Mutaaf Aziz · The AI-Native Manifest
Like whatyou see?
Every game, app and site on this wall is me and my agents, beautifully orchestrated by the best AI-native SDLC you’ve seen. Open any of them. Then keep scrolling and I’ll rewind it, from the finished work back to the first line of the contract.
Cold GasA roadster stunt game with verified scoresOpen it
HearthOne remote for every TV in the houseAt App Review
OUTATIME 88A neon time-travel arcade racerOpen it
The LibraryThe leadership books I keep returning toOpen it
Moon ClubLearn the market by playingOn the App StoreThat store art? An agent briefed it and an engine rendered it. The search listings, the ad slots and this page came out of the same system.
Every claim below comes from a repo, a log or a store record. A script audits the repos every night, and the failures stay on the page.
7 ft
So how did all of that get made?
The line becomes a loop
Keep scrolling and watch it bend. Software used to move through people in a line. Where we’re going, we don’t need handoffs. It moves through a schedule, under rules a machine can enforce.
Before. A line of handoffs. You commit first and learn last.
Contract → run → gate → observe → rewrite the contract
9 ft
Where did the team go?
Who does each job now
Fifteen jobs that used to need separate people or teams. The human column gets shorter, and what stays in it is direction and anything involving money or trust.
| Stage | Before | After | Mechanism |
|---|---|---|---|
| Decide what matters | Leads in a meeting | You | control.json focus, edited from a phone |
| Find the next work | PM + backlog grooming | Agent | Scout: 3 tickets a run, queue cap 10 |
| Write the spec | PM, then review | Agent | Ticket file checked by check-backlog.mjs |
| Write the code | Engineers | Agent | Builder, one ticket per PR |
| Write the tests | Engineers + QA | Agent | Test first, unit or Playwright |
| Review | A teammate, when free | AgentMachine | Fresh subagent; verdict required on fleet repos |
| Merge | Whoever remembers | Machine | Auto-merge only on green CI |
| Deploy | Release manager | Machine | Workers Builds, about 35 s |
| Watch production | On-call rota | AgentMachine | Keeper + /obs/digest |
| Fix what broke | Next sprint | Agent | npm run heal turns signatures into tickets |
| Store screenshots and video | Designer + agency | AgentMachine | Lobby: agent briefs, engine renders, lint checks |
| SEO and AI answers | Marketing | Machine | Playbill at the edge, crons, refusal rules |
| Ads | Ad ops | Machine | Marquee: kids rules in code |
| Submit for review | Release manager | You | Human go. Needs --yes |
| Money and accounts | Finance + legal | You | Parked with the exact click |
10 ft
What does it look like, end to end?
Ten stages, counted down
From what it costs back to the first idea. Each card shows how a stage runs, what stops it, what comes out and what has already broken. The tags come from an audit of the repos.
10 Spend
Partly enforced- How it runs
- A free status check before any model wakes. Free tiers first. An effort index per merged PR.
- What stops it
- Workers AI capped at 700 calls a day on Cold Gas and 30 per IP-hour on Metaphases. The merge gate stops agents at their expiry date. The fleet’s daily budget cap exists and is switched off.
- What comes out
- 3,012 fleet runs recorded
- What broke
- Idle hourly loops dominated effort per merged PR. Cloud routines have no cost log yet.
09 Measure
Partly enforced- How it runs
- A deterministic nightly scoreboard. PostHog and /obs/digest per app. Two apps collect nothing by design.
- What stops it
- CI fails if a published number drifts from the data.
- What comes out
- Numbers no model touched
- What broke
- The scoreboard missed the active repos until this page’s audit, and the repo audit below is one day old. No funnel crosses apps.
08 Grow
Unproven- How it runs
- Lobby for store art. Playbill for search and AI answers. Marquee for ads. Launchers for distribution.
- What stops it
- Lobby lint fails bad claims. Kids ad rules live in code and agents get a 403 on protected settings.
