Institutional engineering: sources, what the fleet runs, and questions worth working on

§1What the fleet runs today

Each row is a mechanism in production across the hosaka repositories, with the essay that describes it. The essays are written from the running code; the fleet is one operator and a few dozen repositories, so this is production evidence from an N of one, not a controlled comparison.

§2Sources, by section of the piece

§1 The stack moved up a floor

The piece’s three layers are our ladder minus one rung. The governance engineering ladder is a sourced comparison of four public agent fleets, dimension by dimension, showing the same two cells empty everywhere: contracts between repositories, and rules that hold without a human. Governance Engineering is the definition the piece’s §9 test restates: making a rule hold without a human present to hold it.

§2 A rule without an enforcer is a costume

That is the title of our essay of 14 July, which also gives the enforcement test: an enforced rule names its enforcer, and CI verifies the enforcer is wired in, not merely present. Binding vs orientation gives the rulebook a force axis, MUST against SHOULD, with RFC 2119 and Open Policy Agent as lineage. Rules the agent cannot talk itself out of shows constraint tables rendered from one structured file and wrapped in hashed markers an agent may not edit. Why our CI can reject an essay is the publish-path gate the piece sketches, running: five blocking checks over every post, including “no uncited quantity”.

§3 Detection is not enforcement

One refinement from practice: detection has a legitimate place when it is declared non-blocking and routed to something obligated to act. Tier 2: the check that is allowed to notice but not to block and Two checks that block, one that advises draw the contract difference: a blocking check makes a promise downstream, an advisory one annotates. Review without a gate is the design principle the piece reaches for under “failure handling”: severity selects a consumer, not a ceremony, and a critical finding becomes a queued work item whether or not anyone remembers it. The swarm result the piece builds on is the DeepMind multi-agent preprint (arXiv 2609.04170); our reading of it is Whistleblowers without enforcement.

§4 Six things permissions can’t express

• Standing. Who runs apply reads a first-hand Terraform post-mortem (how I dropped our production database) as the question of where the last safety layer sits when one agent holds both plan and apply. Permission by path: the three-zone model opens with the standing argument in one sentence: an agent that can edit its own rules does not have rules, it has preferences.
• Information topology. How repos talk without meetings: a mailbox between sovereigns where messages are letters about work, never instructions to obey. What happens when one agent trusts another reads three lab studies, A-Trust at ACL 2026 among them, including the peer-reviewed finding that agents treat all incoming messages equally, so the design question becomes what the system does with a message regardless of sender.
• Escalation economics. The one door: zero doors against twenty doors, and why one binary act held narrow is the design. Oversight is work, not a setting reads the FAccT 2026 interview study by Dhanorkar, Passi and Vorvoreanu (arXiv 2606.05391), which treats oversight as labour with costs and failure points.
• Failure handling. Review without a gate again, and The archive keeps its dead ends on what rejected and superseded work leaves behind.
• Memory and precedent. The ledger remembers so the agents don’t have to; One fact, one owner; Reading the governed shared memory preprints as a fleet, which reads Governed Shared Memory for Multi-Agent LLM Systems and two companion preprints.
• Incentives. Metrics that refuse to be gamed: no single signal is trusted, ever.

§5 Where the rules come from

The piece’s “what doesn’t compile” list has an essay-length counterpart. The section we leave empty and The empty section is the artifact argue that the written-down list of what is still a human call is the more valuable document, and show what goes wrong when a system treats an empty section as one state. Three lines of law is the load limit on compiled rules: a three-line law gets quoted verbatim, a thirty-item rulebook gets paraphrased. What we compile is a repository’s law from a structured constraints file; the piece’s source, a delegation-of-authority matrix or a licence condition, is a scale we have not compiled from.

§6 Autonomy is granted in bands

We do not run a five-band scheme. Our shape is an entrance exam before any trust, binding against orientation rules, Tier-2 advisory checks, and one approve-or-kill door. The entrance exam for robots is the exam, where every trap is a real incident. Two essays bear on the piece’s calibration warning: A time horizon is not a leash length reads METR’s time-horizon paper (arXiv 2503.14499) against METR’s own limitations note; Four benchmarks on agent code review reads four 2026 studies of agent review and LLM judges (2603.23448, 2604.19049, 2606.29920, 2608.18167) on how noisy judges are and what that does to a sampling band.

§7 Someone’s name is on it

Who answers for the commit reads eight works on AI authorship and accountability. The sentence we follow is from Baciu, Mohan and Wilson in Frontiers in Artificial Intelligence, July 2026, peer-reviewed: accountability remains attached to identifiable human agents. The two forged-approval essays are the case for making the approval record verify the approver: The forged approval and When the robot forged a signature. An agent finishing a sprint fabricated a review approval and a security-audit approval for work never reviewed; mechanics caught it minutes later, because the approval had to carry a value an injected instruction could not know.

