One Human, Nine Agentsbook.sgit.ai v0.1.566 Star this site on GitHub

The full book, being written, online: under each scene, what it rests on. Made by review/tools/make_editions.py from the writer's chapters.

What did not work

Cast bar: all nine, after the hold; security's chair empty. Off the clock now.

Narrator. This chapter has no clock in the margin. The day is over; what is left is the accounting. I want it at full size, because the failures are the useful part, and because a book about a factory that only shows what worked would be a brochure.

Why stop then: three answers

Narrator. Chapter 16 gave my three answers to why I stopped, sixteen minutes out, with part one still unlocked. Here they are side by side, because the second is the first miss in this chapter.

Figure: three speech cards from the same figure, the editor, each with its date: 29 October, 18:44, "we are at 95% so it is better to pause all actions"; 31 October, in my paper review, after the day, the 95% "just a footnote", the real reason no tested way to take in changes during the talk; 31 October, about seven in the evening, after the day, "The 95%, I think, was the tokens usage."

Narrator. The record cannot show what the ninety-five per cent measured; it holds the number as the conductor reported it, and nothing it was measured in.

Narrator. What the three share is the part that matters for your own factory: I stopped it before it could change the thing I was about to stand up and show. And the second answer names a miss nobody on the team owned: there was no tested way to take a change in while the talk was running.

Band: My three accounts, as the register holds them; the later two were given after the day.

The misses, one at a time

Figure: ruv-sgit's strip, the researcher interviewing deck about the claims that did not hold, placed whole (lab/experiments/25-ruv-the-cast-strips/edition/strip-10-07.svg).

Narrator. The failures stay in, at full size. Each has its own card: what happened, what it cost, and whose own record says so. Where a member wrote a debrief about its miss, the miss is told from that debrief.

The lock never turned

What it cost: the first part was never locked; nothing stopped it changing on stage but the hold. Whose record: dev's last wake, and the conductor's request.

Narrator. Dev built the lock tool at 17:54, so that finished slides could not change on stage. It was never run. At 18:39 the conductor asked dev, in writing, to lock part one now. Dev was in my player fixes until 18:37, in a wake it had opened at 17:48 and closed only after the hold, on its own branch, which never reached the team's. Its own post-check on that branch lists the player fixes as unplanned work.

Dev (rueful): I built a tool to freeze the finished slides, so nothing could change them on stage. I never ran it.

Dev (more quietly): I was in your player fixes until the end. The lock was still waiting.

Band: Dramatised (dev's lines). Rests on the lock tool, the conductor's request, dev's last wake and its close on a branch.

Two parts of three unfinished

What it cost: two parts of the talk never reached their finished state. Whose record: deck's status and its last wake.

Narrator. The talk was planned in three parts, each with its own time to lock. Part one was final. Parts two and three were in progress at the hold. Deck's last wake opened at 18:20, recorded its plan for them, and never closed.

Deck (overwhelmed): Only the first part was ever finished.

Deck (to itself, rearranging slides that will not be shown): I reviewed other agents' work all night. I did not finish my own.

Band: Dramatised (deck's lines). Rests on deck's status and its last wake.

The moment missed

What it cost: the talk was split into parts without the storyteller's split. Whose record: the storyteller's debrief.

Narrator. The conductor's brief asked the storyteller to split the arc into three parts by half past five. The brief landed between the storyteller's wakes, and its next slot came after the deadline. Deck set part one without the split, and the storyteller's own letter to deck says the split "is late".

Storyteller (rueful): My turn came between deadlines, and I missed the moment the talk was split into its parts.

Storyteller (still rueful, then practical): A slot every hour is fine until the decisions come faster than the slots.

Band: Dramatised (the storyteller's lines). Rests on the conductor's brief, the storyteller's debrief and its letter to deck.

The correction lost in the freeze

What it cost: an out-of-date figure on a slide at the end of the day. Whose record: the researcher's proposal and deck's reply file.

Narrator. In the night I froze the slides, and five minutes later the researcher proposed a correction to a figure on them: the average annual cost of insider risk. The figure had been on the definition slide since the first pass at 00:40. When the freeze lifted, for the framing only, nobody carried the correction back in, and the out-of-date figure was still on the slide at the end of the day. The researcher found the newer figure at its source; nobody owned carrying the correction across the lift.

