Standard · the guardrails story
A rule without a check is a wish.
Since July 2026 I've built products through my own company, Strevian. I write the tickets and the engineering standard, make the rulings, design every screen, and review and merge. AI coding agents build behind that standard, then prove the build. Agents never approve their own work.
01The failure · designed against
An AI changes one feature and silently breaks another.
Everything below exists because of this sentence.
Without a check, that failure lives on the bottom rung of the ladder: someone else notices first. The standard exists to move it up.
02The mechanism · rules, checks, gates
Twenty rules, eighty-two checks, ten gates.
Every rule has a check. Every check carries a permanent violation fixture proving it still fires. The strip at the top of this page runs the same ten gates.
Numbers after the mechanism, never before it.
Press Run and watch the strip at the top tick in step with the tags.
- 20rulesthe engineering standard
- 82automated checksbehind a 10-stage CI merge gate
- 10stages, each with a fixture that proves it still firesthe wall at the top of this page runs the same ten
82 checksone square each
Every one of them carries a permanent violation fixture, so a check that quietly stopped firing fails the build.
10 gatesin order, every pull request
- ruleWhat must be true.Twenty of them, written down.
- checkWhat fails when it is not.Eighty-two, automated, behind ten gates.
- fixtureA permanent violation.Proves the check still fires.
03The loop · the human is the only manual gate
Six steps. I am the sixth.
A Linear ticket goes to a self-hosted agent runner, which opens a PR against a walled repo. The ten gates run, then automated review reads the diff and comments. Then I rule and merge.
Press Merge. The diagram will not do it for you.
Six nodes, one amber. The nodes upstream of the ruling light in order and stop there: nothing before it can merge, and the ruling itself is a button, not an animation.
04What it caught · caught, not hoped
Caught, not hoped.
In one bootstrap the harness caught six defects in the agent's own code, and independent verifier agents found a tenancy hole that would have let any module read every church's data. Fixed structurally before merge, with permanent attack fixtures.
Trip it to watch the fixture fire. Close it to watch the fixture stay.
Both buttons work from the keyboard. The log line is read aloud.
fixture · cross-tenant read · armed · waiting
The tenancy hole, retold.
The ChurchVue bootstrap: a module could read every church's data. Independent verifier agents found it before merge. The fix was structural, per-church data isolation at the foundation, and permanent attack fixtures went into the wall so the hole can never open quietly again.
I want holes found, not reassurance.
05What it cost · paid for in practice
Fourteen failure modes, paid for in practice.
Documented in the agent-operations standard.
Each one was paid for in practice before it was written down. I keep the list in the standard, not on this page.
14 entrieswritten up in the standardwithheld
06My lines · from the standard
Two lines I hold the wall to.
The wall is judged by what it catches and by whether it can be trusted to run.
A flaky wall is worse than a slow one.
Enterprise-grade rigor from automation, solo-grade human load.
07The quality ladder · where a failure class can live
Each fix moves its failure class up a rung.
A gate's worth is the cost of what it catches, not the count.
The cross-tenant read climbs with this section, from where the verifiers found it to where it can no longer happen.
quality ladder · where a failure class can live
- 05impossiblethe type system or the schema rules it out
- 04detecteda gate catches it before merge
- 03testeda test would fail if it came back
- 02revieweda reader would have to notice
- 01found in prodsomeone else notices first
cross-tenant readfound at 02 reviewednow at 05 impossible
08Scale · last, and quietly