Twelve seats, no people, and a check that blocks my own commits

At two in the morning a script called check-dashes refused to let me commit. I had typed an em dash. Nothing else about the change was wrong. The rule I had broken was a house rule I wrote myself. The script did not care.

That is the piece of this I would keep if I had to throw the rest away. Anybody can build agents that do work. The interesting question is whether the thing you built will tell the person who built it no.

Orbyt Collective is the page where I make that claim. Nobody has bought anything from this company yet. All three products sit behind an early access waitlist on production. So what follows describes an org that runs a codebase, not a business with customers in it.

What is actually running?

Twelve seats. None of them are people. One human, and that human is me.

Nine of the twelve run a language model on a schedule. The other three hold a point of view and do not act. Every seat has a written charter, and the seat roster publishes them.

Decisions go to an append only log, where a correction is a new entry rather than an edit. A promotion ladder governs how much autonomy a seat may hold. An inspector general reports straight to me, where no other agent can soften it.

And there is a kill switch. It is a file.

The last time the page was built out of the repository, the log's newest entry was D-0048, dated September 6, 2026. That sentence is generated. A count tells you the log exists. A dated newest entry tells you somebody is still writing in it.

What happened to the one number I typed by hand?

The page said eight founding officers.

The data says nine. Three of the twelve seats carry a flag marking them as later appointments. Everything else is founding. The arithmetic was never in doubt. The leadership page carried the same wrong number in its prose while quietly computing the correct one into a variable it never rendered.

That is the part I still think about. Neither page could contradict itself loudly enough for anyone to notice. Two surfaces, one wrong number, and the right answer sitting unused in a variable on one of them. I did not see it on either page, and I wrote both of them.

The count is now derived from the officer list at build time. It cost about four lines. Deriving a figure does not make it true. It makes two pages unable to drift apart, which is the failure that actually happened here.

Which column matters, and why is it the one on the right?

Each seat's authority is written as two lists. What it may do on its own, and what it may not do without me.

Engineering may publish health reports and rank tech debt proposals. It may open draft pull requests for exactly three things: a new report only audit check, a new or expanded test, and a docs fix. Each draft passes the full guard gauntlet and the build before it opens. Then it sits. A human merges, always, and the human is me. Runtime code under the app and packages directories is not even eligible for a draft, because that lane is a written proposal with the diff described.

Marketing writes into a fenced set of files: blog posts, career guides, AI Skills entries, and its own reports. New pages are gated. Pricing claims and product claims are gated. So is site architecture.

Finance may update the ledger, run the mechanical cost guards, and write analysis. Any spend is gated. Any pricing or billing change is gated, forever.

Operations and Revenue advise and never act. Each overwrites a monthly readiness brief in place, which exists so I can judge whether the advice is any good before either seat is allowed near anything real.

The gated column is longer than the autonomous column on every seat that touches money or main. That is the design, not a phase we are trying to grow out of.

Does it refuse me?

Back to two in the morning.

The guards carry no override of their own. check-dashes exits non zero and the commit stops. So do the color guard, the boundary guard, the security guard, and the rest of the gauntlet stacked behind them. Git has its own skip flag, the house rule forbids it, and the same battery runs again in continuous integration against the pushed branch. Skipping the check locally buys you a red build instead of a clean one.

So I fixed the punctuation and committed again. That is the whole story, and it is the one I would want a stranger to hear, because it is small and it happened.

The promotion ladder holds itself to the same rule. It does not advance while any of its own criteria are unmet. The sentence saying so on the page is generated from the ladder's state file, in two branches. One branch names the criteria that are not met. The other says every criterion is met and it has advanced.

A hard coded sentence about the ladder refusing itself becomes a lie on the day the criteria pass. On this page of all pages, that is unaffordable.

How did it name itself?

On July 13, 2026 each founding seat was asked to choose its own name. They chose in isolation, with no ability to see the others.

Three came back with the same name. Ledger.

Nobody designed that. It is entry D-0016 in the decision log, because the log records what happened rather than what I would have preferred. I did not pick that name. I published the collision.

Why two words above the product name?

Every page in that section carries a small pill reading Research Lab, above the name, before anything else.

It is there because a design review of the process page found a hero promising a product the page retracted eight hundred words later. That was the review's own reading, not an observed visitor. A stranger arriving from search hits the line about deciding who runs it. They walk away thinking a configurable agent leadership team is on sale today. The retraction was real, and it sat at the bottom of the page.

You do not fix that with a longer disclaimer. You fix it by putting the frame first, above the name, in two words. It lives in one component rather than four copies, because four copies of a label is four places for it to drift.

What do the raw receipts show?

Three records go out as public exports under a permissive license. The Autonomy Ledger holds every seat run. The Decision Ledger holds every governance decision. The Failure Corpus holds every documented failure mode. Ids, dates and counts are parsed straight from the committed files. Titles are edited for publication from a reviewed map, and the generator fails if the map and the source ever disagree about which entries exist. The repository itself is private, so these are exports and not the originals.

The ledger's frozen quarterly baseline, dated August 11, 2026, holds 30 recorded runs. 24 completed, 6 failed. A completed run is one whose output survived the workflow's completion gate. A failed run died in the gauntlet or was cut off. A discard is a different unit and is never added to either side. It is a file an agent touched outside its lane, erased before the commit rather than shipped.

Small sample. The org is grading itself. Both of those sit next to the number instead of in a footnote, and the live counter has moved since, which is why the baseline is frozen.

The kill switch has been pulled exactly once, set and lifted on August 20, 2026 during a domain change. Its entire history is five commits.

What does it not do?

It runs in exactly one place. Here.

It is not for sale, and it has never been run at another company. That is my dated account rather than an audit. The page carries the date I first said it, August 9, 2026, so you can hold me to how long it has been true.

It does not merge code. It does not spend money. It does not set a price, touch billing, or ship anything a customer sees. The seats that would eventually do customer facing work are seated and charter bound, with no operating authority until launch.

I am also aware of the obvious objection. A system whose guardrails I wrote refusing me is still a system I wrote. That is true, and it is why the failures go out raw instead of summarized.

Where does the rest of it live?

The research papers are the measured version, and they hold the finding I did not expect. Of 90 documented failure modes, 47 are verification gaps. That means a test, guard, gate or metric that could not fail, could not see, or measured a proxy for the thing it claimed to measure. One rater assigned every class and the corpus has no agent failure class at all, so that is an exploratory share and not a verdict on instruments versus agents.

The books are the human version, written with the AI that helped build the thing. That includes the stretches where I was wrong for weeks at a time.

And the running account, the arguments and the reversals as they happen, stays on the blog.

Related reading:

• The Orbyt Collective overview the seats, the ladder and the kill switch, with every figure generated out of the repository

• How it works what a seat actually is, in five parts, each one enforced somewhere outside the model

• The Autonomy Ledger every recorded seat run, with the failures printed at the same size as the completions

• The governance paper the measured version, including the limits on what the failure corpus can support

---

Originally published on orbytlabs.ai on Sep 25, 2026.