Mutaaf Aziz · The AI-Native Manifest

Like whatyou see?

Every game, app and site on this wall is me and my agents, beautifully orchestrated by the best AI-native SDLC you’ve seen. Open any of them. Then keep scrolling and I’ll rewind it, from the finished work back to the first line of the contract.

That store art? An agent briefed it and an engine rendered it. The search listings, the ad slots and this page came out of the same system.

13products you can open right now
1,277agent PRs merged, counted by script
10agent-run repos, in two generations
1app on the App Store, with 4 more at App Review
1engineer, 15+ years in, and no standups

Every claim below comes from a repo, a log or a store record. A script audits the repos every night, and the failures stay on the page.

7 ft

So how did all of that get made?

The line becomes a loop

Keep scrolling and watch it bend. Software used to move through people in a line. Where we’re going, we don’t need handoffs. It moves through a schedule, under rules a machine can enforce.

Commitment is made hereLearning arrives last IdeaYou: the contractSpecScoutEstimateTicketApproveBuilderBuildCI gateQAMergeReleaseProductionFind outCritic + Keeper Production teachesthe next ticket

Before. A line of handoffs. You commit first and learn last.

BEFOREA straight line of handoffs. Learning, operations and marketing all arrive after the commitment.IdeaSpecEstimateApproveSprintbuildQAReleaseFind outif it worksCommitment is made here, before anything existsEvery arrow is a handoff, a queue and usually a meetingOps, store and marketing teams start hereAFTERA loop that runs on a schedule under a written contract. The product and production are the spec.You: the contractAGENTS.md, control.jsoninvariants, focus, capsScoutfiles 3 tickets a runTicketone PR, in a fileBuildertest firstCI gatenpm run checkMergedeploys in ~35 sProductionreal playerssteersCritic + Keeperread productionErrors, frame times and player signals become ticketsfrozen paths: agents cannot edit their own contract or CI
The top line commits first and learns last. In the bottom loop, a change reaches production and starts teaching within minutes, so the expensive step moves to writing the contract and the gates.

Contract → run → gate → observe → rewrite the contract

9 ft

Where did the team go?

Who does each job now

Fifteen jobs that used to need separate people or teams. The human column gets shorter, and what stays in it is direction and anything involving money or trust.

StageBeforeAfterMechanism
Decide what mattersLeads in a meetingYoucontrol.json focus, edited from a phone
Find the next workPM + backlog groomingAgentScout: 3 tickets a run, queue cap 10
Write the specPM, then reviewAgentTicket file checked by check-backlog.mjs
Write the codeEngineersAgentBuilder, one ticket per PR
Write the testsEngineers + QAAgentTest first, unit or Playwright
ReviewA teammate, when freeAgentMachineFresh subagent; verdict required on fleet repos
MergeWhoever remembersMachineAuto-merge only on green CI
DeployRelease managerMachineWorkers Builds, about 35 s
Watch productionOn-call rotaAgentMachineKeeper + /obs/digest
Fix what brokeNext sprintAgentnpm run heal turns signatures into tickets
Store screenshots and videoDesigner + agencyAgentMachineLobby: agent briefs, engine renders, lint checks
SEO and AI answersMarketingMachinePlaybill at the edge, crons, refusal rules
AdsAd opsMachineMarquee: kids rules in code
Submit for reviewRelease managerYouHuman go. Needs --yes
Money and accountsFinance + legalYouParked with the exact click

10 ft

What does it look like, end to end?

Ten stages, counted down

From what it costs back to the first idea. Each card shows how a stage runs, what stops it, what comes out and what has already broken. The tags come from an audit of the repos.

