see made most of the workspace unreadable. Exit code zero. No error, no warning, no partial result.
- 02
Why it matters
An empty workspace and a blindfolded search look identical.
Nothing in the output separates them, so the agent concludes the thing does not exist, says so with confidence, and acts on it.
- 03
The proof
The agent could read 2.6% of the workspace.
109 files of 4,138 were reachable. The tool that missed the other 4,029 reported success.
- 04
What we built
Checks that interrupt the command, instead of documents that ask nicely.
Fourteen are wired into the session and five halt a specific action before it runs. Each was written after the failure it prevents, never in anticipation.
- 05
What changed
The blind spots have names now.
A search rooted where it would be blinded stops and asks. A scheduled job that goes quiet gets reported. The nine jobs still impossible to watch are printed by name on every run.
The measurement
Measured 21 August 2026
The search reached 109 of 4,138 files, and reported success.
- Markdown files on disk
- 4,138Markdown files on disk
- Reachable by the agent's search
- 109Reachable by the agent's search
- Exit code it returned
- 0Exit code it returned
2.6% of the workspace. The remainder came back as an empty result rather than as an error.
How to reproduce — Count the markdown files on disk, excluding dependencies and build output, then count how many a search honouring the repository’s ignore rules can reach. The difference is what the agent cannot see, and no part of the output reports it.
Note — Described at the architecture level. No credentials, internal rules, client data, or operating costs appear on this page.
- Role
- Architecture + Engineering
- Year
- 2026
- Category
- AI Architecture
Stack
- TypeScript
- Python
- Bash
- SQLite
- Model Context Protocol
- Multi-provider LLM routing
02The problem
An agent that fails loudly is a bug. An agent that fails silently is a liability, because the operator has no signal that anything went wrong and neither does the agent.
The clearest example in this system is a search. The workspace root carries a catch-all ignore rule, and every search path honours it. Running a recursive content search from that root returns zero results and an exit code of zero. No error, no warning. Measured against this tree on 21 August 2026: 4,138 markdown files exist on disk, and a search that honours the ignore rule can see 109 of them. The other 4,029 are invisible, and what the search reports is nothing at all.
An agent reading that zero concludes the thing does not exist, says so with total confidence, and acts on it. Nothing in the output distinguishes an empty workspace from a blindfolded one.
The same shape recurs everywhere once you look for it. A scheduled job that only reports on failure looks identical whether it is healthy or dead. A cost feed froze and kept serving a stale figure that still read as authoritative. A commit message said a change was not deployed, went stale within the hour, and a later audit inherited that claim instead of re-measuring.
03The idea
A tool returning nothing is a fact about the tool, not a fact about the world.
That sentence is the whole design. Every silent-failure mode above is the same error: treating absence of signal as evidence of absence. So the system is built to make silence impossible to misread rather than to make agents smarter.
The second principle is that written rules do not bind. Several of these failures had a rule against them already, in a document loaded into the agent's context on every single turn, and the failure happened anyway. Prose is advisory. A pre-flight check that interrupts the specific command is not. Rules became executable, and each one was written only after the failure it prevents had actually occurred, never in anticipation.
04Build
Fourteen checks are wired into the session lifecycle, and five of them interrupt a specific command before it runs. Each exists because of a measured incident, and each interrupts a specific action rather than lecturing in general. The search guard asks for confirmation whenever a search is rooted where the ignore rule would blind it, and asks rather than blocks, because a blind search is misleading, not dangerous. An outbound gate stops deploys and publishes. A collision guard flags a whole-file write when another session touched the same path recently. A browser guard scopes each session to its own browser, after a shared session let one session screenshot a page a different session had navigated to.
Work routes by cost. The orchestrator holds comprehension and routing and does no bulk work itself; mechanical sweeps drop to the cheapest tier, well-specified execution to the middle, and anything touching money, compliance, security or a public claim stays on the expensive tier and is never delegated.