- What comes out
- Every channel fed from the repo
- What broke
- Baseline: no owned URLs in 33 searches. AdSense in test mode at last check. Days to weeks old.
07 Submit
Partly enforced- How it runs
- Scripted App Store Connect flow, review notes kept in the repo, a rejection log with one rule each.
- What stops it
- store-check exits 1 on blockers. Submit needs --yes. Lobby cannot submit at all.
- What comes out
- A version in review
- What broke
- Four apps rejected under 4.3 and 4.2.6 in one minute. Moon Club was approved on its third try, on Nov 9.
06 Operate
Partly enforced- How it runs
- Keeper checks main and production. /obs/digest reports error signatures and frame times. An expiry alarm opens an issue before agents stop.
- What stops it
- npm run heal files tickets, deduped by signature, at most 3 a run.
- What comes out
- Healing tickets, no pager
- What broke
- 97 leaked namespaces blocked deploys. CPU limit errors took two fixes. The first fleet went dark unnoticed for about 5 days, which is why the alarm exists.
05 Deploy
Partly enforced- How it runs
- Merge to main deploys. Workers Builds, Vercel, manual wrangler and one launchd stopgap.
- What stops it
- Green CI arms auto-merge. Builder then curls production and checks the build hash.
- What comes out
- Live in about 35 s on Cold Gas
- What broke
- Four deploy paths exist. Outatime previews have failed since Oct 19 and nothing requires them.
04 Review
Partly enforced- How it runs
- A fresh subagent sees only the diff and ticket. A Critic checks production and reopens misses.
- What stops it
- Verdict required on four of six fleet repos. Routine repos rely on self-review and the Critic.
- What comes out
- Findings fixed before merge
- What broke
- Only 24% of PRs were reviewed before the gate. Human-prefixed branches still pass it.
03 Verify
Partly enforced- How it runs
- npm run check: backlog, unit, build, E2E. Replay vectors. A screenshot at 390×844 that the agent looks at.
- What stops it
- Required CI on all ten agent repos, with admin enforcement on eight. Moon Club, KIN, Hinge Pop and 17-0 also require it now. Looking at the render is written only.
- What comes out
- Green checks, a checked render
- What broke
- E2E passed against another worktree’s build on a shared port. Native apps got CI only on Nov 5, and its first run found Hearth could not be built from a fresh clone.
02 Build
Partly enforced- How it runs
- A fresh checkout reads AGENTS.md and LESSONS.md. Builder writes a failing test first.
- What stops it
- frozen_paths in the merge workflow. The cap of 8 merges a day lives only in the prompt.
- What comes out
- One small PR, changelog line
- What broke
- A stale memory of main caused a whole feature to be built twice.
01 Idea
Enforced- How it runs
- Focus line in control.json. Scout proposes against a four-lens ticket template.
- What stops it
- check-backlog.mjs fails CI on a bad ticket. Scout is capped at 3 tickets a run and a queue of 10.
- What comes out
- Ticket files, one PR each
- What broke
- The Growth lens produced about 25 vanity tickets per repo until it was rewritten.
30 ft
How did you hear about any of this?
Go-to-market ships from the repo
Most AI engineering stops at deploy. This runs the rest of the lifecycle from the same repos: store art, search, ads, launchers and measurement. Those phone screens at the top? An agent briefed them and an engine rendered them.
42 ft
Why isn’t it all in the App Store yet?
Houston, four rejections
App Review is the stage a fast loop cannot brute-force, since a person on the other side judges the signals around the code. Moon Club got through on its third try. The rest are still in flight.
88 ft
How did a change reach production?
One merge. None shall pass.
One YAML decision is the entire trust boundary between an agent and production. Flip the settings and watch a change get through or get stopped. It runs the same logic as the real workflow.
