AI-assisted operations

The short version

Bottom line. An AI agent does the day-to-day engineering here, inside a written authority envelope that has narrowed as often as it has widened — and its known ways of fooling itself are loaded as a control before the work rather than written up after it.

Risk managed — the expensive failure is not an agent that breaks something, it is an agent that reports success it did not verify. Every claim is required to rest on the artifact a consumer receives, and a finding outside scope is captured rather than acted on.
The decision that mattered — nothing enters the estate ungrilled: an idea becomes committed work only after a four-layer design interrogation and an explicit human approval.
What it costs — speed. A design gate in front of every commitment is friction by construction, and it is the friction that stops a plausible wrong premise becoming delivered scope.

An AI agent does the day-to-day engineering on this estate: it writes the Ansible, authors the pipelines, runs the investigations, writes the decision records and delivers the work items. That is not the interesting claim — plenty of things can generate configuration. The interesting claim is that its authority is written down, its knowledge is retrieved rather than remembered, and the specific ways it has been wrong are a named taxonomy it is required to carry into every session.

402recorded agent lessons
22named failure classes
471architecture decisions recorded
1,503pages in the documentation corpus

The operating loop

Autonomy is an envelope, and the envelope is a document

The agent has standing authority to remediate and to deliver, and it has hard stops it cannot cross under any grant — network configuration, the home automation platform, the edge provider, external exposure, anything irreversible. Those are not prompt-level preferences; they are prime directives, and they bind the autonomous paths exactly as they bind an interactive session.

The autonomous remediation authority standard generalises what began as one bounded permission into a written envelope: what may be done unattended, what must be proposed, and what must never be attempted. Its history is instructive — a broader delegated tier was withdrawn and re-granted more narrowly, with a circuit breaker and independent verification attached (ADR-0403). Autonomy here has gone down as well as up, which is the only evidence that the envelope is real.

The most-often-quoted piece of the envelope is the smallest: an agent’s self-report is never sufficient evidence. A worker that delivers a change reports a verdict; the orchestrator re-asserts the evidence itself before anything is marked done. A system where the entity doing the work also certifies the work has no control at all.

When the harness blocks it, it defers — it does not route around

A safety classifier will sometimes refuse an action the agent is genuinely authorised to perform. The wrong responses are obvious in hindsight and tempting in the moment: retry variations until one slips through, or quietly do it another way. Both convert a control into an obstacle.

Instead the action is classified against a committed register and deferred: recorded, with the exact command and an assertion that will only pass if the work actually happened, into one standing script for the run. The design is blocked-action deferral and ADR-0414. The clause that matters most is the one about the assertion: it must be impossible to satisfy without the work, because it closes the work item unattended.

What the agent knows, it retrieves — it does not remember

Every session begins with no memory of the last one. The honest description of that position is not “limited context” but an unreliable narrator: a briefing assembled from documents, transcripts, other agents’ reports and the agent’s own earlier claims, all of it stale, partial and confidently worded — and none of that looks any different from the truth.

So system knowledge lives in the corpus and is retrieved, never recalled (ADR-0018). Retrieval itself is a governed standard rather than a habit (ADR-0353), because a weak search does not fail loudly — it returns something plausible and the work proceeds on a half-fact. The rules that follow are mundane and load-bearing: an empty result describes the query until a positive control proves the query could have returned anything; one query is not a search; and a retrieved fragment is followed back to its page before it is relied on.

The failure taxonomy is the actual innovation

Most operational lessons are written as postmortems. A postmortem arrives after the mistake, which means it is a record rather than a control.

Here, each lesson is a page carrying the named class of self-deception it belongs to, and the class list is loaded into every session before any work starts. The classes are shapes, not incidents — an assertion that would still pass with the feature removed, an empty result read as an absence, a watcher wired to a signal it cannot observe, acceptance mistaken for completion, a cause the agent authored rather than observed. The shape is in mind before the trap, not after it. The design is the agent lesson corpus; the amendment that moved lessons out of private memory into this shared corpus — so a trap learned in one session is retrievable by every other — is ADR-0392.

The single sentence underneath all of them: the agent never observes the system, only its evidence — exit codes, logs, dashboards, API responses, its own account of what it just did. Every class names a place where the evidence and the system quietly diverge, and the operative question is never did it pass? but what would this have done if the thing were broken?

Agent operations — 471 decisions, 402 recorded lessons

Snapshot taken 25 Aug 2026, 12:16 AEST — build-time, not live

471decision records
402lessons captured
22named failure classes
1,503corpus pages

Decision cadence

Week commencing 15 June 26 to 17 Aug 26, peak 80 in a single week. Dates come from each record's own header where it states one, and from the file's first commit where it does not.

Where the reasoning fails — the estate's own taxonomy

standing-directive55

environment-invariant53

foreign-ground36

empty-is-not-absence29

assertion-cannot-fail23

accepted-not-done23

inherited-diagnosis22

instrument-shapes-reading19

partial-gate19

orphaned-declaration18

blind-watcher17

unswept-consumers16

proxy-not-artifact16

authored-not-observed14

edited-not-running11

guessed-identifier10

present-but-incomplete6

wrong-frame-reading6

inherited-authority4

unreachable-control3

sample-as-steady-state1

borrowed-parameter1

Each lesson is one page carrying the named class of self-deception it belongs to — an assertion that could not have failed, an empty result mistaken for an absence, a watcher wired to a signal it cannot observe. The classes load into every agent session, so the shape of the trap is in mind before it is walked into rather than written up afterwards. The distribution is the useful part and it is not flattering by construction: the tallest bar is the mistake made most often.

How well each lesson is evidenced

verified153

cited145

partial91

reproduced5

confirmed5

proven2

measured1

A lesson carries the tier of evidence behind it — verified against the live system, reproduced, partially checked, or merely cited. A corpus that did not grade itself would be a pile of confident claims, which is the exact failure mode it exists to prevent. Corpus at commit f1121ff.

Findings do not become a to-do list

Anything the agent notices mid-delivery that is not part of the work is routed the moment it is spotted, by one test: part of this commitment, a defect in something already in production, or neither. The third case goes to a snag list — one board row per commitment, invisible to delivery, adjudicated once at close-out into exactly one disposition, and the commitment cannot be closed while any snag is unrouted (ADR-0372).

This exists because the alternative was measured. A reflex to file every observation as new work produced a board with a hundred and nineteen open commitments, fifty of them with no open children at all. Backlog growth had to become a conscious act.

The mirror control is hypercare: delivered work does not go straight to done. It parks in a supervised window and reaches done only via a review that re-runs the acceptance criteria against the live service. The date summons the review; it never closes the window.