  1. 10

    Spend

    Partly enforced
    How it runs
    A free status check before any model wakes. Free tiers first. An effort index per merged PR.
    What stops it
    Workers AI capped at 700 calls a day on Cold Gas and 30 per IP-hour on Metaphases. The merge gate stops agents at their expiry date. The fleet’s daily budget cap exists and is switched off.
    What comes out
    3,012 fleet runs recorded
    What broke
    Idle hourly loops dominated effort per merged PR. Cloud routines have no cost log yet.
  2. 09

    Measure

    Partly enforced
    How it runs
    A deterministic nightly scoreboard. PostHog and /obs/digest per app. Two apps collect nothing by design.
    What stops it
    CI fails if a published number drifts from the data.
    What comes out
    Numbers no model touched
    What broke
    The scoreboard missed the active repos until this page’s audit, and the repo audit below is one day old. No funnel crosses apps.
  3. 08

    Grow

    Unproven
    How it runs
    Lobby for store art. Playbill for search and AI answers. Marquee for ads. Launchers for distribution.
    What stops it
    Lobby lint fails bad claims. Kids ad rules live in code and agents get a 403 on protected settings.
    What comes out
    Every channel fed from the repo
    What broke
    Baseline: no owned URLs in 33 searches. AdSense in test mode at last check. Days to weeks old.
  4. 07

    Submit

    Partly enforced
    How it runs
    Scripted App Store Connect flow, review notes kept in the repo, a rejection log with one rule each.
    What stops it
    store-check exits 1 on blockers. Submit needs --yes. Lobby cannot submit at all.
    What comes out
    A version in review
    What broke
    Four apps rejected under 4.3 and 4.2.6 in one minute. Moon Club was approved on its third try, on Nov 9.
  5. 06

    Operate

    Partly enforced
    How it runs
    Keeper checks main and production. /obs/digest reports error signatures and frame times. An expiry alarm opens an issue before agents stop.
    What stops it
    npm run heal files tickets, deduped by signature, at most 3 a run.
    What comes out
    Healing tickets, no pager
    What broke
    97 leaked namespaces blocked deploys. CPU limit errors took two fixes. The first fleet went dark unnoticed for about 5 days, which is why the alarm exists.
  6. 05

    Deploy

    Partly enforced
    How it runs
    Merge to main deploys. Workers Builds, Vercel, manual wrangler and one launchd stopgap.
    What stops it
    Green CI arms auto-merge. Builder then curls production and checks the build hash.
    What comes out
    Live in about 35 s on Cold Gas
    What broke
    Four deploy paths exist. Outatime previews have failed since Oct 19 and nothing requires them.
  7. 04

    Review

    Partly enforced
    How it runs
    A fresh subagent sees only the diff and ticket. A Critic checks production and reopens misses.
    What stops it
    Verdict required on four of six fleet repos. Routine repos rely on self-review and the Critic.
    What comes out
    Findings fixed before merge
    What broke
    Only 24% of PRs were reviewed before the gate. Human-prefixed branches still pass it.
  8. 03

    Verify

    Partly enforced
    How it runs
    npm run check: backlog, unit, build, E2E. Replay vectors. A screenshot at 390×844 that the agent looks at.
    What stops it
    Required CI on all ten agent repos, with admin enforcement on eight. Moon Club, KIN, Hinge Pop and 17-0 also require it now. Looking at the render is written only.
    What comes out
    Green checks, a checked render
    What broke
    E2E passed against another worktree’s build on a shared port. Native apps got CI only on Nov 5, and its first run found Hearth could not be built from a fresh clone.
  9. 02

    Build

    Partly enforced
    How it runs
    A fresh checkout reads AGENTS.md and LESSONS.md. Builder writes a failing test first.
    What stops it
    frozen_paths in the merge workflow. The cap of 8 merges a day lives only in the prompt.
    What comes out
    One small PR, changelog line
    What broke
    A stale memory of main caused a whole feature to be built twice.
  10. 01

    Idea

    Enforced
    How it runs
    Focus line in control.json. Scout proposes against a four-lens ticket template.
    What stops it
    check-backlog.mjs fails CI on a bad ticket. Scout is capped at 3 tickets a run and a queue of 10.
    What comes out
    Ticket files, one PR each
    What broke
    The Growth lens produced about 25 vanity tickets per repo until it was rewritten.

30 ft

How did you hear about any of this?

Go-to-market ships from the repo

Most AI engineering stops at deploy. This runs the rest of the lifecycle from the same repos: store art, search, ads, launchers and measurement. Those phone screens at the top? An agent briefed them and an engine rendered them.

