A real feature's journey — Aura Widget Draft Persistence, requested by a customer and live in production — compressed from twenty minutes to under two. It took two build attempts; the first one didn't pass. That's in here too. Every gate below exists in the product.
In your product · the Aura widget
No form, no ticket taxonomy, no PM triage queue. The request enters the pipeline as the customer's own sentence — and that sentence travels with it all the way to the code.
Agent · Scout, the interviewer
+ filed separately, with consent: Upload spinner never resolves
Scout triages the dimensions that matter for this request, holds its concerns until they're answered, and splits genuinely separate asks into their own requests — with the submitter's say-so, never silently. It also checks every request against your Constitution. Which is where some of them end.
Meanwhile · a different request, same day
Refused at intake — before a vote, before a token, before anyone's time. And the refusal stays on your board where you can audit it: a system that silently over-refuses is as broken as one that ships anything. This is the part that makes the rest of it safe to automate.
Governance · community consensus
Voting is an amplifier, not a gate you're stuck with: brigading defenses and weighted reputation keep it honest, and when the pool is too small for a meaningful vote — or you run founder-only mode — requests route straight to you instead of staging quorum theater.
Human gate · the founder
Risk decides the model lane: routine work rides the workhorse model, high-risk or hotfix work gets the flagship. Right-sized intelligence, chosen by the same triage that will later govern shipping.
When a build does need something first — an account, a key, a service switched on — it says so here and walks you through getting it, then re-checks. You install it; we never hold it. Xynyx stores no keys of yours, ever.
Agent · Forge, in a live checkout of your repo
The agent works in a real clone with real tools — then the pipeline re-runs your project's own checks itself: typecheck, tests, build. The agent's claim of success is never trusted. That failed test? Caught and fixed before the change was ever offered to you — nobody was paged, nothing shipped.
Auditor · Sentry, a rival vendor's model
Attempt 1
Draft written to persistent storage — survives the session and leaks one user's words to the next person on a shared browser.
✗ Rejected. Not merged, not shown to you, sent back to Forge.
▸ Forge revises — session-scoped storage, keyed per organization.
Attempt 2
Implements the brief — the whole brief, nothing beyond it.
Session-scoped storage, org-namespaced keys, no secrets stored.
No unrelated rewrites. No dropped functionality.
Zero violations — letter and spirit — of your operating rules.
Forge is one vendor's model; Sentry is another's — and it is never allowed to write the fix it demands. Four verdicts, every attempt, kept on the receipt, which names the exact model that judged your code. An auditor that never rejects anything is a rubber stamp, so the rejections stay on the record too.
Human gate · the ship decision is yours
You never approve code you can't see running. The preview is a live deployment of the feature; Ship is your signature. Or delegate it: auto-ship low-risk lanes once the receipts have earned it — the gate never moves, you just decide who holds it.