status: architectural blueprint
01 / 13

Stayfull Engineering blueprint

The self-observing factory

Features ship through one gate. Fixes come back through another.

Build loopfeatures out

Observe loopfixes back

Human gatea human mutates

layer_01

Feature gate

CI green, exact-SHA promotion

layer_05

Fix gate

Human approval

layer_06

Production

Every incident becomes a gate

layer_04

Build

Orchestrated agents in leased worktrees

layer_02 · layer_03

Observe & triage

Signals classified, investigated read-only

Customer intakeintake

requestsmessages
ticketsbugs

→ build

→ observe

env: production
auto_promote: true

status: architectural blueprint
02 / 13

Architecture

Six layers, read from the ground up

Each layer depends on the one beneath it. The sections that follow open them one at a time; the legend in each corner shows where you are.

Human gate

Self-observationrises through every layer

Human gateonly a human mutates

layer_06Memory & knowledgeslides 10–11

Turns every incident and lesson into structured records and validated rules, so the system gets stricter over time.

layer_05Guardrailsslides 08–09

Decides what an agent may do: autonomy modes, tenant scoping, budgets and risk tiers, enforced in code rather than prompts.

layer_04Workforceslide 07

Splits work across fixed roles under one orchestrator, so cost and concurrency stay predictable.

layer_03Autonomous triageslide 06

Classifies red runs, investigates read-only and hands a human a ready proposal.

layer_02Observabilityslide 05

Collects signals from inside, beside and outside the app into one on-call channel.

layer_01Delivery laneslide 04

Moves every change through one pipeline, where CI is the only definition of green.

status: architectural blueprint
03 / 13

Overview

Two engines, one invariant

The factory runs two engines on one codebase. One ships deterministically. The other watches the system and proposes fixes. Neither mutates production on its own.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

engine_a

Deterministic ship

Every change rides the same lane, gated by the same checks, promoted by exact SHA.

worktree

pr

verify

merge

promote

~4.4

Production promotions per day

97%

First-attempt test pass rate

engine_b

Autonomous triage

The system reads failure prose, investigates read-only, and outputs actionable proposals.

read the failure
investigate read-only
write a proposal
stop

The core invariant

The agent proposes, a human mutates.

status: architectural blueprint
04 / 13

Layer 1 · Delivery lane

The single definition of green

Every change travels one lane, from a leased worktree to an exact-SHA promotion. CI decides what is green; independent models then try to break it.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

CI is the single definition of green. The local no-mistakes gate is structurally retired.

stage_01

Leased worktree

Each worker leases an isolated tree from a pool of six.

treehouse get --lease

stage_02

Direct PR

Opens on a fast, medium or slow lane, sized by risk.

release/lane.mjs

stage_03

Verification

CI runs the full check. Its result is the only green.

npm run verify

stage_04

Adversarial review

Models from different providers try to break the final diff.

4 reviewers ↓

stage_05

Merge train

Reviewed PRs integrate in batches, in order.

batched

stage_06

Exact-SHA promotion

Production receives the exact SHA that went green.

promote-production.yml

stage_04 · detail

Adversarial review

The final diff goes to frontier models from different providers, each told to break it. No single model’s blind spots decide what ships.

C Claudeanthropic

C Codexopenai

G Geminigoogle

X Grokxai

Verdict rule

Every reviewer must pass.

Any objection stops the merge and goes to a person.

Disagreement → human

status: architectural blueprint
05 / 13

Layer 2 · Observability

Three gateways, one channel

The factory watches itself from three vantage points (inside the app, beside it, and from outside it), and every signal lands in one place.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

In-processApplication state

Errors and traces from inside the running app.

@sentry/node · @sentry/nextjs

Platform logsOut-of-process

Allowed metadata fields only.

vercel / railway drains → structured json/proto

Platform healthBlack-box

Is it up, seen from the outside.

railway direct watch + uptime.yml

signal

Centralized notification channel

ONCALL_WEBHOOK_URL

Delivered to Telegram

Why out-of-process

In-app exporters die with the app. Drains capture the exact seconds of failure.

status: architectural blueprint
06 / 13

Layer 3 · Autonomous triage

The red run path

When a staging run goes red, the system classifies it, investigates read-only and hands a human a ready decision.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

step_01

Signal arrival

A red staging acceptance run triggers the flow.

jev_stayfull

step_02

Autonomous classification

A classifier names the symptom from the failure prose.

triage/jev-triage.mjs

step_03

Read-only investigation

The agent reads strictly non-tenant surfaces.

logs · traces · runs

step_04

The artifact

A proposal citing evidence and the exact command.

github job summary

step_05

Human gate

The mutator. A human engineer reads the proposal and decides.

