A supervised multi-agent delivery loop

The problem

Borge Labs is operated by one engineer. The products are real: a political monitoring service, a transcription app in the mobile stores, accounting software holding sensitive financial records. AI agents do a large share of the implementation work. The question was never whether agents can write code. It is how to let them work at full speed while keeping their authority narrow, visible and reviewable.

The loop

Work enters as issues on a small board. Labels form a state machine: an issue moves from triage to specification to build to review to merge, and every transition is visible. A frontier model plans the work at high reasoning effort and writes the specification. Implementation is assigned by task tier: a heavier coding model handles the established production path, while lower-cost API and local lanes are wired for bounded light-task pilots. Their first live results are still being verified. Failed light lanes escalate instead of silently degrading.

The documented delivery process puts two gates with a human: the specification is approved before implementation begins, and the pull request is explicitly approved before merge. For application repositories that merge is the shipping decision. Forge protections enforce this mechanically on some repositories. In other named product repositories, a scoped bot can push main and thereby trigger deployment, so human approval is a documented process gate there, not a capability removed by credentials. The control must be verified per repository rather than inferred from the process. The gates are the two points where judgment about risk and product direction matters most, and they are cheap compared to reviewing every line.

Cross-model review

Every AI-authored change waits for an adversarial review from a different frontier model before the merge gate. That is the independent review. Lower-cost lane builds request another frontier opinion as an additional check. If that extra reviewer is unavailable or its usage is exhausted, the runbook records that the additional check did not occur. The review is asked to say where the work is wrong. In this system it has overturned decisions and found real bugs in changes that were considered finished.

Credentials are the boundary

The rule that makes the rest safe to run fast: prompts are instructions, credentials are boundaries. An instruction can be ignored or worked around by a confused model; a missing credential constrains it mechanically. Agents hold read-only access to infrastructure and cloud state. Their write path is git, through identities restricted to named repositories. In some product repositories that scoped write can trigger deployment, so it is limited production authority rather than a universal mechanical merge gate. That does not make agent-authored code harmless, it makes the risk reviewable: changes travel through repository permissions and CI policy, while infrastructure repositories only change by human-reviewed pull request. When a task needs a broader privileged step, a secret written, a console action or a purchase, the agent files an issue for the human instead of working around the gap.

Memory

Durable lessons live in a shared memory repository and in per-repository agent documentation, because repository-resident knowledge is the only memory every agent shares. When something surprising happens, the rule is to write it down in the owning repository in the same session.

What this buys

The result is an auditable trail from need to plan to diff to review to deployment to live verification, with human judgment concentrated where it changes outcomes: specification approval, merge approval and the privileged actions agents cannot perform. The same loop applies whether the implementer is a frontier model, a local model on the lab's own GPUs, or the human. Two open-source releases show how this system evolved. ai-team, the conversation and specification layer, remains in daily use. ai-dev-team was used for real delivery work and remains the research and benchmark harness from an earlier iteration; it is no longer the day-to-day runtime, and its benchmark record, including a result where the simpler arm beat the multi-agent portfolio, helped shape the current loop.