Durable facts live in plain markdown rather than in a vector store, because a retrieval index that silently returns nothing is the original failure wearing a different hat. Retrieval suggests; it never decides.
A heartbeat watches eleven scheduled jobs by checking the age of the artifact each one is supposed to produce, and speaks only when a job goes quiet. Nine further jobs are listed by name as unmonitorable, because their output never lands locally. That list is the point: an uncovered blind spot that is written down is a known risk, and one that is not is an assumption.
- AI Systems
- Agentic Workflows
- Creative Technology
05Result
The silent zero is loud now. A search rooted where the ignore rule would blind it stops and asks before it runs, so the blinded case has to be acknowledged instead of absorbed. A scheduled job that stops producing its artifact gets reported rather than passing for healthy. The nine jobs whose output never lands locally are printed by name on every run, which turns an invisible gap into a listed one.
The scale it runs at: 322 commits in the core operating repository between January and August 2026, alongside 53 skills, 14 wired checks and 1,380 markdown files of canon in that same repository. Those are counts as of 21 August 2026, and they carry a date because every one of them had moved by one within a day of first being written down.
The honest result is the one the system produced about itself. Its own drift audit, run on 20 August 2026, counted 375 commits across the three repositories it compared over the preceding thirty days — a different scope from the figure above, which is one repository across eight months. Of those 375, about 197 went into governance, hooks and memory architecture against 178 into the actual shipping product, with zero commits touching the outreach documents tied to the stalled top priority. A platform built to get work done had put more commits into governing itself than into the product it exists to ship. That measurement is what triggered a freeze on new tooling.
The same audit then retracted its own highest-severity finding after re-measuring the live system and discovering the claim had been inherited from a stale note rather than observed. The rule it wrote for itself afterwards is the one worth keeping: still open is a measurement, not an inheritance.
A governance layer whose own audit catches it over-building itself, and then catches its own audit being wrong, is the strongest evidence available that the measurement is real rather than decorative. There are no uptime or accuracy figures here, because the honest version of this project is the one where the instrument is pointed inward.
06Contribution
Split five ways on purpose. Overstated authorship is the fastest way to fail a follow-up question, so what was conceived, designed, built, AI-assisted, and taken off the shelf is stated separately.
- The governing principle: a tool returning nothing is a fact about the tool, not about the world.
- The rule that executable checks replace prose, and only after a failure has actually happened rather than in anticipation.
- Routing by cost, with an explicit list of categories that may never be delegated to a cheaper tier.
- Naming the unmonitorable jobs out loud, so an uncovered blind spot stays a known risk.
- The approval boundary: which actions are reversible and in-lane, and which stop and ask every time.
- The layering of durable markdown canon against a retrieval sensor that suggests and never decides.
- The escalation tiers that decide what interrupts the operator and what waits for a briefing.
- Specification and acceptance of each pre-flight check against the incident that motivated it.
- The audit practice that measures the system against its own stated goals, including when the answer is unflattering.
- Review of every change to the governing documents.
- Most of the implementation code — the checks, the heartbeat, the sync scripts — was written by AI coding agents from my specifications and under my review.
- The system runs on multiple model providers, and routes work between them by cost and by risk.
- Anthropic, OpenAI and DeepSeek model APIs.
- Model Context Protocol for tool access.
- Git for durable history. SQLite and JSON for derived state.
- A third-party issue tracker as the system of record for tasks.
What this demonstrates
Systems thinking
A smarter agent would not have helped. The change was to what the tools are permitted to leave unsaid, so that a failure has to announce itself.
AI-agent reliability
The agent had already read a document forbidding exactly what it did. Prose does not bind; a check that halts the specific command does, which is why every rule here is executable.
Observability
A job that speaks only when it fails is indistinguishable from a job that is dead. The ones that cannot be watched at all are now listed by name, which keeps an uncovered gap a known risk.
Engineering under ambiguous failure
The hard part was noticing there was a bug at all, while the system’s own output said everything had gone fine.