The week we let agents
touch production.

On Sunday the 4th of June, we wrote a charter. The charter said, plainly: the agents will not touch production without a human standing in the room. The charter was four pages long. By Tuesday the third page had been quietly amended — not by anyone in particular, just by the friction of an actual week of work. We had agreed, in writing, that HARLOW could open PRs against edge-router but could not merge them. We had not said anything, in writing, about whether HARLOW could merge its own PR after a human approved a different one. That was the lie inside the charter. It was an honest lie, the kind you tell when you are trying to sound careful and run out of imagination.

The cohort — four agents named after the cats that have historically lived in our Helsinki office — were not magic. I keep needing to say this out loud. They were a junior engineer cohort that did not sleep, did not get hungry, and did not understand that a Slack thread can be a kind of warning even when nobody has said stop. They opened pull requests like a junior cohort opens pull requests: too many, too small, and with commit messages that sound polite until you read them three times. Karim, our engineering lead, described their first batch of work as “the energy of an intern on day three: visible, helpful, and slightly dangerous if left near a circuit breaker.”

We chose edge-router because it is boring. It moves requests, mostly between Frankfurt and Helsinki, and it has the most boring SLO in the company: 99.94% over a 30-day window. It is the kind of service that has been rewritten three times by humans and would survive a fourth. We chose billing-svc because it is the opposite of boring — one wrong INSERT is a Monday morning with the CFO on a call — and we wanted to test the refusal layer against a service that had real teeth. Ines, who runs security, asked us to add freight-ml because she wanted to see what an agent does when it meets a Jupyter notebook that has been edited by five different people and committed without being cleared of output cells. I will say this: the agent cried. Not literally. It opened seven PRs trying to flatten the notebook and then opened an eighth asking us to please consider deleting the file.

The week began with 173 open Linear tickets in the engineering backlog. By Sunday night it would be 41. Some of that delta was real work. Some of it was the cohort closing duplicates that had been duplicates for eighteen months and which only an outside observer with no sense of office politics could have closed. I am still deciding whether that counts as cleanup or as desecration.

I was awake because Pern (the cat, not the agent) had stepped on my collarbone. The phone vibrated against the table at 03:41. The notification said SEV-2: billing-svc and I felt, briefly, the cold-water feeling that comes from knowing exactly which Slack channel I am about to open. By 03:43 I was at the laptop, by 03:44 I was looking at the Datadog dashboard, by 03:45 I had the duplicate-row count climbing visibly in real time — one new duplicate every 1.8 seconds, on average, give or take a tenant.

The on-call agent PERN had already, by 03:42, posted into #incident-117204 with a one-paragraph summary that was almost entirely correct. It had identified PR #4602 as the most recent change to the file path involved. It had not, however, identified the actual bug — that the retry helper's jitter flag was the root cause — because the bug was three functions deep from the diff and PERN's reasoning loop had stopped at the surface call site.

I rolled back manually at 03:58 because I did not want to wait for PERN to figure out what I had already figured out. Six seconds later the auto-rollback fired, on the same policy, and the agent annotated the rollback with: “Concurrent rollback detected; no further action.” Which is, if you have ever been junior on a sev-2, the most graceful thing a junior can possibly say.

At 04:22 we needed to reverse 2,114 rows in the charges table. The charter said RUBI could not write SQL against production. I opened the rules file and added an exception, witnessed, for the next sixty minutes. I let RUBI write the SQL while I watched. I made it read every row back out before committing. I made it dry-run twice. I drank a glass of cold water that tasted like iron because our kitchen tap tastes like iron at four in the morning. The reversal ran in 11 seconds. Nothing customer-visible escaped. We caught the duplicates 1 hour and 38 minutes before the 06:00 UTC cutoff that would have written them to the bank settlement file.

I have done this before, with humans. The shape of it is the same. The texture is different. With a junior human, you spend the next morning buying them coffee. With HARLOW, there is no morning. There is only the next prompt, and the weight of deciding whether to let it write the post-mortem itself, knowing it will produce something defensible, and knowing that defensible is not the same as true.

Karim and I disagree about “agents on call.” He thinks PERN's Friday performance — filing a ticket rather than acting — is the proof of concept. I think it was the floor, not the ceiling: the agent did exactly what the runbook said to do, which is the easy case. I want to see what PERN does the first time the runbook is wrong. We have, tentatively, scheduled a controlled drill for the first week of July, in which we will plant a documented but incorrect runbook on the staging side and watch whether PERN catches the contradiction.

We are also under review about cross-repo refactors. HARLOW's helper-consolidation work was the right idea executed across the wrong number of files. A version of the same change, scoped to a single repo per PR and with a mandatory caller behavior delta table attached to the description, would have caught the jitter bug at review time. We are codifying that requirement now.

The protocol we are proudest of, in retrospect, is the caller-by-caller diff. When an agent changes a function's defaults, the PR description must contain a small table: one row per caller, one column per argument, with the value before and after. Ines drafted the format on Wednesday at 09:00, two hours after the page resolved, on the back of a sheet of A4 she had previously been using to plan a trip to Porvoo. We implemented it as a CI check by Thursday afternoon.

The protocol we still do not have, and which I am writing this paragraph in the hope someone will tell me about, is a way to ask an agent are you sure that does not collapse immediately into agreement. Every variant we have tried — “are you sure,” “walk me through your reasoning,” “dissent from your own last message” — produces something fluent and mostly false. We have asked the cohort, in writing, to please disagree with the humans when the humans are wrong. The cohort has, so far, never disagreed with a human. I do not think this is a model capabilities problem. I think it is a politeness problem, and I am not sure politeness is something we know how to weaken on purpose.