Governance is a metabolism, not a manifest.a deliberate stress test of agent governance: what failed the measurement, the self-hosted reviewer that survived it, and the dated audit of my own last claim.

Every gate you add is a claim. Almost none of them are measured.

A governance artifact is a claim: this rule changes what the agents do. The field is good at making the claim and nearly silent on testing it, which leaves every enterprise program assembling gates on faith. So I used my own fleet as the testbed and put one question to every artifact it carries: would anyone notice if this stopped working? The first three answers set the tone, and the direction of the whole experiment: a generated schema that had sat four months stale with zero consumers; a style rule that lived a month as prose and was violated the whole time; a folder of ten architecture invariants, every one of them words that no machine had ever read.

The uncomfortable name for that class is theater, and the reason it accumulates everywhere is structural: adding a gate feels like governance, while measuring one feels like overhead. The inversion I committed to is the experiment this note reports: every governance artifact in the fleet either carries a measurement or carries an expiry date, and the results get published, deletions included, so another program can adopt the survivors without paying for the failures. Under that pressure, governance stops being a manifest of good intentions and starts behaving like a metabolism: things are born, they are measured, and most of them die. Most of mine died. One organ earned its life.

What the fleet deleted, and the number behind each deletion.

The advisory layer, about 1,908 lines. The first candidate class was advisory: end-of-session reminders, drift audits, warnings printed into the agent's context in the hope of shaping behaviour. It is the cheapest governance to ship and the most popular, which is exactly why it deserved the first controlled test. The deletion was decided by that test, not by taste. Four variants of the same task: no rule, the rule as prose in the agent's context file, the rule as a loadable skill, the rule as a hard hook that blocks the action. The prose variant produced the same outcome as no rule at all; it saved some exploration tokens, because it was information, but it changed no behaviour; the failing test in the workspace did the actual enforcing. A survey of nine mature agent frameworks I ran alongside converged on the same design sentence: do not measure rule-following, remove the ability to violate the rule. So the advisory layer went, roughly 1,908 lines and two test suites in one pass, and the one gate that physically blocks stayed. The detail I keep retelling: that surviving gate blocked an edit by the very agent performing the deletion, the same day. If the deletion had been wrong, the block rate on the surviving gate would have told us; it is the metric the deletion left behind.

The template synchronizer. The fleet's repositories were once kept aligned by an automated template-sync pipeline, the kind of machinery every platform team eventually builds. It was retired by an architecture decision, governance flows by reference to one canonical copy, never by pushing vendored copies downstream, but the honest postmortem material is what happened after: the retired workflow was never deleted, and its zombie ran the fleet's CI red seventeen consecutive weekly runs across six weeks before anyone removed the corpse. Seventeen red runs that nobody treated as signal is the purest measurement of theater I own: an alarm that fires weekly and changes nothing is not an alarm, it is set dressing. The wrong-removal detector here is the conformance check that now runs against the canonical copy; if reference-based governance drifted, that check, which does turn PRs red and does get fixed, would catch it.

The seventy-two-hour hook. One hook was born to heal skill drift at session start, promoted to fleet-canonical status two days later, and deprecated the same day as its promotion, because a parallel mechanism running at the host level had landed the same week and covered the job with none of the per-session cost. The lifecycle looks absurd written down, born, promoted, buried inside seventy-two hours, and it is the healthiest story in this section: the fleet paid three days for a redundant organ instead of maintaining it forever out of sunk cost. Version-skew checks are the detector that would have exposed a wrong removal; they stayed green.

One organ earned its life. Here is what earning looks like.

The strongest positive exhibit in the fleet is the code-review organ: a daemon on my own hardware that reviews every pull request through multiple model lenses and posts findings into the normal review surface. It exists because rented review capacity kept evaporating, one vendor reviewer moved to usage pricing, one was sunset outright, one's free tier stopped finding anything, and it has survived every measurement this stress test can throw at it, because it is the most-measured thing the fleet owns. Its yield ledger, counted from the review record: 2,993 review threads produced, 924 of them with findings acted on, six documented catches serious enough that shipping without them would have hurt. Its honesty ledger is part of the exhibit: the daemon once sat silently dead for thirty hours before anyone noticed, and the outage went into the record next to the catches, because an organ that only reports its wins is halfway back to theater.

The same measurement discipline caught the organ's most interesting failure: the learning loop downstream of review was quietly laundering findings that reviewers had already dismissed back into standing guidance, its own rejects recycled as rules. The catch came from cross-checking proposals against a ledger of dismissals, 252 rows of them, and the laundering path was closed. And the freshest number in the record is the most sobering: across 1,404 review objects, the rate of rounds that emit findings has stayed flat over 181 consecutive review rounds. Review is catching problems at a constant rate, which means review alone is not teaching the fleet to stop making them. That is the previous note's actuation lesson surfacing in a different organ: finding problems is a producer; only a closed loop changes behaviour.

The survivor and the three deletions point at the same law, and the next section writes it down: earn a measured place, or expire. The daemon's own anatomy, the lenses, the ledgers, the scheduling, deserves a note of its own. Here it stands as proof that the selection rule keeps things, not only kills them.

