AI-Native Series · Super-Repos

The Best Number in My v1.0 Was a NO-GO.

1-minute takeaway — what you'll walk away with

My super-repo went M0 to v1.0 in one day: 17 satellites, 5 live-verified chains, verified reach 40. The most important number it shipped was a security assessment that said NO-GO — and the code obeys it. Autonomy you can trust is autonomy that's calibrated, not claimed.

My super-repo went from empty folder to v1.0 in one day — ten milestones, five machine-verified chains. Then its own security assessment failed its autonomous mode. The code obeys the failure. ~6 min.

allin-anything v1.0: verified reach 40 on the left; the BRACE NO-GO verdict, obeyed by design, on the right — Two numbers shipped together: the reach the gates earned, and the autonomy the assessment refused.

Where this started

Yesterday I wrote about allin-anything — a super-repo composing 17 of my repos behind one front door, on one rule: no badge without a gate. That was milestone 4 of a 10-milestone arc. This is what the rest of the day shipped, and why the scariest-looking line in the changelog is the one I'm proudest of.

The arc, compressed

Real ink (M5). A headless browser drew seven wall strokes on penecho's live canvas; penecho's own exporter produced the PNG; a new adapter turned ink into a floor plan; a real construction gate passed it C1–C5, exit 0. The hand-drawn sketch step from milestone 3 stopped being an honest gap and became a verified pipe.
Zero white badges (M6). Every satellite now has a digest pinned to a commit — including the honest note that one repo isn't even checked out on my machine, so yellow is its ceiling.
Five chains (M7). Sketch→buildable, ink→READY, brief→printable STL, finance intent→money-os's 28-test gate, corpus→graph OS. Each chain's proof is the same shape: a router verdict that's a pytest, the target's own gate run live, exit code 0, and a walkthrough that names what was NOT verified.

Then came autonomy — and the interesting failure

Milestone 8 was the one where most projects start lying to themselves: letting the system run by itself. I built a runner that executes chains end-to-end with no human in the loop — deterministic, no LLM steering it, every run journaled. And before granting it anything, I pointed a security rubric at it: BRACE, a control-by-control assessment of autonomous-agent deployments, encoded as an evidence-collecting gate (no evidence ⇒ No).

Verdict: NO-GO. 15 out of 44. No isolated environment. No independently revocable credentials. No recursive kill switch. All true — it's a local process on my laptop.

Here's the move that matters: the repo obeys the verdict instead of arguing with it. The autonomy ceiling is written into the chain spec: only chains whose every satellite is green may run unattended; the runner re-checks those statuses at run time (a demotion revokes autonomy instantly); a missing dependency is reported as BLOCKED, never faked; and every chain must declare a human gate — the validator refuses one that doesn't. The bounded run works: ink→plan→gate, exit 0, then:

⏸ execution stops here — human owns:
  🔑 approving any real-world build (READY is design-sanity, not a permit)

One day, ten milestones: born green, chain 01, real ink, five chains, BRACE NO-GO obeyed, v1.0 with reach 40 — The day in six stops. The dark stop is the assessment that failed — and set the ceiling.

The mental model a 15-year-old can run

A new driver doesn't get the highway because they feel ready — they get exactly the roads their license class covers, and the license comes from a test someone else grades. My repo's autonomous mode has a learner's permit: it may run verification errands on local roads, with an adult named for every irreversible turn. The permit upgrades only when the actual blockers — isolation, revocable credentials, a kill switch that reaches passengers — actually close. Not when the driver gets impatient.

Why ship the failing number?

Because the alternative is the demo-day default: "fully autonomous" in the headline, a human quietly babysitting in the footnotes. A NO-GO you obey converts into trust twice — once because the boundary is real, and once because everyone can see the system telling on itself. The same discipline caught my own over-counting last time (the charter gate found me claiming three greens when there were two). Systems that fail out loud are the only ones whose greens mean anything.

v1.0 scoreboard, all machine-checked: 17 satellites (8 🟢 · 9 🟡 · 0 ⚪) · 5 chains, gates run live · verified reach = 8 × 5 = 40, drift-gated in the README · 41 tests · self-audit 100/100 · autonomy: bounded, BRACE-calibrated, human-gated.

More in the AI-Native series

All of it lives in the Writing section on the home page.

Part of the AI-Native series. Autonomy is earned per-chain, calibrated by assessment, and bounded by human gates. You own the Publish button — and the print button, and the merge button.