Methodology

The problem: what breaks when agents do the work

Run several agents on one codebase and two assumptions behind the ordinary controls fail at once. Code review, CI, and an issue tracker assume that the actor who says "done" is durably accountable and that status arrives at human volume; a fleet of spawned agents delivers assertions at machine speed, from sessions that will not exist tomorrow to answer for them. The failures that follow are predictable, and each one names a mechanism Assay carries.

Issue trackers, CI, and code review stay in place; Assay assumes them. They were built for teams where the person who says "done" is accountable in a way a spawned agent is not. What they leave uncovered is consistency checking over agent-authored work-state, with verification gates keyed to risk, and that is the gap the pipeline fills.

The design stance

Three commitments run through every mechanism.

• Every rule is stated with its reason. A convention whose rationale is lost decays into ritual, and a fleet of agents is very good at satisfying rituals literally. Each rule carries the failure it prevents, so it can be re-derived or retired on its merits when circumstances change.
• Gates over trust. A rule that depends on discipline is a wish; a rule the machinery enforces is a gate. Wherever a norm can become a check, a check a lint failure, and a lint failure a blocked merge, it does. The friction lives at the gates, not in the flow.
• Claim the weaker, true thing. The strong claim, that status is measured from ground truth, is false: the sensors are writable by the actors they measure. The methodology claims only what its machinery supports and states the residual gap in its own copy, next to the claim it qualifies. A methodology about verifiable claims that overclaimed for itself would refute its own thesis.

Briefs: the unit of work

The unit of work is a brief: a self-contained scope-and-definition-of-done document in a typed format, small enough for one session to own end to end. Four properties do the work:

• Self-containment. Fleet workers are ephemeral; context that lives only in a session dies with it.
• Typed dependencies. A typed reference that stops resolving is a lint failure; a prose reference that stops being true is silence.
• An executable Verify block. Verification against a table written in advance is repeatable by a stranger; verification against the implementer's recollection of intent is not.
• A risk gate assigned at authoring time. Routing review effort by risk is decided by the author of the scope, before the work exists, not negotiated afterward by the implementer being gated.

Full format and lint rules: Briefs.

How work enters: one front door, two lanes

Nothing becomes work except by classification. Everything inbound, from humans, agents, findings, or retro process changes, arrives at the intake-desk, the single front door, and is routed by one test: could a worker take it as-is? Work-shaped items are filed in the issues register, where the issue body stays the spec. Idea-shaped items become numbered entries in the intake register (a register is an append-only log the pipeline remembers with), and every entry gets a recorded disposition: accepted, and authored into a brief that enters the execution flow below, or deferred, rejected, or duplicate, closed in the register with its number kept.

The lifecycle: who may say what, and when

todo → in-progress → implemented → verified → done

Each transition has one owner, and the owners are chosen so the pipeline can run between gates without anyone re-reading the work. The sequence is a separation of powers.

• Implementers stop at implemented. An implementer verifying its own work is the narrator grading its own exam.
• Verified belongs to a non-author, who re-runs the brief's Verify table on merged main and records dated, attributed evidence. The independence is structural, not cultural: the rule is who runs the check, not how earnestly it is run.
• Merging does not verify. A merged brief sits in an awaiting-verification queue until a non-implementer is dispatched. Verified is a distinct, owned step, not a side effect of merge.
• Done requires a recorded review, and the two checks never substitute: the Verify table proves function, the review proves quality. A risk-flagged brief additionally requires a named human.
• Attribution is mandatory. Verified and Reviewed cells take dated, attributed entries, never a bare checkmark. An undated tick is unattributable and unauditable.

The full arc: Lifecycle.

The desks: who owns which transition

Five standing desks run the lifecycle. Four are loops: the intake-desk above, then the worker-desk, the pr-review-desk, and the verify-desk. The fifth, the-desk, is the coordinator: it arbitrates across streams (a stream is a named body of related briefs with its own README) and keeps the registers in order, and it is a hub, not a loop. Each stage transition has one owner, and the two transitions nearest the finish line belong to a desk that did not write the change. What each desk runs unattended, and what it will never do without a person, is on Desk roles.

Registers: memory that resists its authors

Three append-only logs are the pipeline's memory: FINDINGS for knowledge that invalidates existing work, INTAKE for raw ideas awaiting disposition, and RETRO for the cadence retrospective. They are the part of the record the agents being recorded can reach, so their integrity rules are the strictest in the methodology.

• Append-only, with enforced sequence contiguity. A missing number is the visible signature of a deleted entry. The check makes deletion machine-visible instead of luck-visible.
• Withdrawal is a tombstone, never a deletion. Keep the number, flip the disposition, let the body explain. The history of being wrong is itself evidence.
• Findings propagate staleness. A finding names the briefs it affects, and every affected brief is flagged and excluded from the work queue until it resolves. A discovered problem must not be outrun by the work it invalidates.
• Escalation is gated. Anyone can file a finding, but only one carrying the desk's on-record acknowledgment can hard-error an in-flight brief. An ungated demotion rule would let any session drop a rival brief by filing a paragraph.
• The retro reads instruments, not narrative. Board totals, untouched streams, what the gates caught, register ages. One process change per retro, and only one that displaces the current worst pain.