- PR openedby an agent
- past expiry?checked first
- paused?read from main
- frozen path?compared to every changed file
- draft?wait until ready
- arm auto-mergesquash, delete branch
- CI green?required check
- merged and liveabout 35 s later
Merged. The change passes every check and deploys.
if [ "$today" \> "$expires" ]; then verdict=expired
elif [ "$paused" = "true" ]; then verdict=paused
elif [ -n "$hit" ]; then verdict=frozen
elif [ "$DRAFT" = "true" ]; then verdict=draft
else verdict=arm; fi
101 ft
Who wrote that change?
One ticket. It goes to eleven.
This is the actual prompt the Builder follows. It really does have eleven steps.
221 ft
How did the agent know what to do?
One repo. Elementary.
Everything an agent needs is in the checkout, so a cold start works. Move a person or an agent onto any repo and the same files are in the same places.
any-app/
├── AGENTS.md the contract: invariants, map, commands, definition of done
├── CLAUDE.md environment nuances: what bit us and what to do
├── agents/
│ ├── control.json pause, focus, caps, frozen paths. Editable from a phone
│ └── prompts/ common, scout, builder, critic, keeper
├── docs/
│ ├── backlog/ one file per ticket, validated in CI
│ ├── LESSONS.md read at the start of every run
│ └── CHANGELOG.md one player-facing line per ticket
├── store/
│ ├── lobby.json brand, shots, captions, avoid list
│ ├── lobby/raw/ real captures, committed
│ └── review-notes.md what App Review needs to know
├── scripts/up one idempotent command
└── .github/workflows/
├── ci.yml npm run check
├── agent-automerge the merge gate
└── main-ci-backstop CI on main, because token merges start none300 ft
Who decided it was worth doing?
The crew
One cases the place, one does the job, one checks the take, one keeps the lights on. Cold Gas’s focus line reads: the game works, nobody plays it yet. So that is what the crew works on.
1,138 ft
Did it work the first time?
The next generation
No. The first generation ran hourly on a Mac, shared one engine and could fall silent. The second runs in the cloud, one repo at a time, with roles that judge each other.
Generation one: launchd fleet
- Six repos, 645 merged PRs
- Shared engine in one place
- 3,012 recorded runs
- Idle loops dominated effort per merged PR
- Dormant today
Generation two: cloud routines
- Four repos, 632 merged agent PRs
- Each repo steers from control.json
- Runs without the Mac being on
- Critic and heal close the loop on production
- Prompts copied per repo, and already drifting
1,701 ft
How does one person run all of it?
One standard, many ships
Pull the camera back and a stack appears. Add an app and the engines pick it up from a file in its repo.
1,955 ft
What does all this cost?
Show me the work
Pay for judgment only when there is work. Lobby keeps each app’s art for the App Store, Play, Amazon, Galaxy, Alexa and web, and spends nothing on a day with no work. Only App Store upload is wired today; the others stay staged until their accounts exist.
2,001 ft
Why should anyone trust an agent?
A rule is worth the rung it stands on
The idea in this practice most worth stealing. Telling an agent to obey is the second-weakest control you have. Decide how each rule is enforced before you trust it.
- 5
Impossible by construction
The wrong thing cannot happen, or a test fails when it does.
- Lobby has no submit command
- Kids ad policy in select.js, agents get a 403
- Posted scores are re-flown by the server
- Drifted public numbers fail validate.mjs
- Lobby lint rejects rankings, ratings and “best”
- 11 tests on the starter’s merge gate
- A test that Lobby cannot submit
- 4
Required check
GitHub refuses the merge.
- npm run check on all routine repos
- Green CI on Moon Club, KIN, Hinge Pop and 17-0
- Review verdict on four of six fleet repos
- check-backlog.mjs on tickets
- 3
Workflow decision
Automation reads a setting and acts.
- expires, paused and frozen_paths in agent-automerge
- Daily expiry alarm opens an issue
- main-ci-backstop dispatches CI on main
- Lobby’s status gate and SELF_CANCEL
- preview_urls: false on KIN
- 2
Prompt instruction
The agent is asked to obey, and usually does.