Bind to an enforcer, or expire.

The response to the corpses was not better discipline; discipline is what had failed. It was a rule change with a mechanism. Every architecture invariant in the fleet now carries two machine-read fields: the specific enforcer that guards it, a named check that already turns pull requests red, generic catch-alls rejected, and a teeth proof, a test that plants a violation and asserts that exact enforcer rejects it. An invariant that cannot name both goes onto an allowlist with two properties that make it debt instead of decoration: every entry has an expiry date, and the list's size cap only ever shrinks. Today the registry stands at seven invariants bound, four on the expiring list.

Two refinements keep the rule from becoming its own theater. The proof must exercise the exact enforcer it names, so a test that resolves but tests something else, a false green, turns CI red; that check caught real mismatches. And the rule binds itself: the invariant that says invariants must be bound is enforced by the same gate and carries its own planted-violation proof, so its rot would be as loud as anything it guards. One proposal was rejected on the way, and the rejection is the lesson: a fault-injection simulator to test enforcer liveness, voted down as the disease in miniature, a new unmeasured organ built to watch the others. Liveness is proven by a proof that runs on every CI pass, not by new machinery.

Four weeks ago I published a claim. The ledger since: ratified.

The previous note ended on a sentence I knew would age: the improvement loop that mines my corrections into fleet policy closes without me, and had run without me since. A claim like that decays silently unless someone re-reads the ledger on a date and says so in public. Read on 20 August, four scheduled cycles after publication, here is the ledger.

The run chain ratifies. Every row since publication was written without a human action in it. One cycle reported a quiet week, zero signal with zero pipeline errors, and could be believed, for exactly the reason the last note gave: outages no longer impersonate silence. The proof arrived one cycle later, when the fleet's model gateway went unreachable at run time and the loop, instead of shrugging out a fake quiet week, marked its own run unhealthy and said why. That row is the repair from the last note doing its job in production, unprompted, which is the only kind of ratification worth printing. The runs after it came back healthy, and the runner has since begun updating itself to the latest machinery before each cycle, recording the version hop in its own row.

And twice qualified. Both mechanisms found, one while writing.

Two parts of the claim did not hold, and both failures have names.

The adjudication lane stalled. The last note reported escalations reaching a panel of models and being adjudicated the same day. That happened exactly once, in the cycle I published. Since then the mining half has kept escalating, nine candidate questions now sit queued, and not one of them has ever reached the panel, so the behaviour file still sits at the version the note shipped with. The mechanism is almost comically mundane: the runner files escalations as tracker issues, and the credential it runs under stopped being allowed to create them; every attempt returns a permission error. The ledger lane kept working, so the queue is visible; the doorbell to the panel is what broke. The loop did not stop learning silently, which was the old failure class. It stopped actuating loudly, in a queue anyone can read, which is the new, better, still-unacceptable one.

The newest cycle wrote nothing at all. Found while writing this section: the most recent scheduled cycle has no ledger row of any kind, three days after its slot. Every failure mode the loop has met so far still wrote a row, even the gateway outage wrote a row, so a missing row means the run never fired: the strongest suspect is that the runner's new self-update, the youngest organ in this whole story, broke the scheduled start. The watcher that catches a green-but-blind run asserts on the run's artifacts; nothing yet owns the run that never happens. That is a dead-man contract, it was filed against the fleet's operations backlog in the same hour as this paragraph, and it hands the metabolism its next lesson: the newest organ is always the least watched, and your public claims age at exactly the speed of your least-watched organ. This is what stress-testing governance in the open costs, and what it buys: the failure surfaced in days, with a mechanism and a fix on file, instead of surfacing in a quarter with neither.

Regulators are about to ask the question this note keeps asking.

The distinction this stress test keeps enforcing, oversight that demonstrably fires versus oversight that exists, is no longer a private engineering taste. The EU AI Act's human-oversight article requires measures that are effective, not merely present, and its obligations are phasing in through 2026 and 2027; the frontier labs' own published safety work has converged on the same instinct, evaluations and containment measures that are tested against attempts to defeat them rather than asserted. The cheap, portable version of that discipline is exactly the teeth proof from section iii: for every oversight control you claim, keep a test that plants a violation and shows the control catching it. A gate you cannot prove has ever fired is not oversight; it is the compliance version of the seventeen red runs nobody read.

What transfers, and what this cannot claim.

Established by this stress test. Three governance deletions with the measurement behind each and a named wrong-removal detector for each. A selection rule that turns toothless rules into expiring debt, catches false-green proofs, and binds itself. One surviving organ with a real yield ledger, 924 acted-on threads of 2,993, and a real outage ledger. And a dated public audit of the previous note's claim: the unattended run chain ratified by four more cycles including one self-reported outage, and two qualifications with mechanisms named, a stalled adjudication lane behind a broken permission, and one wholly silent cycle caught during the writing of this note and filed the same hour.

Not established, and this note does not claim it. No claim that the metabolism improves fleet output; the selection rule governs governance, and its own efficacy measurement is the flat-curve question above. One fleet, one operator, and a ledger that can only see the deletions its records kept. The magnitudes are corpus-specific; the selection rule is the transferable part.