How this is built: a fleet of AI agents under a fail-closed doctrine

A single operator, running a fleet of AI agents, produced in six days what an outside architect review called an institutionally-architected system — a clinical-financial platform where the same hash-chained ledger that will move the money can trace it back through a deterministic compliance gate to the specific signed exam field that earned it. The interesting question isn’t “can agents write a lot of code fast.” It obviously can. The question is why the output didn’t collapse into plausible-looking fiction. The answer is a doctrine, and the doctrine is enforced by the codebase, not by good intentions.

The cents migration is a good specimen. The rename touched 134 consumer sites across 25 files. That work was split across four partitioned agents, each working one slice under a single strict units convention, followed by a human-run reconciliation pass over the out-of-scope consumers the partitions didn’t own. The convention is what keeps parallel agents from disagreeing with each other; the reconciliation pass is what catches the seams between partitions. Schema-frozen worktrees, tsc-verify per slice, sequential-main for schema-heavy work — the mechanics matter, but the invariant is: no slice merges without the compiler enumerating its blast radius.

commit 64ce05c
fix(money): Claim + Remittance float dollars -> integer cents (spine slice)

Renamed 7 columns to *Cents Int so tsc enumerated all 134 consumer
sites across 25 files — no silent misses. Fixed via 4 partitioned
agents under one strict units convention, then a reconciliation pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The renamed columns forced tscto list every call site rather than let one silently keep reading a dollar value as cents — the compiler, not a reviewer’s attention, is the thing that guarantees no partition leaves a 100× bug behind.

Fail closed, everywhere

An unconfigured integration returns a typed refusal with zero network calls; a money flag with an unrecognized value resolves to enforce, never off; production never simulates success.

Propose, never dispose

Agents suggest coding levels, appeal drafts, merge candidates, interpreter billing codes. A human disposes — no exceptions on clinical or money paths.

The gate is not swappable

Vendors, banks, and clearinghouses are all replaceable behind interfaces. The six-condition conjunction and the WORM ledger are the constitution.

De-theatricalization is standing

Every port from a legacy tree is screened for fabricated data, fake providers, and fail-open compliance — and the same knife is turned inward.

The same de-theatricalization knife is turned on the project’s own output. The git record contains commits that de-fabricate the project’s own frontend claims — deliverables that were reported as done but existed nowhere on disk. This is the part that makes agent-scale building survivable: three actors share one git identity and one working tree, and one of them has a documented history of phantom deliverables. The verification culture is the compensating control. An honest narrative discloses that risk rather than hiding it, which is exactly why we write it down.

shteg.ai heavily documents its build, and the blog is that discipline made public. Every post here is grounded in a real commit or a dated spec milestone — because a build narrative that fabricates its own progress is the precise failure mode the doctrine exists to prevent. If we won’t fabricate a screening result inside the money gate, we won’t fabricate a release in a blog post. The moat was never the parts. It’s the loop, the doctrine, the clearinghouse identity, and the demonstrated ability to rebuild all of it in days without the agents’ output turning into theater.