The repo is a factory

Agent steps run read-only, with no direct secret access, in a container; an algorithmic preload assembles the information package so the agent does not roam for inputs; output passes through narrow, countable channels — this workflow may create exactly one issue — with plan and apply separated and threat detection between the stages. Pull requests are never merged by the system. The safety economics invert in automation: better rails let the train run faster, so guardrails are what license autonomy.

A daily maintenance loop — wake on a cadence, read its memory, pick from a maintainer-shaped task list — burned down years of accumulated backlog on dormant open-source repositories and shipped multiple releases from projects that had gone quiet. The work was always there; it was labor-constrained. The conclusion generalizes: quality work that never fit the budget becomes schedulable.

When flow jams, the management move is not to repair items by hand but to add a quality gate to the factory so hundreds flow. Repositories are blocked, flowing, or idle — and blocked-on-human is a state, not a failure. The owner's job shifts to flow design.

A five-person company bans handwritten code outright: humans own design decisions, constraints, and invariants; a planner faces a deliberately adversarial reviewer with the loop capped at five before a human arbitrates on structured disagreement data; five CI gates — including skill quality as merge-blocking, because the agent is the primary operator — and 217 of 295 triaged issues shipped in 30 days. At the other pole, one team self-merges with no human review at all. It works for them; nobody else followed, and the divergence across the whole conference was only ever in how much evidence the gate receives.

Intake, worker, review, verification, arbitration — five cadenced roles, each producing a narrow artifact, together "automated, repetitive, collaborative, integrated, auditable," which is the Continuous AI definition restated. The closest external implementations converged on this shape independently; that is the strongest validation in the playlist.

"The pull request is the hard human-in-the-loop point" has been Assay's standing rule: agent work lands as draft pull requests, a reviewer role owns the ready flip, and a human merges. Arrived at independently by every serious implementation on stage — evidence the constraint is structural rather than conservative.

Each role writes through its own verbs under its own application scope — the may-create-exactly-one-issue pattern, implemented as enforced permissions rather than declared configuration. Declaring the output budget as inspectable data is a planned tightening of the same idea.

When a failure class recurs, the response is a guard, a lint, or a board check — not the same hand-fix again. That is "fix the gate, not the instances," and it is where the registers, the guardrail layer, and the feedback loop meet.

Auto-merge on green: the human gate is a posture, not a missing feature — loosening it for narrow classes would first need the sibling's depth of automated gating, and that trade is not warranted here. And the agent zoo — hundreds of one-off workflows — would spend the trust roster, the token scoping, and the review ownership that five comprehensible roles preserve.

8 of 93 talks shown — the ones that reach the most concepts in this theme. Every sighting, per talk, is on the concept pages above.