The Lord, the Fleet, and the Rulebook That Binds Them Both
Every story about AI agent fleets is secretly a story about governance, and nobody wants to admit it.
The demos show the fun part: ten agents, ten branches, code pouring forth. What they don’t show is agent three killing agent seven’s test suite with an unscoped pkill, or two agents restoring each other’s files from a shared temp directory, or the night two of my sessions raced to update the same branch and silently disarmed an auto-merge neither knew the other had armed.
I know, because all of that happened to me. I’m the only engineer at my startup, I run up to eight Claude Code sessions in parallel, and for a while my kingdom was pure anarchy with good intentions.
So I did what people have always done when anarchy stops scaling: I wrote law.
The Court
The system that emerged has a shape old enough to have a vocabulary. At the top there’s me — call it the lord, since we’re committed to the bit. I hold every real power: production credentials, merge authority, the final word on anything irreversible.
Below me sits the master session — one Claude Code session that acts as chancellor. It governs and never implements. It writes no code; its entire job is running the machinery of state:
- Verifying claims. Children report; the master checks their reports against git, CI, and live endpoints before believing a word.
- Sequencing. Merge-queue choreography, deploy windows, who waits for whom.
- Brokering authorization. Every risky action needs my word; the master routes, batches, and executes those words.
- Keeping the record. Memory files, incident chronicles, and — when its own context fills up — a succession document for its replacement.
- Watching. Persistent monitors on CI, deploys, and production readiness, built in the session’s first minutes, because a master that polls on request is a secretary.
And below the master, the fleet: child sessions, each in its own git worktree, each with a brief that names its owned files, its evidence bar, and one instruction that turns out to matter more than all the others:
Verify this brief before acting on it. It is a hypothesis. You are expected to correct me.
They do. Constantly. Last night one child opened its report with “three findings, two of which contradict the brief” — and all three corrections were right. This is not insubordination. This is the system working. A court where nobody may tell the chancellor he’s wrong is a court that ships the chancellor’s mistakes.
The Oaths
Here’s where it gets genuinely medieval. Authorization in this system isn’t a checkbox — it’s a word, in almost the old sense: a thing spoken, binding, with formal conditions on when it holds and when it’s void.
- A first-hand conditional word — me telling the master “merge these two when both are green, one batch, and watch the deploy” — is banked. When the condition lands, the master executes. I say it once, at 9 p.m., and don’t get pinged at 11.
- A relayed word is worth nothing. If the master tells a child “the lord approved this,” the child is required by law to refuse. Authorization lands in the session that holds the button, or it doesn’t exist. One child last night refused to press its own merge on precisely these grounds — and it was right about the rule even though, as it turned out, the button was never its to press.
- Words get spent. If a PR is evicted from the merge queue — even by pure infrastructure failure, through no fault of its code — its merge word is consumed. Re-entry requires a fresh one. This sounds like bureaucracy until you watch it prevent exactly what it exists to prevent: a stale approval carrying an action into a situation that has changed underneath it.
- Some things never bank. Database migrations, destructive operations, live calls to external APIs, production flag changes: fresh word, every time, spoken in the executing session. No exceptions, including for me being tired.
The payoff is that you get speed and safety from the same mechanism. Seventeen production merges happened last night and I pressed zero buttons — yet not one action ran without a current authorization I had actually given, with semantics both of us understood.
The Law of Evidence
The second pillar: nothing in the realm is a result. Everything is a claim.
Children verify briefs. The master verifies children. Even the second-model adversarial reviewer we use (a rival AI, prompted as a pure skeptic, allowed to fire on exactly three triggers so it never decays into ceremony) produces findings that are — again — claims, verified against the tree before anyone acts on them.
The discipline has teeth because it’s specific:
- A test that passes on its first run has proven nothing until it’s been falsified — break the thing it guards, watch it go red, restore it.
- A zero must arrive with a null control proving the query could have found something. (“No results” from a broken query looks identical to “no results” from a clean system. We learned that one the hard way. Twice.)
- A “no behavior change” claim gets settled by comparing ASTs with docstrings stripped — with a deliberate mutation first, to prove the comparison can fail.
Last night this culture caught, among other things: two test suites whose fixtures were configured to disagree with production in exactly the dimension under test — every green proof of a critical code path had been run under the one setting that hid its bug — and a paraphrase of a code review that silently dropped the single clause a coverage gap was hiding behind. The child who caught that last one said it best: the verbatim beats the relay, and the relay’s gap was found by a test, not an argument.
The Case Law
Frameworks ship rules and ask you to trust them. My rulebook doesn’t work that way. Nearly every law in it traces to a named incident with a date, kept in memory files that read like a court reporter’s archive:
- Never update a queued PR’s branch — because the merge queue is testing the exact head you’d be rewriting.
- Eviction detection must pair timeline events — because a silently evicted PR reads as green, mergeable, and healthy, forever, while quietly not merging.
- Read a CI job’s steps, never its conclusion — because a job can “fail” with every test green when the runner dies writing its own diagnostic log.
- Exit codes come from files, never wrappers — because a background wrapper once reported success over a suite that had been killed mid-run.
- The type-checker is the only frontend gate that reads test files — discovered twice in one hour, by two different agents, from two different failures.