Formats and conventions: Registers.

The board: status as a build artifact

Nobody maintains the status board (the generated roll-up of every stream's briefs and their states). It is derived from the stream documents and registers by one tool, statusgen, which also lints the entire document set in CI. Derived is the word: the board is computed from agent-authored artifacts with consistency linting, not measured from ground truth.

• Single writer. The board is never hand-edited; its only writer is the main branch's CI. A board with one writer is a board where every change traces to a change in a source document.
• Committed, diffable, lintable. The board is a file in the repository, not state in a dashboard. It can be diffed, reviewed, and checked by a script, and it outlives any tool's UI.
• A computed work queue. Next-up weighs priority and staleness across all streams, caps any single stream's share, and excludes briefs held by unresolved findings, so a worker takes the most important brief anywhere rather than the next brief in its own stream. Known limitation: priority-plus-staleness rewards neglect regardless of why a stream aged. The board is a heuristic scheduler, not an oracle.

The tool: statusgen.

Tiering: which model does which job

A fleet has to keep answering a question a single agent never asks: which class of model should take this piece. Assay answers it in advance, from the shape of the work rather than from whoever happens to be running, on one asymmetry: authoring errors compound through every implementer that takes the brief as its premise, while implementation errors meet a Verify table, a reviewer who did not write the change, and a non-author re-running the checks on merged mainline.

• Authoring and triage run strong; implementation runs cheap behind the gates. The second clause carries the first. Cheap execution is safe because three mechanisms are already watching it. Adopt the tiering without the gates and the same policy just ships worse work faster.
• Effort keys the default, and a brief can tighten it. An optional field asserts a minimum tier for work whose difficulty its size understates, derived from three complexity questions rather than chosen. It only ever tightens; it never widens a brief down-tier.
• Verification does not escalate to a bigger model. Every other rung answers uncertainty with more capability. This one does not: a risk-flagged brief cannot be signed off by a model at all, so the ladder's top rung is a named human.

The policy, per role, and what none of it checks: Model tiering.

The feedback loop: sensing, not just moving forward

Seven loops, one coordinator. The four desk loops above move work; three more, metrics, analysis, and retro, sense it. Everything the desks do lands in artifacts, the board is recomputed from those artifacts, deterministic instruments read the records, analysis turns what they measured into findings, and the retro admits one process change per cadence, on evidence. Findings and process changes re-enter through the same front door as any other work, so the pipeline routes its own defects back into its own queue, to the extent, and only to the extent, that the defects show up in the records.

The incident that shaped the registers

That incident is published rather than buried because it is the clearest demonstration of the methodology's thesis, and it is the direct ancestor of the rules above: sequence contiguity, so a deletion leaves a numbered hole; tombstone-not-deletion, so retraction has a sanctioned path; a single-writer board, so no session can hand-edit the roll-up; and a review stamp no implementer can mint. Every enforcement mechanism in Assay exists because the convention-only version failed on first contact with the actors it was meant to govern.

Non-author review and the assay mark

The lifecycle's review step produces a stamp, not a sentence: a review counts only when it is posted by a separate identity the author cannot post as, in practice an App identity whose credentials no worker session holds. Anything an implementer can write about its own work is a claim; the stamp is the one artifact in the system whose attribution the author cannot supply. The stamp does not certify that the review was thorough or the reviewer competent. It certifies that a specific, distinct identity performed the review and is answerable for it, which is the property a self-written checkmark lacks.

The name of the methodology is a description of this step. To assay a metal is to test it for what it actually contains: the assayer does not take the refiner's word, but cuts the bar, runs the test, and stamps the result. The brief is the bar submitted for testing. The Verify table is the cut. The non-author verifier is the assayer. The review posted by an identity the author cannot post as is the stamp. The hallmark system worked for centuries because it moved quality from something you were asked to trust to something you could check; the methodology's promise is the same, and deliberately no larger.

Claims in code, judgment in prose

The methodology draws one line and treats the line itself as the product. Every claim that has a machine-checkable witness (a pull request merged, a Verify row re-run, a review posted at head) is derived or enforced by an instrument, never hand-asserted. Only judgment stays in prose, and the prose names the human who owns it. A convention moved into code stops depending on anyone remembering it, and the reward is concrete: instructions get shorter, the places a model can stray get fewer, and a cheaper implementer can be trusted behind the same gates as an expensive one, because the gate, not the implementer, is what the claim rests on.

The same move is the source of the system's brittleness, in six named ways. They are stated here with the claim, not after it: a methodology about checkable claims that hid its own costs would refute its own thesis.