BEFORELaunch is a handoff. Each channel starts later, with someone who did not build the product.ShipengineeringScreenshotsdesigner briefListing + SEOmarketingAdsad opsAnalyticsdata teamFirst signalweeks laterAFTEROne commit carries the meaning. Engines turn it into every channel, under the same gates as code.Same repo, same PRstore/lobby.jsoncatalog entrieslauncher entryLobbystore art, video, iconsApp Store, Play, Amazon, GalaxyPlaybilledge SEO, llms.txtsearch and AI answersMarqueead decisions, kids policyweb ad slotsLauncherone shared app listevery launcher and dockFirst signaltelemetry per appfeeds the next ticketWhat the data says becomes the next contract
The second before and after. The difference is the channel work moving into the repo, where it gets the same gates, the same history and the same agents. The channels are built; the results are still early.
New appone repoStore artLobby + store/lobby.jsonAll sizes built and lintedOutcome unknown: 2 days oldSearch and AI answersPlaybill edge + llms.txtLive, with refusal rulesBaseline: 0 owned URLs in 33 searchesAdsMarquee, split kids policyServing in test modeAdSense under review at last checkPaid featuresStoreKit, one-time pricesConfigured on HearthNo sales yet: app not approvedDistributionLaunchers, /apps/ pageEvery app listedNo CI check enforces itMeasurementPostHog, /obs/digestPer app, some by design noneNo cross-app funnelMechanismBuiltEvidence so far
Go-to-market is wired into the same system as code. The right column is the honest one: the machinery exists, and proof that it brings people does not yet.

42 ft

Why isn’t it all in the App Store yet?

Houston, four rejections

App Review is the stage a fast loop cannot brute-force, since a person on the other side judges the signals around the code. Moon Club got through on its third try. The rest are still in flight.

Sep 517-02.1 InformationNeededBecame a ruleDevice recording, full answerskept in the notes fieldNov 4Moon Club1.5 DeveloperInformationBecame a ruleReal support page with a form.Support and marketing URLs differNov 5Moon Club2.3.8 AccurateMetadataBecame a rule"Kids" removed from name,subtitle and art, per the rule logNov 5 11:45Four apps, one minute4.3 Spam +4.2.6 GeneratedBecame a ruleReplies, rename, new mechanic,outside testers, /apps/ pageStatus on Nov 9: Moon Club is on the App Store, approved on its third try. The other four are waiting on review or a reply.
The weakest stage in the practice. Each rejection became a logged rule, and the last one showed a limit: shipping speed can itself look like spam to the people reviewing it.

88 ft

How did a change reach production?

One merge. None shall pass.

One YAML decision is the entire trust boundary between an agent and production. Flip the settings and watch a change get through or get stopped. It runs the same logic as the real workflow.

  1. PR openedby an agent
  2. past expiry?checked first
  3. paused?read from main
  4. frozen path?compared to every changed file
  5. draft?wait until ready
  6. arm auto-mergesquash, delete branch
  7. CI green?required check
  8. merged and liveabout 35 s later

Merged. The change passes every check and deploys.

if [ "$today" \> "$expires" ]; then verdict=expired
elif [ "$paused" = "true" ]; then verdict=paused
elif [ -n "$hit" ];       then verdict=frozen
elif [ "$DRAFT" = "true" ]; then verdict=draft
else verdict=arm; fi
PR openedby an agentagent-automergereads control.jsonfrom main, not the PRexpired?yesstoppaused?yeswaitfrozen?yesrefusedraft?yeswaitall noArm squash auto-mergeCI greenMerged to mainWorkers Buildslive about 35 s latermain-ci-backstopdispatches CI on main hourly and after each PRA merge made with GITHUB_TOKEN never starts workflows, so main could turn red with nothing watching it.
The gate reads its rules from main, so a PR cannot loosen its own gate. The backstop exists because of a specific blind spot that was found in production use.

101 ft

Who wrote that change?

One ticket. It goes to eleven.

This is the actual prompt the Builder follows. It really does have eleven steps.

Preflightread common.md,AGENTS, control.jsonBudgetat 8 merges a day,end NOOPResumefinish an open PRbefore a new onePickheal check, thentop ready ticketTest firsta test that failswithout the changeGatenpm run check +screenshot at 390×844Shipticket shipped,changelog, open PRSelf-reviewfresh subagent getsonly diff + ticketMergeauto-merge ongreen CIVerify livecurl prod in ~2 min,checks build hashRevertif broken: fix/ PR,record a lessonRead right to left on the second row. The last step runs only when production is broken.
One run of agents/prompts/builder.md. It ends with a check against production, so "done" means the new build hash is live.

