What three months looks like.

—Autonomy enforced in code, not prompts. Every agent action passes an L0–L4 ceiling checked at the API boundary, an earned scorecard (10+ human decisions, 85% clean rate), and a per-agent, per-action-class trust lane. One rejection resets the lane to zero. The never-autonomous red lines — money, production data, legal commitments — are invariant-tested so a future edit cannot quietly open them.

—An agent organisation living in Slack as named colleagues. Five C-suite agents with their own bot identities, ~25 further named roles addressable individually, and a #boardroom channel that convenes a multi-agent debate. Not one bot — an org chart.

—External sends are earned, lane by lane. Newsletters, support replies, review responses: each unlocks only behind a clean-approval streak plus a fail-closed brand-and-policy judge that blocks overclaims against the actual state of the product.

—A spend governor wired to the live financial model. Next month's marketing budget is derived from loss headroom and projected burn, with escalating circuit-breakers — including a hard stop to zero and an anti-doom-loop detector.

—The scale of it: 3,571 passing tests across 75 suites in the operations repo alone; 1,568 commits since its first commit on 26 May; roughly 40 scheduled agent jobs running around the clock.

—A consumer AI app engineered for 20 markets from day one. Both hemispheres handled by a Köppen-Geiger climate engine; 13 fully localised languages enforced by CI parity gates that fail the build on a missing key or an untranslated string; cross-store price parity verified by script.

—Personalisation that is combinatorial, not cosmetic. Advice is shaped by market (20), species (449), climate archetype (8), soil pH band (4), organic-matter band (3), garden goal (11) and experience level (4) — more than 37 million distinct advice contexts the engine can serve, before live weather modulates them further. Every factor counted from the code, and the arithmetic is on the page because you'd check it.

—Features engineered around their failure mode. Local pest alerts that require three independent reporters and host-plant matching before anyone is notified — no names, no coordinates, because one false alarm pinned near a real garden would kill the brand. Per-user AI spend caps priced from actual subscription unit economics, enforced in Postgres.

—Live birdsong recognition with a geo-temporal prior and a display gate that stops a country prior passing off an unconfirmed bird as the answer — benchmarked honestly against Cornell's Merlin, including the assumptions that didn't survive.

—Real client systems in production: a music school's recurring-lesson scheduler, family portals and AI digests (the database itself refuses to show a family anything a human hasn't pressed publish on); a print firm's hand-rolled PDF engine with a byte-level preflight verifier that parses its own output back to prove every name and logo landed correctly; an autonomous website factory whose money-to-live-site loop runs Stripe → domain registration → deploy → handover.

—A governance kernel as a product: zero-dependency TypeScript — autonomy, fragility, proposals — 133/133 tests green, including a self-auditing gate that recomputes an agent's declared risk tier and treats under-declaration as an audit failure.

—A 47-agent adversarial security audit that found a real identity-spoofing vulnerability before launch — ten finder agents per attack surface, then independent refuters attacking every finding before it was accepted.

—A 29-agent scale audit to 100,000 users grounded in live production queries — it proved one supposed mitigation was a dead no-op and caught a race condition that paid an AI provider before checking the spend cap.

—Cross-vendor judgement as routine. Autonomous pull requests are adjudicated by a rival vendor's model reading the raw diff against a rubric, wired into branch protection as a required check. A model outage fails the gate closed — it can never wave a change through.

—Keyless CI. GitHub Actions federates directly into Anthropic's OAuth token exchange via OIDC — no static API keys in CI, and a start-up guard aborts if one is ever present.

—Moderation with real injection defences: untrusted content wrapped and declared never-an-instruction, free text clamped to known values before it reaches the model, parsing that fails closed to escalation, and a per-run removal cap sized to the exact pattern a prompt injection would produce.