Requires a human

Classifier, per runscripts/triage/jev-triage.mjs

12/15

Symptom classifications correct

~4 s

Time to classify

~$0.005

Cost per run

0 / 2

Exit codes it can return

The payoff

Ten seconds of human judgment replaces two hours of manual diagnosis.

status: architectural blueprint
07 / 13

Layer 4 · Workforce

The autonomous workforce

Five roles, each with a fixed job, a fixed authority and a fixed reason to stop and escalate.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

Worker	Does	Decides	Escalates when
First Mate orchestrator	Orchestrates workflows, writes contracts, splits work	What gets built next, how work is split	Anything high-risk
Crewmate builder	Codes against one contract in one leased worktree	Everything inside its contract	Scope changes; a second owner for a fact
Deckhand chores	Executes fast-lane integration chores	Nothing beyond the chore	Anything that is not the chore
Sweeper docs	Maintains documentation truth via atomic fix-up PRs	Whether a document contradicts the code	Contradictions needing product decisions
Watch on-call	On-call triage. Investigates read-only and proposes	Nothing. It proposes and stops	Everything

One orchestrator

Workers never dispatch each other, so token budgets and worktree pools stay mathematically predictable.

status: architectural blueprint
08 / 13

Layer 5 · Guardrails

The on-call agent contract

Four terms bind every on-call invocation: how much it may do, whose data it may see, what it may spend and what it must record.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

Autonomy modes

term_01

offNo triggers fire.

suggestDefault. Investigates and proposes; executes nothing.

autoMedium-risk actions allowed on one-reply human approval.

Tenant scoping

term_02

api/src/middleware/orgScope.ts

A server-side, immutable claim. Missing scope is rejected immediately.

null means refuse, never global.

Identifiers are strictly redacted.

Cost budget

term_03

300,000output tokens per incident, hard ceiling

Gated by a quota-axi v0.1.60 preflight.

Tooling cost is accounted outside product AI spend.

Action log

term_04

An append-only log per invocation tracks:

trigger
rank
reads
proposals
outcome

Required to compute repair and false-positive rates.

status: architectural blueprint
09 / 13

Layer 5 · Guardrails

Risk tiers & the execution perimeter

Every verb an agent can run belongs to a tier. The higher the tier, the less an agent may do on its own. At the top, nothing at all.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

tier_3 High risk Human-only, permanently

Promote to production, migrate databases, rotate secrets, touch DNS.

tier_2 Medium risk suggest / auto

Roll back to the last verified SHA, toggle existing feature flags.

npm run rollback

tier_1 Low risk act

Read logs and metrics, run scoped database queries, open PRs.

Enforcement mechanism

The boundary is physical, not prompt-based.

PreToolUse hook

Actively refuses high-risk verbs, regardless of mode.

Triage profile

Withholds the service-role key from the session entirely.

status: architectural blueprint
10 / 13

Layer 6 · Memory & knowledge

Incident memory & quantitative state

Incidents are written as structured records, not stories, so the factory can measure itself from its own history.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

Incident records

docs/incidents/
YYYY-MM-DD-<slug>.md

Parseable headers

detected-at
root cause
mitigation
Cure: | Uncurable:

Every record ends with an explicit cure or uncurable tag.

Processor

scripts/incidents/stats.mjs

Processes incident memory and fails closed.

Computed operational metrics

MTTDMean time to detect

MTTRMean time to repair

FP rateFalse-positive rate

$ / fixCost per fix

Why it matters

Every incident the agent learns from ends as a mechanical gate in the build lane. The exact same fault cannot return quietly.

status: architectural blueprint
11 / 13

Layer 6 · Memory & knowledge

Knowledge as code: the validator system

Instructions that agents rely on are treated like code: budgeted, structured and checked by the build.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

retired

Decaying text

Open-ended prompt files

Hand-waved instructions

Decaying context windows

Untested assumptions

enforced

Validated state

Skill constraints

scripts/skills/validate.mjs enforces a strict 500-line budget per skill to prevent context bloat.

Contractual frontmatter

A mandatory “Common rationalizations” table maps the excuses an agent is expected to make against factual, mechanical rebuttals.

The verification bar

CONSTRAINTS.md acts as a diff-scoped guard. Lowering a threshold or adding an exception fails the build.

exit 1 · build fails

Knowledge is enforced by exact exit codes.

status: architectural blueprint
12 / 13

Summary

Three principles hold it together

Every layer of the factory is an application of one of these three rules.

06 Memory & knowledge

05 Guardrails

04 Workforce

03 Autonomous triage

02 Observability

01 Delivery lane

6-layer architecture

1

The agent proposes, the human mutates.

High-risk operations (promotion, secrets, schemas) are physically and permanently locked out from autonomous actors.

layer_03
layer_05

2

Missing scope means refuse.

Tenant isolation is absolute. In this architecture, null is never interpreted as global scope.

layer_05

3

Verification is mechanical.

A capability without mechanical enforcement decays into prose. If a document cannot be verified by a command-line reproduction, it is treated as a systemic liability.

layer_01
layer_06

status: north star
13 / 13

Vision

The end-state: autonomous reliability

1 Control what matters

Provide strictly enforced sandboxes; let agents operate with total freedom inside them.

2 Wire the brain

Connect classifiers to unlock sub-penny, proactive root-cause detection.

3 Measure & hold out

Establish rigid incident records to prove agent efficacy via blind replays.

North startargets, not current metrics

0 Lines of human-written code

0 Faults that return quietly

10 s Of human judgment per change

24/7 Shipping and self-repair, no pager

The most valuable agent is the one that doesn’t need you to ship. It works for you, then waits.