The moment I understood our development tooling was wrong, nothing was broken.
One afternoon in July 2026, eleven AI agents were implementing in parallel, every pipeline was green, and roughly three dozen completed work items sat stacked at our review-and-verify gates — done by every definition the tools could express, and unusable by mine. The workers were fast. The checking was the constraint. Every agent I added grew the pile.
The pile taught me one sentence; test everything below against it: the constraint moved from writing code to trusting it — design for the gate, not the writer.
CI, issues, and pull requests are furniture so settled it is easy to forget they encode a worldview — one written around 2008, for teams where humans typed the code. Every load-bearing assumption in that worldview has now inverted, and the furniture hasn't moved.
three assumptions from 2008
Code is expensive to produce. The forge is built for scarcity: one branch, one author, a queue of changes worth individually savoring. Agents make code cheap and abundant — the scarce resource is now the judgment that says this change is safe to trust.
Review is a conversation. The pull request is a discussion thread with a diff attached — designed for two colleagues negotiating, teaching, aligning taste. My reviewers are not colleagues negotiating. What I need from review is a verdict with evidence, produced by a party independent of the author, recorded so any later edit leaves a visible trace. A conversation is a lovely container for alignment and a terrible container for attestation.
Status is something people report. Issues, boards, standups — the whole reporting layer assumes a human who knows the truth and types it in. Ask an agent whether its task is done and it says yes. Not because it lies — because it is an unreliable narrator of its own work, the way every author is. A status field an author fills in was always soft; with agents it is worthless.
Three inversions, one direction: each moves the scarce thing from the editor toward the gate.
what you'd build instead
Start from the inverted assumptions and five primitives fall out — none exotic, all bolt-ons in the current stack.
1. Work items are typed contracts, not prose. A unit of work carries, as data: what done means, executable checks, its risk class, what it depends on and unblocks. Machines dispatch it, schedule it, and refuse it when ambiguous. The ticket-as-text-blob survives only where a human wants to talk.
2. The system of record is an append-only ledger of events. Claimed, implemented, checked, verdict-posted, gate-answered — each an attributed fact that stays written. It is a transaction log, for the same reason banks keep one: when the actors doing the work can also narrate it wrongly, the record must not be editable by the actors. An audit trail the author can quietly revise is a diary.
3. Queues are first-class, and the human gate is the scheduled resource. In a fully agentic shop, humans stop being the workers and become the capacity constraint — the finite, expensive server every unit of work eventually passes through. Today's tools have no concept of this queue, so it forms anyway — invisibly, as green checkmarks nobody has accepted. Designed properly, the system knows the gate's capacity, applies backpressure, and spends idle worker time preparing evidence for the checker — the scarcest hour in the building.
4. Evidence is attested, not asserted. Checks produce signed facts about a changeset: who verified, independent of whom, against which exact tree, with what result. Segregation of duties — maker-checker — enforced by identity, not by convention: the author cannot post their own approval; the verifier cannot be the implementer. Decades of compliant financial systems run on exactly this, and it is precisely what agent fleets need — not because agents are malicious, but because plausible-and-wrong survives review at machine speed.
5. Status is derived, never typed. Boards, dashboards, "where are we" — all projections computed from the ledger. If a human or an agent typed a status, it is an opinion. If it was derived from evidence, it is a reading. The difference is whether Thursday's review is a negotiation or a measurement.
The pull request then splits into its real parts — a changeset, an evidence bundle, a set of attested verdicts — and merge becomes mechanical, firing when the gates are green, like settlement after clearing. The issue splits into a typed work contract and an escalation record for human decisions. CI stops being a wall of status icons and becomes a producer of facts. Five primitives, one design decision made five times — spend the machinery on the checker, not the writer.
the pile, re-measured
The July numbers are a dated snapshot, so I re-ran the count. On 2026-08-19,
gh pr list --state open, summed across the four repositories our fleet
works, returns 57 open pull requests — 57 changes sitting between written and
trusted. The fleet's composition has changed since July; the shape of
the pile has not. Seventy years of tooling — compiler, IDE, CI, code review —
economized the writer. Whatever that pile costs me, it is not keystrokes. The cost
that dominates now is establishing that machine-produced work deserves trust; the
instruments for that are the older equipment of regulated industries: contracts,
ledgers, queues, attestation, independent verification.
the part where I don't tell you to burn down GitHub
The honest turn: I run all of this on GitHub, today, and I'd advise you to do the same.
The five primitives need no new forge — discipline plus a thin layer: typed work items are files in the repo with a linter that rejects ambiguity; the ledger is git itself, kept append-only, tombstones instead of deletions; verdicts are posted by scoped machine identities the author cannot impersonate; status is a generated artifact nobody may hand-edit; the queue math runs over all of it. The forge underneath is demoted to what it is genuinely good at — hosting the record, arbitrating the merge, rendering the surface humans read: structurally, an adapter. Build the layer well and which forge sits underneath stops being an architectural decision. That is the bet behind Assay, the methodology we run and publish, and six weeks of operating it under fleet load — early July to mid-August 2026 — have only sharpened the claim.
There is a tempting wrong turn worth naming: reaching for a drag-and-drop workflow engine as the agent orchestration layer. The event-driven instinct is right; the form is wrong. Routing judgment belongs in agents. Deterministic logic belongs in ordinary code, diffable and testable like everything else you trust. A visual flow graph is a third language that cannot hold the first job and does the second one worse. Adopt the event log; skip the boxes and arrows.
the hedge
The evidence here is one shop's: an agent-heavy fleet by deliberate choice. A team with a different writing-to-checking ratio will feel the inversion later or less. The July figures — eleven agents, roughly three dozen stacked items — are our operating snapshot from that month, quoted as observed, not re-measured; the 57 is from 2026-08-19 and includes a handful of deliberate publication holds rather than checking debt. Six weeks under fleet load is early evidence, not longitudinal proof. The primitives are cheap to describe and real work to operate: scoped identities rot, linters over-reject, and a derived board is only as good as the events feeding it.
the Monday test
Count the items in your shop that are done by tooling definitions and not yet trusted by yours — open pull requests are a fair proxy. Small and stable: your constraint is still the writer; the 2008 furniture serves you fine. Growing with every agent you add: the constraint has moved, and more agents buy you pile, not throughput. Then rebuild one gate around the checker — give its work items an executable definition of done, verdicts from an identity the author cannot touch, and a status derived from the record.
The teams that thrive with agent fleets won't be the ones with the most agents — they'll be the ones who noticed the constraint moved and rebuilt around the checker. Done is a gate you pass, not a box you tick — design for the gate.