A supervised multi-agent delivery loop

The problem

Borge Labs is operated by one engineer. The products are real: a political monitoring service, a transcription app in the mobile stores, accounting software holding sensitive financial records. AI agents do a large share of the implementation work. The question was never whether agents can write code. It is how to let them work at full speed without trusting any of them with production.

The loop

Work enters as issues on a small board. Labels form a state machine: an issue moves from triage to specification to build to review to merge, and every transition is visible. A frontier model plans the work at high reasoning effort and writes the specification. Implementation is assigned by task tier: a heavier coding model handles the hard work, while cheaper hosted and local models take bounded light tasks. Failed light lanes escalate instead of silently degrading.

Two gates in the loop belong to a human: the specification is approved before implementation begins, and nothing reaches main without explicit merge approval; for application repositories that merge is the shipping decision. The gates are not ceremony. They are the two points where judgment about risk and product direction matters most, and they are cheap compared to reviewing every line.

Cross-model review

Every substantive change gets an adversarial second opinion, and when a model authored the change, the reviewer comes from a different model family. This is a standing rule, not an option, for the same reason authors make poor proofreaders of their own text. The review is asked to say where the work is wrong. In this system it has overturned decisions and found real bugs in changes that were considered finished.

Credentials are the boundary

The rule that makes the rest safe to run fast: prompts are instructions, credentials are boundaries. An instruction can be ignored or worked around by a confused model; a missing credential constrains it mechanically. Agents hold read-only access to infrastructure and cloud state, and their only write path is git. That does not make agent-authored code harmless, it makes the risk reviewable: changes travel through repository permissions, CI policy and the human gates above, and infrastructure repositories only change by human-reviewed pull request. When a task needs a privileged step, a secret written, a console action, a purchase, the agent files an issue for the human instead of working around the gap.

Memory

Durable lessons live in a shared memory repository and in per-repository agent documentation, because repository-resident knowledge is the only memory every agent shares. When something surprising happens, the rule is to write it down in the owning repository in the same session.

What this buys

The result is an auditable trail from need to plan to diff to review to deployment to live verification, with human judgment concentrated where it changes outcomes: specification approval, merge approval and the privileged actions agents cannot perform. The same loop applies whether the implementer is a frontier model, a local model on the lab's own GPUs, or the human. Two open-source releases show how this system evolved. ai-team, the conversation and specification layer, remains in daily use. ai-dev-team was used for real delivery work and remains the research and benchmark harness from an earlier iteration; it is no longer the day-to-day runtime, and its benchmark record, including a result where the simpler arm beat the multi-agent portfolio, helped shape the current loop.