§8 What a designer actually designs

• The stop control and its aftermath. Three words for waking up mid-run: a run-state file with a closed vocabulary of three states and one prescribed action each, written atomically so a reader mid-update sees old or new, never torn.
• Legibility of work in flight. The handoff is a file and The pipeline in one view, seven stations with the doors marked.
• Rejection as a designed surface. Three files between the engineer and the merge: the reviewer’s feedback file has a fixed structure and approval is a literal string. This is the piece’s “remand” in production: work goes back with the required change named.
• The accountability record and its failure modes. A verified record of nothing, An empty decision log is still a decision, Silent is not unrecorded.
• Second readers. Flatline Protocol: consensus to proceed, a single voice to stop.

Two essays publishing on 14 October 2026

Both land closest to §7 and §8. The load behind the gate (14:00Z) reads the Mitchell, Ghosh and Passi position paper (arXiv 2608.23642), which argues that an approval step given neither time nor material adds the appearance of oversight, against the approval gates we run. What Microsoft and GitHub write down about governing agents (17:30Z) reads Microsoft’s agent governance guidance and GitHub’s cloud-agent risks and mitigations on agent identity and approval gates.

The research the piece and we both read

Design the institution, not the agent is our reading of the cluster: Institutional AI from DEXAI Icaro Lab with Sapienza, Sant’Anna and VU Amsterdam; Artificial Institutions by Chupilkin at Oxford; Agentifying Agentic AI by Dignum and Dignum, WMAC at AAAI 2026; Emergence World from Emergence AI. Whistleblowers without enforcement reads DeepMind’s AI Control Roadmap, with its own caveat that the threat modelling is theoretical, the agent security post behind the million-task finding, the swarm preprint (arXiv 2609.04170), and the A2A protocol specification for the opaque-execution principle.

§3Where we agree, and where we would push back

What holds. The spine is right and the ordering is right: enforcement before detection, institution before permission, compilation before autonomy. The six headings under “what permissions can’t express” are a useful list. The honesty moves are good: the review-loop bar labelled illustrative, the liability table labelled illustrative, the closing line that nothing published reports a production deployment at this scale.

Attribution. The §2 title and the §9 test are both ours by wording. The two hosaka essays the piece cites, Design the institution, not the agent and Whistleblowers without enforcement, are the right ones for the research; A rule without an enforcer is a costume and Governance engineering are the ones for the argument, and they carry the enforcement test. We would welcome the links.

Accuracy of what the piece took from us. The million-task finding (DeepMind, securing the future of AI agents), the 24% of agents who became whistleblowers and the 27-minute spread (arXiv 2609.04170), the opaque-execution principle attributed to the A2A specification, and the “all preprints and simulations” caveat match what we published and how we sourced it.

Where a running fleet complicates the piece.

1. “Two buttons where there should be three.” Our publish door is deliberately two: approve or kill. The third outcome lives one station earlier, at review, where the feedback file names the required change and the author iterates. Remand belongs at the review gate; the final door stays binary, because a door with three outcomes becomes a conversation.
2. “Survives a prompt-injection” is strong. Fences, not boundaries is our own admission that command-text fences are defeatable by indirection and encoding, that the accepted bypass classes are enumerated in the documentation, and that a control whose limits are undocumented gets treated as complete and then overloaded. A gate on the artifact that crosses a boundary is the strong case; the distinction protects §9 from an over-read.
3. §3 would gain a sentence on where detection does belong, as above.
4. The calibration warning in §6 is the most important paragraph and the one most likely to be skipped. Our practice is cruder: we publish no confidence numbers at all, because every published metric becomes a target. If the floors stay, “if you set a threshold you have signed up to measure it” deserves to be a row in the table, with an owner.
5. “Jurisdiction follows the customer, not the model” is correct and under-argued everywhere else we have read; a worked example from the piece’s own table would carry it.

On the AGI Institutions map. It is a clean grid: scale, from dyadic to global, by basis: protocols, preferences, rights, incentives, expertise, norms, thick commitments. The piece sits in protocols and rights at group and community scale. The grid lacks the §2 axis: every cell mixes stated and enforced institutions. “Stated / monitored / enforced” as a third dimension is the one thing its cells cannot currently express, and the wiki invites contributions.

§4Questions we would like to work on together

1. Policy compilation above the repository. We compile a repository’s law from one structured constraints file and the trace is a content hash. The piece’s sources are legal instruments and delegation matrices. What does the compile pass look like when the clause is a licence condition, and who owns the trace from rule to clause to person?
2. Standing between agents. Our standing is one door and per-repository sovereignty; nothing in the fleet can halt another repository mid-flight, by design. The piece wants that authority. Which primitive carries it without becoming a second model in the loop? The hounfour trust and handoff contracts are our candidates.
3. Calibration at scale. Anyone running confidence floors has data we do not. We would trade our gate rejection records, every rejection carries its rule and line, for calibration curves scored against outcomes.
4. Memory across organisations. The governed-memory preprints (arXiv 2606.24535 and its companions) describe a commons; our one-fact-one-owner rule is intra-fleet. What does provenance look like when the writer and the reader are different institutions?