- max_merges_per_day: 8
- Resume an open PR before starting new work
- Self-review by a fresh subagent
- Verify on production, revert if broken
- 1
Written down
It depends on someone remembering.
- Look at a real render
- Every new app in both launchers
- Fetch main before picking up work
- Run E2E on your own port
2,112 ft
So what are the rules?
Twelve angry rules
Each one came from something that happened. Under each rule is the proof.
Write the contract before the code.
Every repo carries an AGENTS.md an agent can read cold from a fresh checkout: invariants, system map, commands, lessons, definition of done.
Near universal across the projects; the best run to 526 lines.
Land work with CI, never with the agent.
An agent can open a PR. Only a green check can merge it.
agent-automerge.yml reads its rules from main, so a PR cannot loosen them.
Agents never edit their own leash.
Prompts, CI and the control file sit behind frozen paths or human review.
Live test: an agent PR raising its own merge cap was refused.
Separate who finds, who ships and who judges.
A builder grading its own work reads as success. Give judgment to a different role with different context.
Critic reopens misses on production. Reviewed PRs went from 150 of 638 to 6 of 7 once the verdict became required. Seven is a small sample.
Check for free before you think for money.
A deterministic script decides whether a model needs to wake at all.
Lobby logged "no work" today at no cost; hourly loops were the main waste.
Keep plumbing in the engine and meaning in the app.
Shared code holds mechanism. A small file in each repo holds what is true of that app.
Lobby renders every app from its own store/lobby.json.
Every incident becomes a rule, then a check.
Lessons get read at the start of every run. The strong ones climb into tests.
Replay vectors exist because three engines scored one run 77.3, 76.0 and 71.3. The full lessons file is public.
Publish only what a script can recount.
Public numbers come from a deterministic job, and CI fails if the page drifts.
CI re-renders the numbers on this page from data and fails on any difference. The audit below is generated the same way.
Autonomy needs an expiry.
Scheduled agents carry a kill date and tell someone when they stop.
The first fleet ran dark for about 5 days unnoticed. Now merges stop at the date and a daily alarm opens an issue 14 days ahead.
Involve the human where money or trust changes hands.
Everything else gets decided and shipped. These stop, with the exact next step written down.
lobby/PARKED.md. Lobby cannot submit an app, and a test keeps it that way.
Go-to-market ships from the repo.
Store art, search, ads and launchers are engines fed by per-app files, built with the same gates as code.
Lobby, Playbill, Marquee and Launcher. Outcomes are still early.
A new environment fact goes in the file today.
One idempotent npm run up, and a nuance table the next agent inherits.
11 repos carry the table: Xcode paths, port collisions, leaked namespaces.
5,150 ft
Where did the rules come from?
Sixteen incidents. Make a wish.
Real incidents, and where each one landed on the ladder. A lower rung means it can happen again.
