My AI agents are not allowed to say my model graduated. I wrote the rule that stops them.
Yesterday my joy detector cleared both bars on a sealed exam for the first time: 30 of 32 on the texts that should fire, 45 of 57 on the ones that should not. The adversarial reviewer accepted the result and then banned one word from every page I control. The student has cleared the gate. It has not graduated. Nobody gets to write "graduated" until fresh text, read blind, says so.
The reviewer is an AI agent. So is the one that trained the model, the one that built the exam, and the one that caught my own claim overstating what I had seen. They all run on the same operating system, and this post is about that system: what it is, how a day under it goes, and what it changed about the quality of the work.
Three files, and nothing that knows what you are building
The whole thing is small. Roles, gates, laws.
Roles are fourteen constrained experts. Each one has an operating prompt, a checklist that gates its output, and a memory file that fills up with lessons in your project, never in the shared repo. A scout only observes. A synthesis role only infers. Executors only apply approved changes. A challenger only refutes. The challenger runs on a different frontier model from the one that generated the work, on purpose, so the refutation is not blind to the same failure modes.
Gates are fourteen checks an artifact passes before a human is asked to look at it. Laws are conduct rules, append only, each one named after the defect that caused it. Twenty-four of them so far in my project. A script checks the ones that can be checked mechanically, because prose decays and scripts do not.
Everything domain-specific, what you measure, what you sell, who approves, lives in one file in your own repository. The operating system never sees a domain noun. There is a test that greps for them and fails the build if one leaks.
What a day looks like
Sessions are disposable. The repository is permanent. Every session starts by reading a bootstrap file, then the last handover, then continues from the first unfinished step. When a session ends, for any reason, it writes a checkpoint first. This week's sessions wrote three.
Work moves as pre-registrations. Before a training run, the bars are frozen, the critical counts are written down, the number of times the exam may be read is fixed, and the challenger files its own prediction. Only then does money get spent. When run 9's pre-registered checkpoint failed retention at 21 of 32, the record already said what a fail meant and what a pass would have meant. There was nothing to argue about.
I am the only source of truth for what a feeling is. Every exam row is my verdict, sat blind. Over the last 32 days that was 2,950 verdicts and about 183 hours of sessions, and the system counts them, because chair time is the scarce resource and it should be spent where the design says.
The reviewer that caught me
Run 9 trained for a fixed 1,200 iterations, as registered. Its held-out loss bottomed at iteration 150 and rose for the next thousand. The model memorised. I filed an amendment, before reading any result, to examine the iteration-150 checkpoint instead, chosen only from the validation curve.
The challenger accepted the numbers and rejected my sentence. Its finding: the exam had already executed on the box when I filed, the result file's timestamp on my machine sat three seconds before my commit, and "filed before any exam read" claimed more than the record could support. It rewrote the allowed claim to state the checkpoint switch, the second look, the enriched yes side and the in-corpus limit, in one sentence, and it forbade the word graduated until the next gate.
That is the system working. Not the model passing. The part where my own framing got corrected by something I built to correct me.
A law that had been silent for two weeks
One of the mechanical laws warns when a page claims feeling detection without a construct lock behind it. On 2 September an agent noticed the check was dead code. The report-and-exit block sat above it in the script, so it had never run since 18 August. Moved, re-run, two live warnings surfaced the same minute.
Nothing had broken loudly. A guard had gone quiet. Under this system, the guard's silence became a finding with a commit hash, not a surprise six weeks later.
Owning the defect instead of the excuse
Run 7 failed hard: 2 of 9 on the yes side. The finding file records two coordinator-owned design errors: the exam's yes side was 9 rows, which cannot measure a 90 percent bar, and all 186 reclaimed yes rows had gone into training with none reserved for the exam. It also records the diagnosis, a register skew in the textbook that taught "boundary-style text means yes" when my verdicts on that register run about 85 percent no.
The next exam was rebuilt from my verdicts only, sealed at 89 rows, with a challenger review of its design before a single row was read. Run 9 was read against that.
What it changed
Quality stopped depending on my attention. The system refuses work on my behalf: a deck builder will not write a deck that violates the composition law, a training job will not start without the challenger's acknowledgement in its provenance file, a runner will not train on an exam whose checksum does not match the seal.
The memory compounds. Thirty-seven decision files, 204 findings, 10 lessons, each dated, each pointing at the record that caused it. A session that has never seen the project reads them and does not re-fight a settled battle.
And the speed came from delegation, not from cutting corners. Machine work goes to cheaper models with the full spec in the prompt. The frontier model is spent on judgment: rulings, pre-registration design, money, incidents.
Limits
This is one project, two months old, with one human judge, and the judge is me. The 24 laws have mixed enforcement: some are mechanical, some are still prose, and one of the mechanical ones was silent for two weeks before anyone noticed. The run-9 pass is an in-corpus read on a keyword-enriched yes side, which is exactly what the reviewer said it was and nothing more. One agent this week wrote outside the repository despite the rule, over a system binary that three daemons depend on. The rule now sits in every agent prompt. It did not before.
Where to go next
The operating system is public on GitHub at github.com/perwinroth/die-os, scrubbed of everything that belongs to my project. Roles, gates, laws, the bootstrap loop, the law checker. Copy it in as a folder, write one domain file, and point your agent's entry file at it. Two projects sharing it should be able to swap it wholesale and notice nothing.
If you run agents on real work and you have ever caught one of them agreeing with you when it should not have, that is the problem this was built for.