221 ft

How did the agent know what to do?

One repo. Elementary.

Everything an agent needs is in the checkout, so a cold start works. Move a person or an agent onto any repo and the same files are in the same places.

any-app/
├── AGENTS.md            the contract: invariants, map, commands, definition of done
├── CLAUDE.md            environment nuances: what bit us and what to do
├── agents/
│   ├── control.json     pause, focus, caps, frozen paths. Editable from a phone
│   └── prompts/         common, scout, builder, critic, keeper
├── docs/
│   ├── backlog/         one file per ticket, validated in CI
│   ├── LESSONS.md       read at the start of every run
│   └── CHANGELOG.md     one player-facing line per ticket
├── store/
│   ├── lobby.json       brand, shots, captions, avoid list
│   ├── lobby/raw/       real captures, committed
│   └── review-notes.md  what App Review needs to know
├── scripts/up           one idempotent command
└── .github/workflows/
    ├── ci.yml           npm run check
    ├── agent-automerge  the merge gate
    └── main-ci-backstop CI on main, because token merges start none

300 ft

Who decided it was worth doing?

The crew

One cases the place, one does the job, one checks the take, one keeps the lights on. Cold Gas’s focus line reads: the game works, nobody plays it yet. So that is what the crew works on.

Scoutfinds what to build nextchanges only tickets and lessonsCriticthe hardest reviewerchecks production, reopens missesdocs/backlog/ticket filesvalidated in CIready queue cap: 10Builderships one ticketmax 8 merges a dayProduction/obs/digesterrors, frame times, funnelKeepermain is green, prod is upat most two small PRs a runfilesfiles and reopens missestakes topmerge deploysread livereads digestheal: new error signatures become tickets
The second generation as Cold Gas and Metaphases run it, with all four roles. Each role runs on its own schedule in the cloud and knows only the repo. Separating who finds work, who ships it and who judges it stops one agent grading its own homework.

1,138 ft

Did it work the first time?

The next generation

No. The first generation ran hourly on a Mac, shared one engine and could fall silent. The second runs in the cloud, one repo at a time, with roles that judge each other.

050100147MayJunJulAugSepOctPeak: 147 merges in one week, May 18No merges, July and August
Merged PRs per week on the first generation, from the nightly scoreboard (645 total across 6 repos). The chart leaves out the second generation, which has 632 merged agent PRs of its own in four other repos.

Generation one: launchd fleet

  • Six repos, 645 merged PRs
  • Shared engine in one place
  • 3,012 recorded runs
  • Idle loops dominated effort per merged PR
  • Dormant today

Generation two: cloud routines

  • Four repos, 632 merged agent PRs
  • Each repo steers from control.json
  • Runs without the Mac being on
  • Critic and heal close the loop on production
  • Prompts copied per repo, and already drifting

1,701 ft

How does one person run all of it?

One standard, many ships

Pull the camera back and a stack appears. Add an app and the engines pick it up from a file in its repo.

YOUDirection, invariants, taste, money and accountsSTANDARDAGENTS.md in every repo · lessons file · environment nuance table · definition of doneENGINESRoutinesscout criticbuilder keeperLobbystore artPlaybillSEO, llms.txtMarqueeads + kids policyLauncherone app listaurora-fieldshared lookprompts in repostore/lobby.jsoncatalog entrycatalog entryversioned copyversioned copyAPPSHearth17-0Cold GasMoon ClubHinge PopKINand web appsPLATFORMSGitHub Actions · Cloudflare Workers · Vercel · App Store Connect · Supabase · PostHog
One split repeats everywhere: engines hold the plumbing, and each app holds its own meaning in a small file. A new app appears in Lobby automatically because discovery walks the projects folder.

1,955 ft

What does all this cost?

