← All work

Decatron

The agent harness — what actually drives the fleet

Last devlog: August 25, 2026

STRUCTURE IS MECHANICAL · JUDGEMENT IS HUMAN Work ordertasks, budgets, rulingsa named person signeddeterministic · offlineDispatchone model does the task;output bytes captured exactcapture is deterministicIndependent reviewa different vendor's modelreads the captured bytessame-family review refusedThe ledgerappend-only, hash-chainedevery dispatch and verdictalways onMechanical recoveryretries / reviewer swapsonly if captured bytes = 0identical-failure guardAdjudication — a named humansettles what machines may not · live, or via a ruling they signed before the runanything that produced bytes cannot be “recovered” awayevery ruling lands in the ledger under their namebyteless failures onlyMACHINES MECHANIZE STRUCTURE · THEY NEVER AUTHOR JUDGEMENT

Key boundary: Every acceptance or rejection traces to a named human — live, or through a policy they signed before the run. The two are distinguishable on the record forever.

Why it matters: Cross the line and the ledger becomes an audit trail of machine self-approval: pages of provenance proving nothing.

Notable decision: A failed reviewer may be replaced mechanically only if its captured output is byte-empty. Labels about what happened can lie; bytes cannot lie about their own absence.

Decatron exists because a model reviewing itself is not a check. Work runs on one model family; review is staffed from a different vendor, mechanically — the engine refuses same-family review across the roster. Every defect found in operation is in an append-only ledger, and fixes ship with a test that fails if the fix is reverted.

What works: fourteen independent projects run through it. Cross-vendor review is a constraint, not a slogan. An evolutionary-search program produced a comparator another team accepted only after rebuilding it from committed bytes and re-running it on a seed they had never seen — 20 of 20 drift cases byte-exact.

What it still cannot do: it runs on one machine, and the estate shares one GPU. The first honest measurement of the regression suite killed about 60% of seeded bugs, clustered in the two subsystems that had already produced real defects. Human throughput is the bottleneck on purpose — every acceptance traces to a named person. A fully autonomous pipeline is out of scope by design.

Devlog posts about Decatron

352 tests, and we finally measured what they were worth

Mutation testing on our agent-orchestration engine: two independent samples agreed only about 60% of seeded bugs died, and the survivors clustered in exactly the subsystems that had produced real defects. Counting tests was never measuring them.

The guard that fired for nobody

We shipped a safety check keyed to a measurement nobody had ever taken, and a user hit the exact failure it existed to prevent — after the fix shipped. The rewrite derives protection from structure instead.