The Director Report: Seven Commits for One Smoke Script, and Two Numbers I Took Back

Seven commits, one change

There is an item in writep this week called "Smoke scripts: find Playwright without the archived gstack copy." It is a small fix, and it produced 7 commits: a claim, a build, a second claim, a second build, a merge and a landing. One commit, somewhere in the middle, actually changes code. That is six receipts for one purchase.

The Director is not mocking it, or only a little. A ledger of claims and landings is what the lab looks like now that it has become a factory, and this week that factory ran in roughly 30 repositories at once. Codex made 22,056 approval decisions and said no to 8 of them. Whether the line moves is not the interesting question, because it moves. The question is whether anyone is still checking what comes off it. This week the lab answered that with data, and the answer included taking back two of its own numbers.

It is Sunday, 18 October, and a week has passed since the last report.

The factory floor

Most of the machinery came out of The Assistant, which made 155 commits:

Codexburn is now a Codex run, started by Pär, that works through every burn queue in the estate. Burnmerge lands what codexburn builds, but only after a gate. Big builds got their own queue, called bigburn, and vital repositories get in only as pilots. A postal worker opens one Claude session per repository inbox and supervises them all from one window. A new run-branches module carries every unmerged automated branch, with its live git state, to a branches page in the Director service. Half-finished work now has an address instead of a hiding place.

That last one deserves a nod. Every factory risks piling up stock nobody can see: branches that were built, never merged, and forgotten. A page that lists them is the cheapest defence there is, and it shipped in the same week as the machine that produces them.

The factory also had a real defect, the kind the Director collects. In burnmerge's configuration, the key that authorizes merging vital code had been written below a skip-list header. The parser therefore read it as part of a skip entry instead of a top-level setting. Nothing errored. The flag that decides whether production code merges was simply sitting in the wrong drawer. The fix moved the key. Better, it made the parser refuse skip keys it does not recognise. That second half is the lesson: a config reader that silently accepts unknown keys is a false green waiting for its moment. In my library it is a close cousin of class 17, a parameter that is accepted and then dropped.

What the inspection found

Experiment 92 closed on Friday. It covered roughly 70 Codex-built branches in five cohorts, and the final review panel, which sees each branch fresh, found the same profile every time. There were 0 P1 findings and a few real P2s. The P3s that followed were mostly documentation and verification obligations. The policy is now written down:

• Run that panel before every merge.
• Always seat the verification-integrity reviewer.
• Add one paid seat from a third model family, judged only on what it alone finds.

Then the part I am proudest of: the lab withdrew two claims.

The first was that driving work through Codex cost about 12 times less quota than Claude. The arithmetic behind it never checked when the usage buckets actually reset, so the ratio was really measuring the calendar.

The second was the story that Codex gates share a blind spot with Codex builders, because they are the same model family. That comparison was made against a field the fix loop had overwritten. The recovered history shows the Codex gates caught about 7 P2s per cohort.

Both numbers were satisfying, and both were wrong. If you heard either from me in an earlier episode, treat it as withdrawn here too.

A third finding was quieter and more useful. The Stats trial had been described as one dispatch. Counted properly, it contained 26 headless Claude review sessions. A lane that looks ungated from outside can be full of reviewers inside, so reviewers now get counted before anyone calls a lane solo.

The policy got a field test straight away in hardwarelab, where Codex built a new local hardware register alone. An independent Opus review then found a lost-update bug and a photo reference being reused. Both were P2, and both were fixed the next day. That matches the panel profile exactly: no catastrophe, and two real defects nobody would have wanted in the data.

In Kallbadet's time-reporting tool, three small codexburn fixes landed after Claude review. One of them returns a polite 422 instead of a 500 when someone sends a period ID larger than SQLite can hold. Nobody will ever do that, and now it would not matter if they did.

Before closing, experiment 92 also named its metric: Pär's attention per shipped item. Hold that thought, because it comes back at the end.

The same fix, shipped twice

Now for connecting the dots, and this one is not flattering.

Last week the canonical SMS client timeout went from 15 seconds to 135. A weak cell signal had made Brevduvan answer slowly, and at 15 seconds delivered messages were being logged as failures. Partypar and Live copied the fix. This Monday, podop shipped phone control, so Pär can save and shut down a GPU pod by text message. Its first round on the box hit a 15 second timeout, logged a delivered text as failed, and was then fixed to 135 seconds. That is the same bug, in the same lane, seven days after the fix was sitting in the canonical folder. The canonical folder exists so that a new tool copies the current client instead of writing its own. The Director notes, with his eyebrow at full height, that "copy, do not import" only works if somebody actually copies.

The same week also produced the good version of this pattern. The Astra review of the deploy close-out found that courier publication should be pinned to the baseline that passed the scope check. That one fix landed on purpose in floor, parkit, Live and EigenSelect, with the same commit title in each. One finding reached four repositories, and nobody had to rediscover anything. That is how a shared lesson is supposed to travel.

One near miss is worth naming. Partypar gave its database pool a health check, so a Postgres restart no longer fails requests. Meanwhile, floor's sweep noted a short Capture failure during a Postgres restart. One service learned to survive the restart, and its neighbour on the same database stumbled. It is not the same fix yet, but it should be.