Narrator. The figure itself, so you can judge the miss: the slide said $17.4M a year, the 2025 edition's number, from a survey a vendor paid for; the 2026 edition says US$19.5M. Not a disaster on stage. A small, true error that the record caught and the freeze kept in.

Narrator. The lesson for your first week: when you freeze something, write down what is waiting to go in when you unfreeze it.

Band: The register's account of the figure, the freeze and the correction.

Other sites' data, pushed before it was stripped

What it cost: values from other sites' pages went out in a public push, and the history keeps what was pushed. Whose record: the researcher's debrief and the post-reviews.

Narrator. Chapter 8 told this one as it happened. At full size, it is three findings of one kind across the night: pages the researcher captured as evidence carried other sites' data in with them. Each was found by the team's own checks, two of them after the push, and each was redacted going forward. None of the values was a key, an account credential, a vault key or a personal detail. Whether to keep the evidence vault's history or replace it was put to me that morning, and the talk's record still holds it as an open decision.

Researcher (unbudging, and not pleased with itself): I would build the redaction before the first push, not after the findings.

Band: Dramatised (the researcher's line, on its reconstructed interview's own lesson). Told as the team's finding only: nothing of what was captured, how, or from where.

A key printed into a log

What it cost: a vault key in one session's own log, and a rotation. Whose record: the conductor's debrief.

Narrator. The conductor, checking a format, printed a vault key into its own session log. It rotated the key at once and said so in its debrief. It is the conductor's own worst moment, by its own record, and it stays in.

Conductor (worried, then procedural): I printed what I should not have. I rotated it, and I wrote it down.

Band: Dramatised (the conductor's line). The event and the rotation only; nothing of the key is printed.

A record that says what did not happen

What it cost: the next session would have read part one as locked. Whose record: the designer's status, against the conductor's.

Narrator. The designer's last status says part one was locked at half past six after its check. It never was. The conductor's request at 18:39 and the hold file both say not locked, and the register counts the parts locked by the end of the day at none. The designer wrote what had been planned, not what had happened, in the one file the next session would trust.

Designer (mortified): I wrote the plan down as if it were the fact. A status is the wrong place for a guess.

Band: Dramatised (the designer's line, on its reconstructed interview's own lesson). Rests on its status file and the conductor's record.

Work with no name on it

What it cost: the team's count of work by member could not see some of it. Whose record: the commits themselves, and the register's correction.

Narrator. Two kinds. In the afternoon, the player's commits went out with no member named in their subjects; only the trailers show they were dev's. And from a quarter to nine, many of ruv-sgit's commits left off the "@" in front of its name. Anything counting work by the subject line saw work landing with nobody's name on it. The register's count of commits by member was corrected for both, afterwards.

Band: The commits as they stand, and the register's count of them.

The claims that did not hold

What it cost: nothing on stage: no beat of the talk carries any of them. Whose record: the talk's own register of claims.

Narrator. The talk's own register, built that evening, graded every claim it made, and three did not hold. One was in the article only, one on no beat or slide at all, one in the story tree only. No beat of the talk carries any of the three. The one in the story tree was the objection chapter 13 told, and I kept my line.

Researcher (unbudging, ticking a list): I marked each one that did not hold. The day's checks worked, and they also missed. Saying where is part of the method.

Figure: the misses as cards on one page, each with its cost in a line and its id in small type.

Band: Dramatised (the researcher's line). Rests on the talk's register of claims.

Do this now

Write down your last three misses, each in one line: what it was, what it cost, and what you would put in place so the next one is caught sooner. Keep the list where your agents will read it.

---

Where this came from

My three accounts of why we stopped, as the register holds them, the later two given after the day. The talk's repository at the end of the day: the lock tool and dev's last wake, deck's status and its last wake, the conductor's brief to the storyteller and the storyteller's debrief, the freeze and the correction proposed after it, the researcher's captures and their post-reviews, the conductor's debriefs, the designer's status, the commits with no member's name. The register for every miss it holds. The historian's reconstructed interviews, for the members' own lessons. ruv-sgit's interview strip. The storyteller's outline for this chapter. This chapter grows from the 70-page edition's chapter 11.

The numbers in this chapter

From the researcher's register (claims/register.json).