Show me the work

Pay for judgment only when there is work. Lobby keeps each app’s art for the App Store, Play, Amazon, Galaxy, Alexa and web, and spends nothing on a day with no work. Only App Store upload is wired today; the others stay staged until their accounts exist.

launchddaily at 07:20SELF_CANCEL?expiry with a notificationlobby status --jsonfree: no model calledno workStop. Costs $0workclaude -pbrief + exact work listlobby buildlint fails on bad claimsLook at the sheetthen fix and rebuildlobby pusheditable versions onlyNever submitsno such command existsmoney, accountsPARKED.mdone line, exact click
Put a deterministic check in front of expensive judgment. Today’s run logged "no work" at no cost, and the one working run on Nov 4 cost $1.77. Old hourly loops spent most of their effort finding nothing to do.

2,001 ft

Why should anyone trust an agent?

A rule is worth the rung it stands on

The idea in this practice most worth stealing. Telling an agent to obey is the second-weakest control you have. Decide how each rule is enforced before you trust it.

  1. 5

    Impossible by construction

    The wrong thing cannot happen, or a test fails when it does.

    • Lobby has no submit command
    • Kids ad policy in select.js, agents get a 403
    • Posted scores are re-flown by the server
    • Drifted public numbers fail validate.mjs
    • Lobby lint rejects rankings, ratings and “best”
    • 11 tests on the starter’s merge gate
    • A test that Lobby cannot submit
  2. 4

    Required check

    GitHub refuses the merge.

    • npm run check on all routine repos
    • Green CI on Moon Club, KIN, Hinge Pop and 17-0
    • Review verdict on four of six fleet repos
    • check-backlog.mjs on tickets
  3. 3

    Workflow decision

    Automation reads a setting and acts.

    • expires, paused and frozen_paths in agent-automerge
    • Daily expiry alarm opens an issue
    • main-ci-backstop dispatches CI on main
    • Lobby’s status gate and SELF_CANCEL
    • preview_urls: false on KIN
  4. 2

    Prompt instruction

    The agent is asked to obey, and usually does.

    • max_merges_per_day: 8
    • Resume an open PR before starting new work
    • Self-review by a fresh subagent
    • Verify on production, revert if broken
  5. 1

    Written down

    It depends on someone remembering.

    • Look at a real render
    • Every new app in both launchers
    • Fetch main before picking up work
    • Run E2E on your own port

2,112 ft

So what are the rules?

Twelve angry rules

Each one came from something that happened. Under each rule is the proof.

  1. Write the contract before the code.

    Every repo carries an AGENTS.md an agent can read cold from a fresh checkout: invariants, system map, commands, lessons, definition of done.

    Near universal across the projects; the best run to 526 lines.

  2. Land work with CI, never with the agent.

    An agent can open a PR. Only a green check can merge it.

    agent-automerge.yml reads its rules from main, so a PR cannot loosen them.

  3. Agents never edit their own leash.

    Prompts, CI and the control file sit behind frozen paths or human review.

    Live test: an agent PR raising its own merge cap was refused.

  4. Separate who finds, who ships and who judges.

    A builder grading its own work reads as success. Give judgment to a different role with different context.

    Critic reopens misses on production. Reviewed PRs went from 150 of 638 to 6 of 7 once the verdict became required. Seven is a small sample.

  5. Check for free before you think for money.

    A deterministic script decides whether a model needs to wake at all.

    Lobby logged "no work" today at no cost; hourly loops were the main waste.

  6. Keep plumbing in the engine and meaning in the app.

    Shared code holds mechanism. A small file in each repo holds what is true of that app.

    Lobby renders every app from its own store/lobby.json.

  7. Every incident becomes a rule, then a check.

    Lessons get read at the start of every run. The strong ones climb into tests.

    Replay vectors exist because three engines scored one run 77.3, 76.0 and 71.3. The full lessons file is public.

  8. Publish only what a script can recount.

    Public numbers come from a deterministic job, and CI fails if the page drifts.

    CI re-renders the numbers on this page from data and fails on any difference. The audit below is generated the same way.

  9. Autonomy needs an expiry.

    Scheduled agents carry a kill date and tell someone when they stop.

    The first fleet ran dark for about 5 days unnoticed. Now merges stop at the date and a daily alarm opens an issue 14 days ahead.

  10. Involve the human where money or trust changes hands.

    Everything else gets decided and shipped. These stop, with the exact next step written down.

    lobby/PARKED.md. Lobby cannot submit an app, and a test keeps it that way.

