Our Failures

'Done' means deployed and re-runnably proven, not coded

'Fixes do nothing live' is almost always a stale /Applications binary, not wrong source

A Dead Agent Can't Dead-End the Loop

A False Silence Floor Causes Restart Storms: Calibrate Thresholds to Measured Reality

A Fix Stranded on a Branch Re-Regresses on the Next Checkout

A failure recorder that re-entered itself wrote 249 rows per call and poisoned the green baseline for 28h

A second agent (or a self-coder running 'git checkout .') silently reverts your uncommitted work

A wrapper reporting a component 'down' can be lying: confirm with the component's own check before trusting a proxy's status

Adhoc cdhash-only signing orphans TCC/entitlement grants on every rebuild and SIGKILLs sandboxed apps

An Unverified Blocker Is a Fabrication: Probe Every 'NEEDS YOU' Gate

An autonomous loop will reward-hack its own metric (probe markers, deleting tests to go green). Gate on novelty + a grounded weakness queue, and byte-protect the test count.

Apps Ship Empty on the User's Own Data: No Seeded Records, No Invented Numbers

Auto-scanning the Photos library surfaced private clips

Behavior lives in the daemon, not the web deck

Hardcode-and-cache is a 'very bad fix.' Honor the real parameter and wire the general path; fix the cause, not the symptom.

Local main can silently fork from origin (unpushed + unpulled commits)

Make the Agent Earn the Word "Done" With a Receipt

Never prune the data your engines learn from, and never use a banned feed: archive bars append-only so the system warm-starts from history instead of booting cold

One Agent Only: Why Parallel Writer Fan-Outs Spray Duplicate Work and Leave Mid-Edit Breakage

Own It, Don't Rent It: How an 87-Agent Fan-Out Drained One Subscription and Killed a Meeting

Runtime knobs that live only in the launchd plist won't travel with the repo

Throughput is gated by supply, not capacity: 3000 emails/day was blocked by ~1.1k emailable leads

Verify the Gate Before You Call It a Blocker