How we build

Cairn is the bleeding-edge AI build pipeline we built in-house. Every project on this site is built under it.

It isn't a product. It isn't for sale or licence, and there's nothing to download or sign up for. It's how we build what you hire us for.

AI tools do much of the typing. Scripts stop them merging or deleting anything on their own, so merging stays with a person.

The record behind that, as measured on 14 October 2026: 145 multi-agent runs with more than 2,100 agents between them, six scripts on the agents' tool calls, thirteen consistency checks, and 12 of 12 on a test whose answers were written down first.

The problem

AI coding agents work from written instructions, and written instructions aren't enforcement. The tool's own documentation says there's no guarantee an agent follows them strictly. Our record shows written rules losing: one was broken seven times, twice after it had been reworded to close the gap.

The quieter failure is a safeguard that looks switched on and isn't. On 9 August 2026, every guard written so far passed its own test, and none of them was running.

What we built

Written limits on what an agent may do without a person. It can write code, open a draft for review and leave comments. It can't merge, mark work ready, close an issue or delete anything.

Scripts enforce those limits outside the agent. Six run on the agents' tool calls, before anything happens, and a seventh reads the end of every turn. Scripts stop them merging, rewriting history or deleting a branch, so merging stays with a person.

Why it holds up

No script is trusted until it has refused something on purpose. Each one carries a self-test, each test is broken on purpose to prove it can fail, and the proof that a script is installed is a refused command, not a passing test.

The stages that review the agents' work were tested against answers written down in advance before they were relied on, and matched 12 of 12.

It can't show a defect rate, though. There's no before-and-after measure of delivery here, and none is implied.

The technical detail

For agency readers: the engineering, with every count as measured on 14 October 2026.

• Built by: one person. The policies, the guard scripts and checks, the multi-agent pipelines, and the record they all write to.
• Stack: Python hooks on Claude Code's tool-call and turn events, JavaScript workflow scripts for the pipelines, a POSIX shell push gate, GitHub Actions, and MCP servers for GitHub and the databases.
• Timeframe: July 2026 to now. Still in progress.
• Source: the repository is private, and this page links none of it. We can walk through it on request: get in touch.

The problem, in detail

The projects on this site were built with AI coding agents doing much of the typing. An agent works from an instructions file, and that file is context, not configuration: the tool's own documentation says there is no guarantee of strict compliance. Every rule for the agents lived in one, and the record shows the rules losing.

One rule shows the shape. When an agent needed a decision from a person, it was to offer clickable choices rather than ask in prose. It was broken seven times, twice after it had been reworded to close the gap it slipped through. A turn that hands over a decision in prose looks exactly like a finished turn, so nothing noticed until a person did.

The second failure looked like success. On 9 August the guards already written were registered nowhere. The settings file that should have switched them on had no hooks section at all, while every guard passed its own self-test. A guard that can't launch doesn't refuse anything. It lets the call through, and the layer reads as installed.

The agents' reviews needed the same suspicion. An early review pipeline handed five findings to an agent told to refute them, and it refuted none. That's either five good findings or a refuter that agrees with whatever it's handed, and from outside the two look the same.

What we built, in detail

First, a written ceiling on what automation may do without a person. An agent may read, branch, commit, push its own branch, open a draft pull request and comment. It may not merge, mark a pull request ready, force-push, close or rewrite an issue, or delete anything. The ceiling is a draft because a wrong draft costs one review to discover, where a wrong merge or a closed issue costs a recovery.

Then the hooks: eight scripts registered on the agent's events. Six run on its tool calls before anything happens, one reads the end of every turn, and one reports work at risk when a session starts. Between them they refuse merges, force pushes and every spelling of branch deletion, work in a repository outside the session's scope, a story filed without its epic and estimate, a pull request that would close an issue with unticked acceptance criteria, and a turn that ends on a question asked in prose. A git push gate refuses integration branches outright, and thirteen consistency checks keep the record honest. One of them fails the build when a number written in prose stops matching the value something else computes, which turned out to be the most common defect in the repository.

$ gh pr merge
refused before it runs: merging stays with a person

Seven multi-agent pipelines do the larger reads: a review of a working diff through six independent lenses, a sweep of every repository for work that shipped but was never recorded, backlog grooming, and others. In each, every finding goes to a separate agent instructed to refute it and to call it refuted when unsure. Only survivors reach a person, usually with a correction attached. An agent that dies mid-run is reported as dead and never as a clean result. Four of the six pipelines that existed on 7 August had been counting a dead refuter's finding as refuted, which is the most confident wrong answer a review can give.

Under it all is the record: 593 notes, each a decision with its reasoning or a mistake with its correction; a ledger row for every pipeline run, written by the session that dispatched it rather than by the pipeline; and a register of 141 faults that counts which ones came back after they were fixed.

A decision we'd defend

A rule an agent must not break is enforced outside the agent, and nothing counts as enforcement until it has refused something on purpose.

The first half came from the clickable-choices rule. A rule that comes back after its wording has been corrected has a delivery problem, not a wording problem, so the fix was a hook that reads the end of every turn and hands the turn back when it closes on a prose question. The same reasoning put merges, force pushes and deletions behind a hook rather than behind a sentence.

The second half came from 9 August. Every guard then had a passing self-test, and none of them was running. So now each guard is made to refuse on purpose before it is trusted: its test is mutated until it goes red, a check confirms the guards are registered on the machine where they run, and the proof of an install is a refused command rather than a green test. That discipline found a push gate that waved a protected branch through whenever git's list of refs ended without a newline, and nine patterns in the question hook that no logged case had ever exercised.

It also found the case nobody would have predicted. A merge from the shell was refused while the same merge through a GitHub tool server was allowed, because the guard read the shell command and a tool server's call carries none. A guard keyed on how an act is spelled misses the next spelling of it. Matching the tool by name closed that, and narrowing the token behind the server closed it a second time, so two independent ceilings now hold.

What it rejected, and why:

• Rewording the rule again. It had been reworded already, and two of the seven violations came after that.
• A guard on every hazard. Some failures have no clean signature in a command line. A guard that fires on half of them reads as coverage and stops anyone looking, so those stay written rules on purpose, with the reason recorded beside them.
• A passing self-test as proof of a guard. That was the state on 9 August, exactly.
• Letting a pipeline write its own run record. A pipeline's account of itself is the self-assessment the rest of this exists to avoid.

The cost is real. A hook refuses some legitimate work, once including its own commit, and when a guard's only false positives are cosmetic, they're paid rather than the guard softened. A push gate on one machine stops a habit, not an adversary. And a hook catches a failure without curing it: sessions still reach for the prose question now and then, and the hook still hands those turns back.

Outcome

From 3 August to 14 October 2026, 145 multi-agent runs were recorded, with more than 2,100 agents between them. Each has a ledger row saying what was found, what survived the refuter, and what was corrected.

The refuting stage was tested before it was relied on. Six claims with answers written down before the run, each dispatched twice, came back 12 of 12. The sweep's confirming stage was tested the same way with the polarity reversed, and also matched 12 of 12. The test corpus was 45 lines and synthetic, which is easier than a real diff, and the record says so.

All eight hooks carry a self-test, as do ten of the thirteen checks. The other three were proven by mutation in the commits that added them.

What this page can't give is a defect-escape rate. There's no before-and-after measure of delivery here, and none is implied.

The projects it guards are on the work index, each with what was decided and why.