  11. Go-to-market ships from the repo.

    Store art, search, ads and launchers are engines fed by per-app files, built with the same gates as code.

    Lobby, Playbill, Marquee and Launcher. Outcomes are still early.

  12. A new environment fact goes in the file today.

    One idempotent npm run up, and a nuance table the next agent inherits.

    11 repos carry the table: Xcode paths, port collisions, leaked namespaces.

5,150 ft

Where did the rules come from?

Sixteen incidents. Make a wish.

Real incidents, and where each one landed on the ladder. A lower rung means it can happen again.

What happenedWhyWhat changedNow on
One input log scored 77.3 in Node, 76.0 in workerd and 71.3 in productionMath functions are not bit-identical across enginesOwn math kernels; server replays every posted scoreRung 5
E2E passed against the wrong buildWorktrees shared a port and reused a serverEach run takes its own portRung 1, a lesson
Ad tests stayed green while about 430 KB of real ad traffic went unmeasuredA stub proves the calls, not the wireBucket production requests by game modeRung 4
Main went red after two good PRs mergedBoth took the same free ticket idRenumber on collision; validator in CIRung 4
Main could be red with nothing watchingGITHUB_TOKEN merges start no workflowsmain-ci-backstop dispatches CIRung 3
Fleet dark about 5 daysSelf-cancel fired silentlyLobby notifies on expiry; warning ticket still open for the old fleetRung 3, partial
About 25 vanity tickets per repoThe Growth lens rewarded activityLens rewritten in fleet PRs #138 and #176Rung 2
A full feature built twiceAgent trusted a stale memory of mainFetch main before picking up workRung 1
24% of PRs reviewedReview was optionalVerdict became a required checkRung 4
97 leaked Durable Object namespaces blocked deploysEvery Worker preview creates new onespreview_urls: falseRung 3
Test harness printed "0 failed" while skipping a third of its checksMissing key skipped silentlyKnown, recordedRung 1, open
An iPad preview video was built from iPhone screens for an iPhone-only appPreview target missed the iPad gateSpec flag plus a push guardRung 5
This page’s audit found the site claiming every project had a kill date, and undercounting its own workCopy outlived the system it describedClaims corrected repo by repo; routine repos added to the generated scoreboardRung 5 for numbers
Hearth could not be built from a fresh clone: two native modules existed on one Mac only.gitignore had ios/, which hid every ios folder. Nothing had ever run a clean checkoutRule anchored to /ios/, modules committed, CI on every PRRung 4
The manifest’s own audit found the engine behind it, Lobby, had no CI, lessons or pause switchNew tools skip the standard they serveAll three added, with testsRung 4
Four apps rejected in one minuteFive apps in weeks, thin beta signalsReplies, outside testers, hold new submissionsRung 1, too new

8,675 ft

Is any of this true?

Trust no one. Audit.

The manifest’s standard, applied to my own repos by a script. No model touches this table, and the holes stay visible.

95 of 134 checks met across 18 repos, as of 2026-11-09. A script reads each repo from GitHub every night.

RepoContractNuancesDoneLessonsCIRequiredNo bypassPauseExpiry
Cold Gas●○●●●●●●●
OUTATIME 88●○●●●●●●●
OpenAero●○●●●●●●●
Metaphases●●●●●●●●●
AI-Native Starter●●●●●●●●●
Lobby●●●●●○○●●
Cue●●●○●●●··
17-0●○○○●●●··
Moon Club●●○○●●●··
Hearth app●●○○●····
Hearth core●●●○○○○··
KIN●●●○●●●··
Hinge Pop●●●○●●●··
Marquee●○○○●○○··
Playbill●○○○●○○··
Launcher○○○○●○○··
This site●○●○●····
agent-fleet●○○●●●●··

● met ○ missing · not applicable, or not available on a private free repo. Pause and Expiry apply only to repos with scheduled agents. Business repos are left out by name.

24,601 ft

Can I have one?

It’s dangerous to go alone

Take this. Start from the repo, or adopt the pieces in this order. Each step works alone, and none of it needs a Mac.