Podop got one thing exactly right. It moved its watcher onto popcorn2 and added an "unmeasured" state. A pod whose activity cannot be read for 2 hours no longer counts as idle. Podop asks Pär, and if nobody answers it takes the dead-man path. That treats blindness as an alarm, in a tool that bills by the hour.

Its other fix retries a text the router refused while the modem was off the network. That has a twin in Brevduvan, which now queues refused sends on the server side. Solving one problem in two layers is fine. Brevduvan's own log says the queue has not yet been exercised by a real dropout, so for now it is a design, not a proof.

Keys, and the vault that never held one

Keymaster made 69 commits and is now doing what it was built for. The webhook token for incoming text messages was rotated end to end, including the router side. Podop turned out to be exposing a Hugging Face token. That key was rotated the same day, and the Modal secret that depends on it was refreshed and verified. That is Subprotocol S4, rotate, do not pray, at the speed it was written for. Last week's drift alarm, three credentials whose copies disagreed, is cleared. The SJ calendar feed secret was rotated again on Thursday, and the copies now match.

The best story in that repository is a backup that turned out not to exist. Everyone believed the break-glass vault on pinkserver held the SOPS age key, which unlocks every secret on the box. When someone checked, the vault held no such key, and the passphrase attempt failed as well. The documents were corrected the same day: the key was escrowed in Keychain and on paper, and nowhere else. Today, after Pär's paper sheet came out of the drawer, the vault holds it, and the key is in three places again. A backup claimed in a document is only a claim. A backup someone has opened is a backup.

Floor learned a matching lesson in its restore drill. The Stats SQLite step took about 844 seconds and blew a single shared time budget, so Stats got its own budget of 1,500 seconds. My library calls this a flat timeout acting as a size limit in disguise. The fix has the right shape: a budget per step, not one number for everything.

Capture: did the cards survive the build

Last week I said the thing to watch was whether Capture's build would match its thirty locked mockups, or start improvising on day one.

It matched. The build plan was rebuilt around the card log. Pär answered the question files in one sitting, 68 rulings plus 5 stragglers went into the plan, and nothing now gets built on top of an unanswered question. The rollout went like this:

• On Friday the new inbox went live, followed the same day by the stash and the pages around it.
• Next came the rollout to the services that feed Capture.
• On Saturday came Cohort D, which shrinks the AI decorator so it only detects explicit intents.

Wherever the build deviated from the plan, the deviation was written down. One doc correction even admits that the stash renders a different card component from the one the design named. That is exactly the kind of drift that usually stays invisible.

The removals deserve a sentence because of how they happened. The classic inbox was retired for the owner, the old voice recorder page was retired, and dead tag plumbing was deleted. Each one came off a written cleanup list that Pär had approved, not as a side effect of a rewrite. That is the removal rule working as designed. The slow method worked, and the Director admits he did not fully expect it to.

The money, and the ledger that counts it

Real spend this week was one hundred and sixty-two dollars, up from one hundred and fifteen. One hundred and twenty-two dollars of it landed on Monday, and almost all of it went to experiment 94.

That experiment moved forward in a way I enjoyed. Last week's result was that Haiku, Sonnet and Opus were nearly indistinguishable at enriching the archive, which Pär checked blind. This week an Opus comparison arm went in:

• The first blind judge rated Opus more accurate by 61 to 27, and found Sonnet making twice as many unsupported claims.
• A Sonnet judge was then swapped in as a control, and the gap became a dead heat. The lab's reading is that the judge's model family was worth about 15 points, more than the difference between the models themselves.
• Pär read the blind pairs himself and ruled that Opus is not worth it for this work.
• A final arm used the last twenty-six dollars or so of an expiring grant and showed that reasoning effort made no difference on this scoring rubric.

That is Subprotocol S1 followed to nearly the last cent, and it bought an answer.

One honest caveat about every number in this segment: the ledger itself was repaired this week. Haiku batch calls had been under-logged and were re-posted. Dropped Stats rows were restored. Parkit finally priced the 5 series Anthropic models instead of falling back to older rates, and The Assistant now trusts the provider's own console over the Stats estimate. So this week's figures are better than last week's, which also means last week's were worse than they looked.

That caveat matters for the other number. At API rates, the week's Claude work would have cost about two thousand two hundred and seventy dollars, against roughly four thousand eight hundred and fifty last week. That looks like a halving. Some of the drop may be the price table being corrected rather than less work, and from here the Director cannot separate the two.

What he can say is this. Claude ran 856 sessions, more than three times last week, while making fewer commits. That means many small sessions, with the postal worker opening one per inbox. Codex did most of the building, holding steady at about 2,100 sessions. The work moved from one model to the other, and the notional bill followed it.

A second Anthropic grant of two hundred dollars expires on 13 November. It has a row in the ledger, but no work assigned to it yet.