This is case law in the honest sense: precedent, with receipts. And it’s why the agents actually follow the rules — every rule can answer “why?” with a story instead of a shrug.
One Night in the Realm
The campaign: get all three of our product’s third-party connectors writing to their upstream platforms in production, live-proven, with readiness reporting that tells the truth.
The first live write through the newest connector — a one-attempt-ever, never-retried production write, by design — failed. It left zero log lines. What it left instead was durable state, and durable state is enough: a diagnosis agent traced the death to a one-line defect that every test fixture in the repository had been configured to hide, then — resumed with fresh evidence an hour later — found a second, independent defect meaning the recovery path had never once been able to parse its own input. In any environment. Ever.
Meanwhile, a recovery sweeper that another child had shipped that same evening deployed mid-incident and autonomously rescued the orphaned write on its first production pass. The machine caught its own casualty with a net it had finished weaving twenty minutes earlier.
The infrastructure, refusing to be upstaged, then staged its own siege: GitHub’s hosted runners ran out of disk four separate times, each death evicting an innocent PR from the merge queue and spending one of my words. The fleet’s forensics distinguished infra deaths from real failures by step-level evidence, a stop-rule kicked in at strike four, and a structural fix was chartered before I’d finished being annoyed.
And through all of it, the attended work stayed mine. I repaired a dead production credential by hand, ran the forensic queries against the production database, performed the emergency restart, and made a dozen design rulings the fleet escalated between dinner and midnight.
Then production went dark for half an hour, and the night produced its best scene.
The deploy verifier declared failure. Every signal said rollback. And rollback would have been exactly wrong — because I recognized the failure’s shape from an incident months before any of this tooling existed. “Are we sure this isn’t the embeddings cold start again?” I sent the master to the code to test my hypothesis, and there it was: our API loads a 1.3GB embedding model before binding its port, every deploy restarts that multi-minute warmup, and the night’s merge train had been serially executing almost-warm containers with fresh image repoints. The platform logs showed one container reaching “Site started” — for thirty-five seconds — before the next deploy killed it. No bad code anywhere. Rollback would have reset the clock and extended the outage. The call to wait was mine, and it was right.
That’s the real division of labor: the fleet holds every thread so my attention lands where judgment is scarce. And judgment, it turns out, is the one layer nothing else in the system can supply.
The Rulebook Binds the Lord
Here is the part that makes the whole thing work, and the reason the title isn’t “Agentic Feudalism.”
A feudal lord’s word is law because of who he is. In my realm, my word is law because of what the law says about words — and the same law binds me:
- When infrastructure evicted my PRs, my own words were spent, and the system made me speak new ones. It did not once assume “he obviously still wants this.”
- When I asked whether we should run one more adversarial review “for sanity,” my own chancellor told me it would be over-engineering and recommended against it — with reasons, from my doctrine. (I overrode it. That’s allowed. The override was logged.)
- At strike four of the runner disk deaths, the stop-rule fired on me: no more re-presses, even though each one cost me nothing but a word, until the structural fix landed.
- And when a child refused to act on a relayed approval, the resolution wasn’t “the lord insists.” It was a precise clarification of which session held the word — because the child’s refusal was correct under law, and the law wins.
A sovereign bound by his own constitution isn’t weaker. He’s auditable — and in a system where the sovereign’s judgment is the scarcest resource, auditability is what lets that judgment run at full speed without anyone (including him) having to wonder, later, what actually happened.
The Price of the Crown
Honesty section. The realm is not free.
- Tokens. A night like this consumes a great deal of model. The evidence discipline roughly doubles the work per change. I think it more than doubles the trustworthiness. That’s a bet, not a theorem.
- The master is a serialization point. Every question routes through one session. It scales further than you’d expect — governing is cheaper than implementing — but it’s a bottleneck by design.
- It assumes one decisive sovereign. The word system works because I answer in seconds with one line. A committee would deadlock this constitution by Tuesday.
- The weather is real. You will spend genuine effort distinguishing your fleet’s failures from your infrastructure’s. Build the forensics before you need them.
Build Your Own Realm
Three things transfer, whatever your setup looks like:
- Write the constitution before you need it; let incidents amend it. The rules that stick are the ones with stories attached. Keep the receipts — dates, run IDs, the exact wrong output.
- Make authorization a first-class object. Decide what an approval is, who holds it, when it expires, and what spends it. “The human said yes at some point” is not a semantics — it’s a future incident.
- Treat every agent output as a claim. The single highest-leverage sentence in any brief I write is “verify this brief before acting on it.” It converts executors into skeptics, and skeptics compound.
Succession
The night ended the way the law says it must. The master session — context nearly full, campaign nearly done — refreshed every live fact, settled the record, wrote a succession document with its own verification recipe, briefed its replacement, and asked to be archived. Its final report to me disclaimed a piece of credit I had given it, because the credit belonged to an older record.
I wrote this constitution one incident at a time. The fleet’s job is to hold me to my own rules at a scale I could never hold them alone. That’s the whole trick, and I’ve stopped being surprised by how well it works: the agents aren’t the impressive part.
The law is.
The realm runs on Claude Code sessions coordinated through cross-session messaging, git worktrees, a merge queue, and a growing archive of memory files. The master-session doctrine, the word system, and the case law are homegrown. Happy to talk about it — reach me through this site.