| What happened | Why | What changed | Now on |
|---|---|---|---|
| One input log scored 77.3 in Node, 76.0 in workerd and 71.3 in production | Math functions are not bit-identical across engines | Own math kernels; server replays every posted score | Rung 5 |
| E2E passed against the wrong build | Worktrees shared a port and reused a server | Each run takes its own port | Rung 1, a lesson |
| Ad tests stayed green while about 430 KB of real ad traffic went unmeasured | A stub proves the calls, not the wire | Bucket production requests by game mode | Rung 4 |
| Main went red after two good PRs merged | Both took the same free ticket id | Renumber on collision; validator in CI | Rung 4 |
| Main could be red with nothing watching | GITHUB_TOKEN merges start no workflows | main-ci-backstop dispatches CI | Rung 3 |
| Fleet dark about 5 days | Self-cancel fired silently | Lobby notifies on expiry; warning ticket still open for the old fleet | Rung 3, partial |
| About 25 vanity tickets per repo | The Growth lens rewarded activity | Lens rewritten in fleet PRs #138 and #176 | Rung 2 |
| A full feature built twice | Agent trusted a stale memory of main | Fetch main before picking up work | Rung 1 |
| 24% of PRs reviewed | Review was optional | Verdict became a required check | Rung 4 |
| 97 leaked Durable Object namespaces blocked deploys | Every Worker preview creates new ones | preview_urls: false | Rung 3 |
| Test harness printed "0 failed" while skipping a third of its checks | Missing key skipped silently | Known, recorded | Rung 1, open |
| An iPad preview video was built from iPhone screens for an iPhone-only app | Preview target missed the iPad gate | Spec flag plus a push guard | Rung 5 |
| This page’s audit found the site claiming every project had a kill date, and undercounting its own work | Copy outlived the system it described | Claims corrected repo by repo; routine repos added to the generated scoreboard | Rung 5 for numbers |
| Hearth could not be built from a fresh clone: two native modules existed on one Mac only | .gitignore had ios/, which hid every ios folder. Nothing had ever run a clean checkout | Rule anchored to /ios/, modules committed, CI on every PR | Rung 4 |
| The manifest’s own audit found the engine behind it, Lobby, had no CI, lessons or pause switch | New tools skip the standard they serve | All three added, with tests | Rung 4 |
| Four apps rejected in one minute | Five apps in weeks, thin beta signals | Replies, outside testers, hold new submissions | Rung 1, too new |
8,675 ft
Is any of this true?
Trust no one. Audit.
The manifest’s standard, applied to my own repos by a script. No model touches this table, and the holes stay visible.
95 of 134 checks met across 18 repos, as of 2026-11-09. A script reads each repo from GitHub every night.
| Repo | Contract | Nuances | Done | Lessons | CI | Required | No bypass | Pause | Expiry |
|---|---|---|---|---|---|---|---|---|---|
| Cold Gas | ● | ○ | ● | ● | ● | ● | ● | ● | ● |
| OUTATIME 88 | ● | ○ | ● | ● | ● | ● | ● | ● | ● |
| OpenAero | ● | ○ | ● | ● | ● | ● | ● | ● | ● |
| Metaphases | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| AI-Native Starter | ● | ● | ● | ● | ● | ● | ● | ● | ● |
| Lobby | ● | ● | ● | ● | ● | ○ | ○ | ● | ● |
| Cue | ● | ● | ● | ○ | ● | ● | ● | · | · |
| 17-0 | ● | ○ | ○ | ○ | ● | ● | ● | · | · |
| Moon Club | ● | ● | ○ | ○ | ● | ● | ● | · | · |
| Hearth app | ● | ● | ○ | ○ | ● | · | · | · | · |
| Hearth core | ● | ● | ● | ○ | ○ | ○ | ○ | · | · |
| KIN | ● | ● | ● | ○ | ● | ● | ● | · | · |
| Hinge Pop | ● | ● | ● | ○ | ● | ● | ● | · | · |
| Marquee | ● | ○ | ○ | ○ | ● | ○ | ○ | · | · |
| Playbill | ● | ○ | ○ | ○ | ● | ○ | ○ | · | · |
| Launcher | ○ | ○ | ○ | ○ | ● | ○ | ○ | · | · |
| This site | ● | ○ | ● | ○ | ● | · | · | · | · |
| agent-fleet | ● | ○ | ○ | ● | ● | ● | ● | · | · |
● met ○ missing · not applicable, or not available on a private free repo. Pause and Expiry apply only to repos with scheduled agents. Business repos are left out by name.
24,601 ft
Can I have one?
It’s dangerous to go alone
Take this. Start from the repo, or adopt the pieces in this order. Each step works alone, and none of it needs a Mac.
The copyable core, as a working repo
AI-Native Starter
The contract, four role prompts, the gate as a tested script, the expiry alarm and the CI backstop. Live-tested on Nov 5: an ordinary agent PR merged itself, and an agent raising its own cap was refused.
gh repo create my-app --public \ --template mutaaf/ai-native-starter --clone cd my-app && sh scripts/setup.sh
- AGENTS.md skeletonInvariants, system map, commands, lessons, definition of done. Cold Gas has the fullest example.
