Agent operations
An AI agent does the engineering on this estate. The claim worth making about that is not throughput — it is that the agent’s reasoning is governed: decisions are recorded before they become work, and the specific ways it has been wrong are a named taxonomy loaded into every session before the work starts.
Agent operations — 580 decisions, 554 recorded lessons
Snapshot taken — build-time, not live- 580decision records
- 554lessons captured
- 27named failure classes
- 1,927corpus pages
Decision cadence
Week commencing 15 June 26 to 5 Oct 26, peak 80 in a single week. Dates come from each record's own header where it states one, and from the file's first commit where it does not.
Where the reasoning fails — the estate's own taxonomy
Each lesson is one page carrying the named class of self-deception it belongs to — an assertion that could not have failed, an empty result mistaken for an absence, a watcher wired to a signal it cannot observe. The classes load into every agent session, so the shape of the trap is in mind before it is walked into rather than written up afterwards. The distribution is the useful part and it is not flattering by construction: the tallest bar is the mistake made most often.
How well each lesson is evidenced
A lesson carries the tier of evidence behind it — verified against the live system, reproduced, partially checked, or merely cited. A corpus that did not grade itself would be a pile of confident claims, which is the exact failure mode it exists to prevent. Corpus at commit 5593b7d.
Reading the failure-class chart
Section titled “Reading the failure-class chart”Each bar is a class of self-deception, not an incident. The classes are shapes — an assertion that would still pass with the feature removed, an empty result read as an absence, a watcher wired to a signal it cannot observe, the system accepted the request, which is not the system doing the work, a cause the agent authored rather than observed.
The distribution is not flattering by construction, and that is the point. The tallest bar is the mistake made most often. A taxonomy curated to look good would be useless, since its whole function is to put the most likely trap in front of the agent before it walks into it.
The single sentence underneath all of them: the agent never observes the system, only its evidence — exit codes, logs, dashboards, API responses, its own account of what it just did. Every class names a place where the evidence and the system quietly diverge, and in the worst of them the evidence is something the agent authored rather than collected. So the operative question is never did it pass? but what would this have done if the thing were broken? If the answer is “the same”, it is not evidence.
Why the evidence tier matters more than the count
Section titled “Why the evidence tier matters more than the count”A corpus of three hundred and fifty confident, unverified claims would be worse than no corpus at all — it would be a machine for laundering guesses into doctrine. So each lesson records the tier of evidence behind it: verified against the live system, reproduced, partially checked, or merely cited from a source.
Grading its own contents is what makes the corpus safe to retrieve from. A lesson that says this is cited, not verified is a lead. One that says verified, on this date, by this observation is a finding.
Decision cadence
Section titled “Decision cadence”Decisions per month, taken from the same dated set the decision log publishes, so the two panels cannot come to disagree about how many exist. The shape of the series is mostly a record of when the estate was being restructured rather than extended — the tall months are platform migrations and standards work, not feature delivery.
What the agent may and may not do
Section titled “What the agent may and may not do”Autonomy here is an envelope written down, not a prompt-level preference. There are hard stops that no grant crosses — network configuration, the home automation platform, the edge provider, external exposure, anything irreversible — and they bind the autonomous paths exactly as they bind an interactive one.
Two properties of that envelope are worth stating because they are unusual:
- A self-report is never sufficient evidence. A worker that delivers a change returns a verdict; the orchestrator independently re-asserts the evidence before anything is marked done. A system where the entity doing the work also certifies the work has no control at all.
- Autonomy has gone down as well as up. A broader delegated tier was withdrawn and re-granted more narrowly, with a circuit breaker and independent verification attached. An envelope that only ever widens is not an envelope.
And when a safety control blocks an action the agent is genuinely authorised to perform, the answer is neither to retry variations until one slips through nor to quietly do it another way. The action is classified against a committed register and deferred — recorded with the exact command and an assertion that cannot pass unless the work actually happened.
Depth: the AI-assisted operations chapter · the agent lesson corpus design · the autonomous remediation authority standard