The First Lap

The domain in five primitives

Delegating real work to a machine reduces to five verbs. Learn these and you can read any autonomous-agent pipeline, anywhere:

1. Identity — the worker is not you. Give it its own name, so its actions notify you natively and its permissions end where its invitations end.
2. Scope — least privilege is an ACCOUNT property before it is a token property. The mesh's entire universe is the two repos it was invited into, at Write. The token just unlocks that (already small) universe.
3. Probe — never trust a credential you haven't tested three ways: who am I (identity), what can I read (positive), what am I REFUSED (negative). A channel you never saw refuse is not a proven channel.
4. Lap — the unit of delegated work: brief in → draft → branch → PR out. It stops before judgment, on purpose.
5. Gate — the PR body carries one PUSH SUMMARY: what changed, drafted by whom, spend, the brief it came from. One summary, one human yes/no. The lap is complete only when a human says so.

Choose your door

• Builder — Builder Track: run your first lap and watch a PR appear that you didn't author.
• Architect — Architect Track: the three layers, built in order.
• Translator — Bridge below: a new employee's first day.
• Validator — Gates at the bottom, one at a time, in order.

Builder Track (DO FIRST)

On your machine, with the machine account's token loaded, run:

py -m mesh.breaker new-lap "my-first-lap"

py -m mesh.lap --brief BRIEF_FILE --repo OWNER/REPO --path TARGET_FILE --base master

Watch a pull request appear on GitHub authored by an account that is not you, with the summary in its body and $0.0000 spent. Then go click the merge button — or decline it. Both are the system working. Now read on.

Architect Track (MODEL FIRST)

Three layers, built in order:

• The identity (Step 0): a dedicated machine account — its bio marks it a machine account operated by its owner (the ToS convention); 2FA enabled (the first QR was screenshot-captured, so the secret was reissued — a captured secret is a leaked secret); invited via gh api, verified Write on both repos. Token gotcha learned live: fine-grained PATs cannot cross personal accounts, so the fallback is a classic PAT, repo scope only, 90-day expiry — the account's tiny universe does the narrowing.
• The hands (Step 1): mesh/lap.py — strip fences, create branch, put file, open PR, build the PUSH SUMMARY. Its Drafter call rides the Phase 4 breaker, so a lap can never outspend its ceiling. v1 deliberately stops at "PR opened": red-CI recovery stays human this phase.
• The proof (Step 2): the ritual pair — adversarial review (an independent reviewer found 1 blocker: 404-detection by string-matching error text) then prove-the-fix (13 regression tests written from findings, 12 red before the fix, 100/100 green after — and the tests then caught a live bug in the FIX itself: percent-encoded branch slashes). Author-verifier correlation is real; the pair is how you beat it.

Translator Bridge

In your world this is a new employee's first day. HR issues a badge (the account) that opens exactly two doors (the invited repos). Orientation is the probe ritual: confirm the badge says their name, confirm it opens their doors, confirm it does NOT open the vault — and the vault door doesn't even admit it's a vault (the 404). Their first task comes as written instructions so precise the trainee only has to transcribe them. And nothing they produce ships until the supervisor signs the one-page summary on top.

Validator Gates

Write each answer in your own words before checking.

1. Gate 1: My own token already worked. Why does the mesh need its own account? (Two structural fixes: GitHub never emails you about your own actions — a machine identity makes its PRs notify natively; and CODEOWNERS enforcement deadlocks with one identity, since an account can't approve its own PRs.)
2. Gate 2: You probe branch-protection settings with the mesh token and get 404, not 403. Bug or pass? (PASS. On private repos GitHub hides resources the token can't touch — an unauthorized caller can't even confirm the endpoint exists. On an admin endpoint, 404 is the expected result for least privilege.)
3. Gate 3: hermes3:8b flunked two module drafts, then reproduced a 170-line file with a single perfect one-word change. What changed? (The ask finally matched the seat. Small local models TRANSCRIBE, they don't synthesize — spec sections given as literal code came back perfect; sections in prose came back AS prose. Spec-as-code, lap-sized asks.)
4. Gate 4: Why does the lap runner stop at "PR opened" instead of merging its own green PR? (The merge is the human's — that's the gate the whole chassis exists to protect. A lap that could merge would make its worst failure "bad code on main" instead of "a PR you decline.")
5. Gate 5 (the honesty gate): The first lap PASSED — and produced two blemishes. Whose were they? (Both ours, neither the model's: our strip_fences ate the file's EOF newline, and PowerShell's default encoding mojibaked the brief display. Attribute failures honestly or you'll retrain the wrong part of the system.)

This module ran live on 2026-07-06: brief assembled → py -m mesh.lap → a pull request on a small game repo of mine, authored by the machine account, PUSH SUMMARY in the body, $0.0000 spent → CI green in 15 seconds → I merged. Success criterion met: a pull request I would have approved anyway. The lesson you just read is the lap that actually happened.