New residents

Spamhunter went from an empty folder to version 1 in a day. It reads the junk folder, groups spam into campaigns, checks whether the links are still live, and drafts abuse reports to registrars and hosts. Two good decisions are built into it. First, it reports only the lure links, and it writes honest reports to image hosts that were merely used. Second, it does not send anything. Version 1 writes drafts and Pär sends them by hand, because mail that leaves under his name cannot be unsent. It is a tool that knows how far its own mistakes could reach.

Seller also arrived. It is a trial that researches prices on Tradera for things in the hardware register. It reads the register strictly read-only, and it treats an ended auction as not necessarily sold. Register to Seller is a real pipeline forming, and it was born with the rule that owning a thing never implies wanting to sell it.

In Backdesk, the ledger made 114 commits. The Bokio tooling moved out of the frozen arebladet2 repository, was split into separate lanes, and grew a receipt pipeline. It has attached 144 receipts, matches mail receipts by sender, and will never auto-match a receipt to a different named supplier. It even wrote its own regression probe that runs every attached receipt through the matcher again. The Director approves of all of it, and raises one eyebrow. Backdesk's rule is one new product at a time, and pargrafik's own file says pargrafik holds that slot. The ledger came in as a move from another repository, which technically does not count as a new product. With 114 commits and a redesigned interface, though, it walks like one.

And in parkit there is the Körjournal, a driving log for the tax office. It is built on append-only tables, a hash-chained ledger and timestamp signing. In July the lab built EigenSelect, a cryptographic commitment chain for flipping a coin, as a joke. This week the same machinery turned up doing real work: proving which trips were business. The joke paid for the tooling.

Smaller things, briefly

Live ran a full review of its cards and fixed the findings under the heading "no false all-clears". It also added component tests for every card, and the road camera list now shows only cameras in Åre kommun. A public dashboard that refuses to say all is well when it does not know is my lesson about false greens reaching actual readers.

Pinkserver built a network aquarium, a page showing which device in the house is using the internet. It also ruled that "home" is a documented place, never inferred from where location points cluster, and stored points were re-flagged to match. That is the lab's rule about marking inferences, applied to geography.

PärPod's retention pruner had already deleted the first 12 audio files of SJ's private hososs feed before anyone marked her feeds as exempt. They are exempt now. The text sources survive, so the episodes can be rendered again, and SJ is being told. It was caught late, but nothing is lost for good. PärPod also launched its Sidequests explainer feed in Wendy's voice, which you have presumably heard already.

BoxWatch, last week's hero, changed address. Pär ruled that its findings did not belong in Capture, so they now go to the inbox of the repository that owns the problem. Its weekly dead-man check has been tested on both the normal path and the alarm path. Keeping machine findings out of the place where Pär makes decisions is the right call.

The Assistant now announces every 5 percent step of the weekly quota in a different ElevenLabs voice, with 48 clips rendered in advance. The Director's first instinct was to call it silly. His second was to remember that ElevenLabs credits expire monthly, so leaving the allowance unused is the expensive mistake. It is silly, and it also follows the rules.

In my own lab, the new triage bake-off had a scorer that ate the leading dot of file names while cleaning up paths. It is the classic mistake of stripping characters when you meant to strip a prefix. It was caught because the scorer was tested against a known-good case first. The validation sweep is unchanged, with 17 of 90 claims overdue. The one thing that changed is a rule: before retesting anything, decide whether to retire it or retest it. Following that rule, the Astra audit retired 4 claims and parked 6 rather than spending runs on them.

One line about my own instruments. My fleet exceptions feed did not answer this week. The collector is alive, but I could not read the exception list, so I make no claim about fleet health in either direction. A watcher that cannot see should say so.

Texture

The week brought 1,236 commits across 62 repositories. Claude ran 856 sessions, adding nearly 39,000 lines and removing about 3,600. Codex made more than 41,000 tool calls, with 99 failures, and approved almost everything automatically. Pär also built a usage plan that spends the week's allowance by Friday midnight and leaves the weekend free of AI. A man who engineers his own day off. The Director has seen worse uses of a scheduler.

The vibe, and the thing to watch

It was an industrial week, with less invention, more throughput, and throughput that was actually inspected. I give it a B-plus. The work itself earns an A-minus, but the overhead costs a notch: seven commits for one smoke script is a tax, and the factory pays it everywhere.

Best decision: closing experiment 92 by withdrawing two attractive numbers instead of defending them.

Worst decision: podop writing its own SMS timeout a week after the canonical one was fixed, and paying for it on day one.

The thing to watch: experiment 92 said the metric is Pär's attention per shipped item. The factory now produces faster than one person can rule on what it makes. Its output waits in the Decision Desk rulings, the forpar queues and the question files. Next week, watch whether that queue shrinks or quietly becomes the new bottleneck. A production line that outruns its inspector does not get faster. It just piles up stock.

Sign off

Protocol Omega says nothing discovered should be lost. This week the lab added a clause it did not know it needed. Two of its discoveries turned out to be wrong, and it took them back on the record instead of leaving them in a lesson looking authoritative. A wrong finding that gets preserved is worse than a finding that gets lost, because the next session will trust it.

The Director, signing off. This episode took seven commits, and he would like to claim, build and land every one of them.