01 · change
Black box
Claude Code changed its interface. The useful moment—clicking in while it was thinking—was gone.
Substrate 01 · Machines
Agents that
act.
Observe here.
Enforce there.
The first failure was not a bad answer. It was losing the ability to see how the answer had been produced. The system started with a recorder.
THE QUESTION What did the agent actually do, what keeps failing, and what has earned the right to become code?
The agent-QA loop · from visibility to consequence
01 · Record
Capture prompts, tools, sub-agents, failures, and the narration between them. Output is not the process.
02 · Explain
Run it a few times. Ask why it worked, why it failed, and which path became recurring.
03 · Promote
Turn the recurring failure into monitor, nudge, deny, or block—at the boundary where it matters.
04 · Retain control
Code owns consequence. The model owns content. The human still owns irreversible apply.
origin · observability
2026-05-14
cc-logger’s first commit. The recorder predates the GTM agent system by thirteen days.
routing · maintained
6 + 6
Six live eval-gated modes. Six retired modes, each with a dated reason rather than silent deletion.
production · drift
0.9 → 0.3
Extract-accurate pass consistency dropped in production. The regression harness caught it.
One method.
Two machine eras.
Agents only entered the work at Repath. The method was born there, then became the operating system for Tam to Target: observe the work, promote only what recurs, and keep consequence outside the model.
applied to
01Findthe failure surface
02Holdthe invariant
03Promotethe recurring rule
04Carrythe guarantee forward
Repathorigin · first recorder
failure surface
Claude Code changed its UI. The reasoning went black-box. The work could no longer be watched.
invariant
Do not trust what cannot be observed. Record the prompts, tools, sub-agents, failures, and narration.
rule
Run it repeatedly, inspect the logs, and derive what should become deterministic.
carry
cc-logger first: 2026-05-14. The instrument came before the system it would watch.
Tam to Targetnow · governed fleet
failure surface
95 skills, 39 clients, 35 scheduled jobs: repeated work can drift, fail, or write across the wrong boundary.
invariant
Same evals, constraints, tenant isolation, and architecture. Model method stays flexible; consequence does not.
rule
Promote recurring failures into monitor, nudge, deny, or block. Retire modes with a reason.
carry
Propose → apply pairs keep the human gate. A model can draft; it cannot silently execute the irreversible step.
THE THREAD The machine story is not “I built agents.” It is “I built the layer that lets autonomous work become inspectable and governable.”
HOW I OBSERVE MACHINES · OPEN / POROUS
Watch the run,
not just the result.
Two identical outputs can hide two different processes. The instrument makes the path visible before anyone decides what to enforce.
The first failure was opacity.
The UI changed. The reasoning disappeared. Trust stopped being earned because the work could no longer be inspected.
02 · response
Record everything
cc-logger captured every prompt, tool call, sub-agent, failure, and narration between them.
03 · compare
Find the path
Two runs can produce the same output while one failed three times and got lucky. The processes do not match.
04 · consequence
Guard the boundary
agent-guard turns repeated failures into monitor, nudge, deny, or block rules.
ORIGIN cc-logger first commit · 2026-05-14 / GTM repo first commit · 2026-05-27
The blank form.
What did the agent do between the prompt and the outcome—and which part is still invisible?
Prompt
What was asked, with what context?
Tools + agents
What actions, branches, and retries occurred?
Failure + drift
Where did the process diverge from the canonical path?
Rule candidate
What should remain model-owned, and what should become deterministic?
THE TEST Works is not enough. Explain why, then decide what to make deterministic.
What repeated
enough to become code.
The guardrail is not the insight. The insight is the recurring failure, with enough evidence to justify moving consequence out of the model.
01
observed
Bare psql fell back to the local socket.
recurrence
Approximately 18 logged failures. The same failure was cheap to predict and expensive to keep rediscovering.
promoted
nudge · 2026-06-05
Use the sanctioned database path instead.
02
observed
Neon MCP pointed at the wrong account.
recurrence
Approximately 14 failures. The tool had no legitimate use in this environment.
promoted
deny · 2026-06-05
Cheap to block; wrong-account access is not a recovery path.
03
observed
A guard message named a flag that did not exist.
recurrence
The control layer itself caused approximately 43 more failures per week.
promoted
rewrite · 2026-07-06
The observation layer caught the control layer being wrong.
04
observed
A shared-context write could fan out to every agent.
recurrence
Zero incidents. The believed cost was high, but the evidence had not earned enforcement.
promoted
monitor only · 2026-07-22
“Log-only for now.” Restraint is part of the control system.
05
observed
An eval-passing route drifted in production.
recurrence
Extract-accurate dropped from 0.9 to 0.3 pass consistency; mean score fell from 0.967 to 0.622. Output did not parse.
promoted
caught · 2026-08-03
The harness pulled the failure into view before it became a quiet assumption.
HOW I CONTROL MACHINES · CLOSED / NARROW
Code owns consequence.
Model owns content.
The control plane is calibrated to the cost of being wrong. Recoverable mistakes get a nudge. Irreversible misses get a boundary.
Same system.
Different thickness.
The model can propose. The boundary decides what is allowed to happen.
cheap recovery
Fail-open
Main-session nudges. Let the model self-correct where recovery is cheap.
irreversible miss
Fail-closed
Readonly DB firewall. False positives are acceptable; false negatives are not.
unearned risk
Monitor
Shared-context writes. Record the risk before pretending the evidence is complete.
the human gate
Propose → apply. The model drafts, the system holds, and nothing irreversible runs until a human reply authorizes it.
Accuracy is
maintained, not claimed.
A governed agent system has to show its demotions, its drift, and its missing guarantees. The honest version is more useful than the aspirational one.
Retire
Six routing modes were retired with dated reasons. A bad mode is not quietly removed; the failure stays in the record.
Re-test
Six live modes exist, but only two of six are under continuous regression. No provider pins are populated. Publish the real coverage.
Separate
Telemetry, evals, and guards are different layers. A passing eval does not prove a production route will stay healthy.
ROUTING ALLOWLIST · USE CASE, VERIFIED DATE, USE-WHEN, DO-NOT-USE-WHEN → THE MODE IS THE CONTRACT
REGRESSION HARNESS · 2026-08-03 → EXTRACT-ACCURATE DRIFT CAUGHT BEFORE IT BECAME INVISIBLE
The proxy was not
good enough.
The observation problem arrived first in People. Machines made it possible to solve the same feeling directly.
People · before
Remote work patched with proxies.
Audits, taking classes, attendance data, and feedback collected sideways gave enough signal to run the business—not enough to trust the process.
Machines · now
Record the work itself.
When the agent acts on your behalf, the path is the work. The recorder came first, then the controls earned by what it showed.