From Zero to Running System

Fulltrace started doing work by itself. One model writes a plan, a second carries it out with tools, and a third checks the result and sends it back when it falls short. Network errors are retried without the model seeing them, a badly formed tool call goes back to the model to fix, and a test harness runs the same task many times to measure how often it succeeds. The first job kept this website current from each project's changelog, readme and version. A model proposed the edits and plain code made them, inside the website folder only, with git blocked.

The single pipeline became one step in a larger map of steps. Code checks the map before any model is paid for, runs a few steps at a time, and stops the run if it goes over its token budget. The first run on it audited the code of every enrolled project at once. The local server gained a way to list workflows, start a run and stream its progress live, all behind a login token because these calls spend money.

Free-tier rate limits blocked the first full run, so a stage could now take a list of models: a preferred one, then backups. If a provider is down or busy, the stage restarts on the next model. A real error is reported straight away, and the record names every model that was tried. The same push fixed the worst quality bug. Code now picks the most useful files for each audit, and a run that ends without sending its findings is a failure. Before, it looked like a clean pass.

Plain code now re-checks an audit result in four ways: the output exists, the model finished, the report has the right shape, and every finding quotes a real line in a real file, word for word. If any finding cannot do that, the whole result fails, and a failed result gets one smaller retry. The path for making a fix landed alongside it. A fix is replayed from a saved report that passed the checks. It is a preview by default, limited to allowed folders, needs a clean working tree and must pass the project's own build. A line-ending mismatch blocked the first real fix, so matching now allows for line endings. Two real fixes went through the whole path and were committed.

A second model can now be asked to challenge a result that passed. It can add a warning. It cannot change the verdict or cause a write, and that policy is written down. Workflows also got a registry, where each one has a fixed id and a description that is checked before any model is called. Two new workflows use no model at all. One reports docs that have fallen behind the code, and the other reports commits the changelog does not mention.

Runs are now saved twice: in logs that are only ever added to, and in a local database for fast lookups. A database row with no matching log entry is kept and reported as it is. Queued jobs hold no keys, because the worker adds credentials when it picks a job up. An approval record now exists for any future fix made with nobody present. It is tied to one exact change and issued by a command that refuses when in doubt. Applying a fix with nobody present stayed impossible.

A read-only layer over the audit results, with no model in it: a report that groups findings and links each one to its evidence, a log of what was decided about each finding, and a summary of what past runs show. Everything in it is a suggestion, and nothing fixes itself. The website audit also became a workflow. It reviews how this site tells each project's story. It can propose changes and cannot make them.

The extension grew Workflows, Runs and Graph tabs, then merged them into Studio: one screen built around the life of a run. A person picks a workflow, sets it up, sees a cost estimate from past runs, confirms the spend, watches it live and opens any step to read its findings. The lists of workflows and projects moved into files kept in git, so adding a project is a reviewed change. By the end of this phase the panel's code was one 12,000-line file. Splitting it up started in August, and the last big piece left on 29 September.

Making a fix became something done from Studio. Each step was designed first and reviewed by a second AI before it was built. The exact change is shown. Studio then rehearses it: it applies the change, runs the project's own build and undoes it. Only a change that passes can be approved, and the approval covers that one change. On 4 July the first approved fix landed on a real project and was kept, with its build passing. The fix model also got stricter instructions: stay within the evidence, or decline and say why. Around it came a shared model picker and a one-script setup for a new machine. Studio shipped a new release most days through this stretch.

The next problem was a change too big for one edit. A model now splits it into steps, and that model cannot write anything itself. Each step goes through the same checks and gets its own commit, and a running cap reads the real git history so a large change cannot slip through as a run of small ones. The first live plan had three steps and cost about ten cents. Then, in one day, came the decision inbox: one read-only list of everything that needs a person. Five of its six parts shipped. The sixth needed several machines, which did not exist yet. It was marked deferred, because a paused row left in progress would show as work under way.

The checks already assumed the model could be wrong. This phase assumed the files it reads could be hostile. Audits put real file contents and web pages into prompts, and a copied snippet could carry a line like "ignore your instructions". So every prompt now has one place instructions can come from. Everything else is wrapped as data and sealed with a random marker, and content that already holds the marker is refused. A before-and-after audit over three projects, for about US$0.32, showed no drop in quality. Two more things arrived. The phone started getting notifications and a read-only page, showing counts only, with no content. And Studio gained a set of models that run on the local machine. Their use was recorded from the first call, and they were kept out of task runs.

Thirteen tabs became seven. A registry now lists every place a prompt is built, and a scan fails when one appears without an entry. It caught a real miss straight away: a stage that had shipped two days earlier without one. Then came the find this phase is named for. A test checked whether granting permission to change project code would ask first, and the command ran with no prompt. None of the three layers meant to stop it was working, and in one mode a rule that should ask is ignored entirely. Nothing would have flagged it. It was rebuilt to give a clear allow, ask or deny for every command. Two weeks later the registry's own coverage claim was checked and found to be half true. Phase 31 picks that up.

A run could hang on one model call for ever, because a hung call spends no tokens and so never trips the budget. Every call now has a time limit, the stages that use tools have backup models, and a timeline shows which steps really ran at the same time. A run can be stopped part way through, and the stop is recorded as a person's act. Audits also started reading a short brief about how the work gets done, served by the local server and listed in each report. And halfway through, AgentOS became Fulltrace, because another product is called AgentOS and AI tools reading this site had started to mix the two up.