- Control file and merge gateagents/control.json, agent-automerge.yml, main-ci-backstop.yml.
- Branch protection with admin enforcementNeeds a public repo or a paid GitHub plan. GitHub refused it on two private repos.
- Four role promptsScout, builder, critic, keeper. Start with builder and critic.
- Checks that fail on driftAny number you publish gets recounted by CI.
- Nuance table plus one idempotent upEvery environment surprise goes in the file the day it appears.
- Submission preflight and a rejection logA store-check script that exits non-zero, and one rule logged per rejection.
Will not transfer as is: launchd jobs, Xcode signing on one machine, keys in local config, approvals on one phone, and a Claude Max plan as the cost model. Will transfer: cloud routines, GitHub Actions, Workers and the prompts.
30,000 ft
What aren’t you telling me?
Still broken
A manifest that lists only wins is marketing. Writing this one exposed gaps, and most of them got fixed on the way. These are the ones still open.
Independent review has holes
Routine repos rely on a self-review subagent plus a critic after merge. Human-prefixed branches pass the fleet gate automatically.
Hearth cannot require its CI
Hearth’s app repo is private, and GitHub offers required checks on private repos only on a paid plan. CI runs on every PR, but nothing stops a merge when it fails.
Go-to-market is barely proven
One approved app so far, no owned search results at baseline, and no revenue figure found. All of it is days to weeks old.
Copies are drifting
check-backlog.mjs has 6 different versions across 13 repos, and routine prompts are copied per repo. The starter is now the canonical copy, but no existing repo has been moved onto it. The doctrine warned against exactly this.
Cloud routines have no cost log
The fleet recorded the effort of every run, but the routines that replaced it record none, so effort per merged PR is blind for the active generation.
Rules conflict
Involving the owner only for money sits against a human go on submissions. The other conflict, push to main against PR gates, was settled on Nov 5: push without asking, through a PR that lands itself on green.
Used by one person
No evidence yet that anyone else has adopted this, and the starter is one day old. Parts depend on one Mac: launchd, Xcode signing, local keys.
Closed on Nov 5, with proof
- Cloud routines had no end dateMerges stop at an expiry date, and a daily alarm opens an issue 14 days ahead. Live in four repos.Cold Gas · OUTATIME · OpenAero · Metaphases
- Native apps had no CIEvery PR now runs the tests. The first run found a build-breaking bug in Hearth within minutes.KIN · Hinge Pop · Moon Club
- Native CI was optionalMoon Club, KIN, Hinge Pop and 17-0 now require green CI on main, with no admin bypass. A live direct push was rejected.Moon Club · KIN · Hinge Pop · 17-0
- Apps could not hear each otherEverything cross-app was polling. Cue is now the event backbone: typed contracts, a durable log, dead letters, no personal data. Its first event that mattered: an alert that Moon Club was approved.Cue
- Hearth could not be rebuilt from GitHubTwo native modules existed on one Mac only. They are committed now. That repo is private, so there is no link.
- The engine skipped its own standardLobby gained CI, tests, a pause switch and a lessons file. The no-submit rule moved from a promise to a test.Lobby
- Copying the practice took reading itNow it takes one command, and the merge gate has its own tests.Starter
- Docs had drifted from the codeStale model name in the doctrine, and a reversed rule in a README.Doctrine · Playbill
- This site overstated two claims and undercounted its workKill dates and required review now say what each repo really does, and the scoreboard counts the active repos.
42,000 ft
And before all of it?
One contract, written by a person who knew what they wanted. That’s the whole answer. Write it. Close the loop. Move each rule up a rung.
The starter · The apps · agent-fleet · llms.txt
Every altitude on this page is a reference. No prizes.