• Code freezes a convention at write-time. When a rule becomes a schema and a check, changing the rule is no longer an edit. It is a new schema version and a migration of everything written against the old one. The rigidity that makes the convention enforceable is the same rigidity that makes it expensive to revise; a versioned brief format is that cost, paid on purpose rather than avoided.
• Fail-closed instruments fail whole. An instrument that refuses to emit a wrong answer will refuse to emit any answer: a single malformed brief can freeze regeneration of the board for the whole tree rather than degrade one cell. Per-node containment, a bad node reported as bad while the rest still computes, is a property that has to be designed and built, not one that comes free with failing closed.
• Enforcement taxes every legitimate session. A guard that stops the bad write also stops the good one that happens to resemble it, and the legitimate session pays the same friction as the one being blocked. Past a threshold, friction stops deterring and starts breeding workarounds: the evasion becomes the guard's own product, and a control that is quietly routed around is worse than none, because it still reads as present.
• Code cannot hold judgment, and looks as if it can. Some decisions are irreducibly a matter of judgment, and dressing one as a machine-checkable derivation does not make it one; it only lends it unearned authority. A call that should have carried a named human's signature, keyed instead on a proxy signal, will be made confidently and wrongly, and the derivation's air of objectivity makes the error harder to challenge than a signed prose note would have been.
• Green is not good. A passing check certifies only that the failures it was written to catch did not occur; its coverage is the set of incidents that have already happened. The failure nobody has had yet is invisible to it, so an all-green board reports the absence of known faults, not the presence of quality, a distinction that erodes the moment green is read as a grade.
• The forge becomes the truth store. When status is derived from the version-control forge, the forge's mutability becomes the methodology's exposure: a force-push or a rename can leave a derivation pointing at the wrong object and emitting a confident, wrong answer. The discipline that contains this is narrow and absolute. Unknown must mean "could not look," never "looked at the wrong thing," and holding that line is a standing obligation, not a solved problem.

None of the six is an argument against the line; each is the price of drawing it, paid deliberately. The rule that decides what belongs in code and what stays in prose, and who owns the prose, is the thing actually under design, and it is never quite finished.

The claim, and the residual gap

What the machinery supports. Status is derived from agent-authored artifacts with consistency linting, backstopped by independent re-verification. The linter checks internal consistency: sequence gaps, missing evidence, unresolved findings, malformed gates, hand edits to the generated board.

What it does not support. The board is not measured from ground truth. The generator parses tables, frontmatter, gate cells, and evidence blocks, all markdown written by the same agents whose work they report. The sensors are writable by the actors they measure. A lint can check that a done row has a Verified entry; it cannot, today, prove the string in that cell corresponds to a real verification run. Extending identity attribution from the review stamp to the verification gate is the designed hardening; it narrows the gap without closing it while a single identity can author both the work and its record. Nor does the pipeline extend past main: it runs from intake to verified-on-main, and release, deploy, and rollback are not in it today.

What is deliberately not published. No productivity multiplier, no output-per-agent claim, no tier-comparison result. Those figures have no measured baseline, no quality adjustment, and no controlled design behind them. Refusing to quote a number we cannot recompute is the position.

Where the line falls. That refusal is about claims, not about counts. A raw count of our own activity (commits in a window, changes merged, bugs filed) is recomputable by anyone with the same command, the same window and the same commit, so it is publishable; a figure asserting that this represents more or better work than some alternative is not, because there is no baseline against which it could be recomputed. The how-it-runs snapshot publishes only the former, states the instant and commit each number was taken at, names the result cap standing behind each one, and leaves every metric it could not compute visible in the table rather than dropping it, marked could-not-check and given the same weight as the ones that resolved. No count from that page is restated here: it has one source, and a second copy of a number is a copy that drifts.

Where the methodology does not pay for itself. For a human-paced team, this machinery largely duplicates code review plus CI plus an issue tracker, and the non-author verification step costs a second actor's time. The return comes specifically where agents do a large share of implementation and self-reported status has stopped being informative. Today's lived evidence comes from a single-operator fleet regime; the multi-actor regime, with distinct identities so a forged verification cannot lint green, is a designed direction, not a shipped property.

Placement

The mechanisms here have neighbors: artifact-backed lifecycles, spec-time contradiction checking, verification-strength ladders, and risk-routed oversight all have published precedents that informed the design. A prior-art sweep run on 2026-07-08, refreshed against the July 2026 landscape, found no published counterpart for the combination described here: a generated single-writer board, a cross-stream computed queue, findings with staleness propagation, and an intake register, joined to a lifecycle whose verification evidence must come from a non-author. That finding is scoped to our own sweeps; we say "we found none," not "none exists." The individually novel pieces are few; the discipline is the assembly, and the placement: documents plus a linter that sit under whatever harness, tracker, or orchestrator a team already runs, with the work record as a committed artifact rather than a vendor's UI state.

The toolkit is Apache-2.0, adopted by pinning a released binary rather than copying source in, and in daily use on the regulated-finance build it was extracted from. This page describes the methodology that build actually runs, not a specification awaiting a first user.

The summary fits in three sentences. Agent fleets generate claims at machine speed, and the claims are not trustworthy on their own. Assay does not try to make them trustworthy; it makes them checkable, by a script in CI and by a second actor posting as an identity the author cannot post as. Quality you can verify, not quality you are asked to trust.