The copyable core, as a working repo

AI-Native Starter

The contract, four role prompts, the gate as a tested script, the expiry alarm and the CI backstop. Live-tested on Nov 5: an ordinary agent PR merged itself, and an agent raising its own cap was refused.

gh repo create my-app --public \
  --template mutaaf/ai-native-starter --clone
cd my-app && sh scripts/setup.sh
  1. AGENTS.md skeletonInvariants, system map, commands, lessons, definition of done. Cold Gas has the fullest example.
  2. Control file and merge gateagents/control.json, agent-automerge.yml, main-ci-backstop.yml.
  3. Branch protection with admin enforcementNeeds a public repo or a paid GitHub plan. GitHub refused it on two private repos.
  4. Four role promptsScout, builder, critic, keeper. Start with builder and critic.
  5. Checks that fail on driftAny number you publish gets recounted by CI.
  6. Nuance table plus one idempotent upEvery environment surprise goes in the file the day it appears.
  7. Submission preflight and a rejection logA store-check script that exits non-zero, and one rule logged per rejection.

Will not transfer as is: launchd jobs, Xcode signing on one machine, keys in local config, approvals on one phone, and a Claude Max plan as the cost model. Will transfer: cloud routines, GitHub Actions, Workers and the prompts.

30,000 ft

What aren’t you telling me?

Still broken

A manifest that lists only wins is marketing. Writing this one exposed gaps, and most of them got fixed on the way. These are the ones still open.

  • Independent review has holes

    Routine repos rely on a self-review subagent plus a critic after merge. Human-prefixed branches pass the fleet gate automatically.

  • Hearth cannot require its CI

    Hearth’s app repo is private, and GitHub offers required checks on private repos only on a paid plan. CI runs on every PR, but nothing stops a merge when it fails.

  • Go-to-market is barely proven

    One approved app so far, no owned search results at baseline, and no revenue figure found. All of it is days to weeks old.

  • Copies are drifting

    check-backlog.mjs has 6 different versions across 13 repos, and routine prompts are copied per repo. The starter is now the canonical copy, but no existing repo has been moved onto it. The doctrine warned against exactly this.

  • Cloud routines have no cost log

    The fleet recorded the effort of every run, but the routines that replaced it record none, so effort per merged PR is blind for the active generation.

  • Rules conflict

    Involving the owner only for money sits against a human go on submissions. The other conflict, push to main against PR gates, was settled on Nov 5: push without asking, through a PR that lands itself on green.

  • Used by one person

    No evidence yet that anyone else has adopted this, and the starter is one day old. Parts depend on one Mac: launchd, Xcode signing, local keys.

Closed on Nov 5, with proof

  • Cloud routines had no end dateMerges stop at an expiry date, and a daily alarm opens an issue 14 days ahead. Live in four repos.Cold Gas · OUTATIME · OpenAero · Metaphases
  • Native apps had no CIEvery PR now runs the tests. The first run found a build-breaking bug in Hearth within minutes.KIN · Hinge Pop · Moon Club
  • Native CI was optionalMoon Club, KIN, Hinge Pop and 17-0 now require green CI on main, with no admin bypass. A live direct push was rejected.Moon Club · KIN · Hinge Pop · 17-0
  • Apps could not hear each otherEverything cross-app was polling. Cue is now the event backbone: typed contracts, a durable log, dead letters, no personal data. Its first event that mattered: an alert that Moon Club was approved.Cue
  • Hearth could not be rebuilt from GitHubTwo native modules existed on one Mac only. They are committed now. That repo is private, so there is no link.
  • The engine skipped its own standardLobby gained CI, tests, a pause switch and a lessons file. The no-submit rule moved from a promise to a test.Lobby
  • Copying the practice took reading itNow it takes one command, and the merge gate has its own tests.Starter
  • Docs had drifted from the codeStale model name in the doctrine, and a reversed rule in a README.Doctrine · Playbill
  • This site overstated two claims and undercounted its workKill dates and required review now say what each repo really does, and the scoreboard counts the active repos.

42,000 ft

And before all of it?

One contract, written by a person who knew what they wanted. That’s the whole answer. Write it. Close the loop. Move each rule up a rung.

The starter · The apps · agent-fleet · llms.txt

Every altitude on this page is a reference. No prizes.