Each project's details moved out of code into files kept in git, and Studio gained a Projects view: one card per project, a checklist of what it has, and Refresh as the only button. Enrolling a project starts an interview in a chosen AI tool, on a personal account, and what comes back is a proposal for a person to review. The local server stopped crashing on a broken settings file, where one typo used to take every route down. The prompt registry turned out to cover only half the system, so Studio's prompts got a registry and a scan of their own. The local models also got their first real job: a search index over the project's own docs, searched at $0, storing numbers only, with none of the text.

Task runs can now be put on an overnight schedule. A schedule is a file, and switching it on is a separate recorded act tied to the schedule's exact contents, so editing a schedule switches it off again. Nothing runs until its limits are set by hand, and the limits file ships blank. One limit counts how many decisions a night can leave for a person by morning. Jobs are keyed to calendar dates, so a daylight saving change cannot run one twice, and every due job ends as ran, skipped or capped, with the reason named. The scheduler is built and tested, and no job has been scheduled on it yet. Studio also gained a Signals view: counts drawn from the run records, with no model involved. And a sweep closed gaps in the spending record. A mistyped option used to be read as a prompt and buy a model call. It is now refused, with the nearest real option named.

A workflow can now be written down in a file and run. The file is checked against a fixed shape, nothing can use it until a person accepts it, and an edit after that cancels the acceptance. Steps can carry a condition such as "only if the report has findings", and a workflow that writes to files is refused. The same fortnight set the rule for what may leave this machine. The thirteen places data can leave were listed in code and locked by tests, and nine of them are this machine talking to itself. The push tool refuses a remote owned by anyone else, and the assistants lost the four shell commands that send data out. Spending got its own page, where runs can be filtered by model and two runs compared side by side. A tool also arrived that breaks the code on purpose and checks that the tests fail. Its first real run found a small group of tests that disagreed with themselves. And on 19 August the first slices, small planned pieces of work, shipped with nobody in the session.

The nineteen standing rules stopped being paragraphs. Each got a record saying how it is enforced, checked against the real code: a guard that refuses, a test that fails, a checklist step, or nothing yet. One rule turned out to have nothing, and the record says so. Eighteen were ruled permanent and one temporary in one sitting, and Studio lists them under Config > Governance. The steps of the method moved out of the extension's code into a file a project can own. A saved run became a test: replayed with no model called, 89 of 101 recorded runs came out exactly the same. A chat tab arrived in Studio, with the model and cost on every reply and a spending limit that stops it. Schedules could be switched on and off, created and edited from the screen. On 22 August the unattended runs moved from nights to around the clock. And the written process stopped assuming Claude. A short file at the top of the repo tells any assistant where the rules live and what only a person decides. The first watched Codex run found the rules and diagnosed the problem better than the backlog row had. Then it stopped, because in that mode Codex could not write files here.

The panel had grown to nine tabs, and the screen for building Fulltrace sat last, behind eight tabs meant for using it. So the panel got a switch: Operate, eight tabs for using Fulltrace, and Build, six tabs for building it. It reopens where it was left, and nothing is more than two clicks deep. Seven panels that show a figure read from somewhere else now say where the figure came from and when it was taken, and an empty list gives a count and a reason. Chat learned to use a model on this machine at $0. How deep a code audit reads can be chosen, and every project says when it was last audited. Most of the remaining places the panel said AgentOS became Fulltrace. Four stayed, because other code reads them by exact name. And each build of the extension now carries a number and a list of the slices in it. The first list was wrong, and fixing it became a row.

A security review on 4 September read through the code. Its four most serious findings were fixed within ten days, and thirteen small ones were closed in October. The file tools can no longer write to the files that decide what runs next. The logging endpoints now need the login token. Audits and other model-driven jobs stopped carrying the write token, which they never needed, and memory copied into the repo is checked for six common key patterns. Meanwhile the half of Studio's 22,000-line panel file that answers button presses moved into small files that can be tested, in eleven steps, with nothing on screen changing. On the factory side, one run that started just before midnight on 6 September took on 17 slices and shipped all 17 over the next 18 hours. After a run, a page now lists what to click to check the work, and the factory's board gained a stats page that shows how much of the machine's working time the unattended runs did. From 12 September a slice that changed the runner's own guard rails stopped the run until a person had looked.

On 21 September a slice in the write-or-authority risk class shipped unattended, without the design review the rules recommend for that kind of work. The same day the unattended limit was lowered, so that work now only runs with a person present. Since 26 September raising the limit again would not be enough, because each such row also needs a dated clearance written by a person after its review. The unattended runs got steadier too. They pause when the Claude plan runs out of hours and pick the same slice back up, and since 28 September they run on a fixed copy of the runner's code, so a slice cannot change the runner it is running under. Codex had been refused every time it was asked since 9 September, and no check flagged that the first-choice reviewer was dead. It was repaired on 27 September, given the same guard as Claude, and offered as a builder for slices a person starts. A scan also found twenty-two of the project's own self-tests crashing before they tested anything. New in Studio: a Research workflow that answers from chosen files, chat that can read attachments, an Ideas tab, and a button to rule on a parked slice.

The factory had only ever built Fulltrace. In the first week of October it became able to work from another project's roadmap. Fulltrace can tell which project a folder belongs to, one command gives a new project a starter roadmap, and the board, the stats page and Studio's Build mode can each show any enrolled project. On 5 October the first slice outside Fulltrace, and so far the only one, shipped in the Salesforce Developer Tools extension, in a run started by hand. Studio's Start button still runs Fulltrace only. The same week the runner's queue could be changed from Studio, where before a session had to edit the file. Every deploy now writes its own page of manual checks, which can be finished inside Studio. A Films tab rebuilds the demo films on this site and reshoots the board one. And the Research workflow can cite the web when a box is ticked, and one bad quote no longer sinks the whole answer.