A protocol for running fleets of coding-agent sessions — Claude Code and similar — on real, commercial software. Written rules, hard human gates, provable artifacts. Not a framework, not a harness: the methodology layer above them.
the series · the author · saphan.ai
How the fleet works: roles, the gate sequence, dispatch rules, order/status channels, proof-over-claims.
Where a project's truth lives: one repo per project — constitution (§1), tasks, decisions, conventions. No product code.
The parallel agent sessions doing the work: a master, executors, an independent adversarial review.
The fleet reports to the bridge.
The bridge is governed by the protocol.
Every agent session starts by reading the bridge; the fleet does the work; the bridge records what became true. Humans hold the gates.
| Role | Does | Never |
|---|---|---|
| MASTER | plans, writes executor briefs, creates worktrees, holds the ledger | codes, merges, reviews its own dispatch |
| EXECUTOR | implements one task in its own worktree, commits locally, returns STOP-2 with actual artifacts | pushes, merges, touches worktree lifecycle |
| REVIEW | adversarially checks an executor's return; recommends accept / conditions / reject | writes code, designs anything |
| HUMAN | decides at every gate; merges; owns anything irreversible | gets automated away |
STOP-1 (plan) → review → IMPL → STOP-2 (proof) → review → HUMAN MERGE
Gates are cheap, early human course-corrections — the protocol automates transport between them, never the judgment at them. A green test run proves determinism, not correctness: GREEN ≠ correctness. STOP-2 must show the actual artifact — the diff content, the rendered output, the live HTTP response — never an agent's summary of it.
Each exists because its absence caused a real incident.
The hardest file in a bridge is AGENT.md §1 — the invariants no task may violate, each checkable against a diff. From the worked example (a fictional billing SaaS) that ships in the repo:
- 1.1 Never double-charge. Every charge path is idempotent end-to-end;
a diff touching rating without an idempotency/property test is
incomplete by definition.
- 1.2 The usage ledger is append-only. Corrections are compensating
entries; alterations must remain detectable.
- 1.3 Fail-closed on charging, fail-open on display.
- 1.5 Billing math lives in one module. Duplicated money math is a §1
violation even when the numbers are right today.
Every template in the repo ships with a filled *.example.md like this — read the example, write your own, delete the example.
Verify before you assert. Status claims (“done”, “deployed”, “collision”) require live evidence — a git log, a real build exit, a live HTTP status. Recalled memory is point-in-time: if it names a file or flag, re-verify against live code before relying on it.
Secrets not quoted. Names and prose are fine; values never — in any role, any artifact, any log.
Deterministic first. No model call where code suffices: deploy verification, PR pre-flight, build orchestration are algorithms, not conversations.
Extracted from practice: this protocol shipped a commercial telco-security product, live at a mobile operator six months after development started — one person running the specialist half through agent fleets, alongside a classic team. Every hard rule comes from a real incident; the incident write-ups are the series.