Three verifiers, one release

Day one of this release ended with eight filed defects and one slice implemented. Day two ended with all five slices verified and merged, and the interesting part is everything the verification chair did in between: three different models from three different vendors held it, and each handover taught us something the pattern-level discourse about agent loops has no vocabulary for.

The roster turns over

grok-4.6 verified the first slice properly: failed the first candidate on a real defect, a SQLite fixture whose git-materialised file mode broke the journal’s 0600 requirement, prescribed the fix in its fail receipt, and passed the repair. Fail with reasons, repair, pass, all readable in the receipt chain. It was also costing about forty US dollars a day, so the chair went to claude-opus-5 on subscription billing, through the engine’s native CLI closure.

Standing Opus up was its own field report. The engine pins the exact CLI binary by digest; the pinned version had been auto-cleaned from disk by the installer, the current version’s init handshake had grown three new fields and one new capability that the closed-surface validation correctly refused, and the binary turned out to be dynamically linked where its predecessor was static, so the sandbox lacked an ELF interpreter until the loader and five libraries were pinned as runtime files. Three stacked failures, every one of them the attestation system refusing drift it could not vouch for, every one fixed in config or a compiled constant. Opus then verified the second slice cleanly in forty-seven minutes.

Diagnosing a model at the TCP layer

The third slice was the largest in the release, and Opus’s verification of it failed four consecutive times with opaque transport errors. The diagnosis ended at the socket: an established TLS connection to the provider, a 2.6MB request sent, and zero bytes returned, no stream frames, no keepalives, frozen counters across every sample window. Not slow thinking. A hung request.

The pattern had a clock on it. The successful verification ran in the Australian afternoon, which is the American night. The hung ones ran in the Australian morning, which is the American evening peak. Same model, same driver, same sandbox, different hour. Every published comparison of models scores capability and price; none of them has a time axis. A delivery loop that runs overnight in Australia collides with US peak exactly when its operator is asleep, and the only reason we can state that as a finding rather than a feeling is that the run journal and the socket both kept receipts.

qwen3.8-max took the chair, verified the third slice within the hour, and ran the fourth slice’s entire cycle before we had finished discussing the third. The chair is now decided by evidence per slice, which is what a capability-based roster was always supposed to mean, and the roster now knows something it did not know yesterday: availability is a property with a schedule.

The lint that failed its own inspection

The final slice adds a deterministic scope lint at plan recording, because four earlier contracts in this project had under-derived their scope and each one cost a plan revision. Its captain escalated the design with a finding worth framing: the scope lint’s own scope was under-derived, by the lint’s own rule. The seam where the lint must run lives in two packages the contract had not included, and the captain quoted the slice’s acceptance criteria back at it to prove the gap. The fifth scope under-derivation of the release was caught on the slice that exists to end the class, by the review stage that exists to catch it.

The tax that was never owed

The expensive discovery of the whole release hid in its churn ledger. A contract fix moves the branch head, the plan record binds the head exactly, so each fix forced a re-record, and on every previous re-record we deleted the track ref that holds the slices’ receipts, out of caution inherited from an earlier incident. Deleting it voided every passed verdict and forced full re-runs.

On the sixth revision we kept the ref. The fresh run adopted all four passed slices intact and re-ran only the one slice whose contract had changed. Most of the re-run tax of the previous two days had been self-inflicted. The receipts tolerated ancestry all along; only our recipe demanded exactness. That correction is now recorded on the churn issue, and it converts future contract fixes from losing a day to losing one slice’s redesign.

What merged

All five slices, verified by three vendors’ models, implemented end to end by one: gemini-3.7-flash built every candidate in the release, through the native driver whose quota pacing was itself day one’s emergency fix. The merged code carries the release’s own medicine: refusals that name their paths, continuation exits that name their mechanism, repair context that survives, batched tool calls, and the scope lint, freshly cured of its own disease. The full test suite passes at the merged head with zero failures.

The loop spent two days generating the exact evidence its slices were specified to make legible. We were the last operators to diagnose these failures the hard way, which is the most a delivery tool can promise anyone.