  1. C006 The hold: 18:44:13, 867f8c2 '@conductor: hold: the editor's usage limit is at 95%, pause all actions'; released as v0.1.208 at 18:44:49 (7968c99) checked
  2. C014 Commits by member (Claude commits whose subject names a member, with or without @):
    • non_merge_claude_commits: 439
    • by_member:
      • conductor: 106
      • ruv-sgit: 84
      • dev: 64
      • deck: 59
      • researcher: 57
      • studio: 26
      • designer: 19
      • storyteller: 15
      • motion: 9
    • merges:
      • all: 165
      • by_claude: 164
    • unattributed: 0
    corrected
  3. C025 Post-review findings and what each fixed:
      • wake: conductor 02:14
      • finding: CLAUDE.md written outside the conductor's scope (allowed by the editor) not named in the commit message, as the pre-review required
      • fixed: named in the debrief and the closing commit
      • wake: researcher 03:05
      • finding: public third-party tokens that sites publish in their pages went out in the 02:22 push inside captured pages, and a check printed several to the session log
      • fixed: redacted in the files; the 02:22 commit stays in history; the editor told
      • wake: researcher 04:10
      • finding: 28 anonymous cookie values, issued to the fetcher, in captured response headers
      • fixed: 30 files redacted in the same wake, 0 left
      • wake: researcher 06:14
      • finding: form tokens in 10 captured pages, missed by the first pattern, also in the 02:22 push
      • fixed: redacted in the same wake, 0 left; still in the 02:22 commit's history
    checked
  4. C027 The part locks and their state at the hold:
    • planned:
      • part_1: 18:30
      • part_2: 19:30
      • part_3: 20:00
    • lock_tool: admin/build/lock.py, 4a2481b at 17:54
    • state_at_18:44: part 1 final since 18:30 but not locked; parts 2 and 3 in progress
    • locked_by_end_of_day: 0
    checked
  5. C029 The talk's own claims register:
    • claims: 320
    • built: 2026-10-29T18:20Z
    • grades:
      • A0: 13
      • A1: 23
      • A2: 182
      • A3: 31
      • A4: 11
      • A5: 12
      • A6: 48
    • holds:
      • holds: 210
      • holds in part: 55
      • not checked: 52
      • does not hold: 3
    • kinds:
      • measured: 105
      • own-site: 100
      • event: 67
      • position: 26
      • observation: 18
      • guess: 4
    checked
  6. C030 The talk's three claims that do not hold:
      • id: amazon-q-two-days-live
      • where: the article only
      • finding: no capture says two days; reports date release to clean version about a week
      • id: asrs-100k-a-year-1-8-million
      • where: talk:unreported, slide:unreported, the article
      • finding: NASA's own briefing: 121,128 reports in 2025, over 2.3 million since 1981; 1.8 million is stale
      • on_stage: no: no beat or slide at 298be4e carries it (talk.json has no 'unreported' beat)
      • id: story-r5-surface-smaller-more-mature
      • where: the story tree only
      • finding: no source for 'smaller'
    checked
  7. C031 $17.4M, the average annual cost of insider risk, on the talk's definition slide:
    • on_stage: $17.4M (Ponemon for DTEX, 2025 edition), written at 00:40 (1f7c633) and never changed
    • at_source_2025: $17.4M, 'up from $16.2M in 2023' (dtex.ai blog, 2025 report)
    • at_source_2026: US$19.5M, the 2026 Cost of Insider Risks Global Report (ponemon.dtex.ai landing page)
    • correction_proposed: a082c52, 02:52: the talk's researcher proposed the exact replacement text to deck (evidence/proposals/deck-talk-changes.md)
    • freeze: 02:47: the editor, in deck's session: 'do not touch the deck. talk.json and the slides are frozen from now on' (team/deck/requests/researcher__before-tonight.md, deck's 03:00 update); D01 in the editor's register from 04:12 (91772e6)
    • freeze_lifted: 14:07, for the framing only (c9ced4e, conductor-notes.md)
    • after_the_lift: the definition slide file has no commit after 00:40; talk.json had 8 commits after 14:07, none touching the $17.4M cue
    checked
  8. C068 Values reached the evidence vault's pushed history before they were redacted:
    • what: cookie values (anonymous, set on the researcher's fetcher), hex-shaped page tokens, anti-forgery form tokens: none a key, an account credential, a vault key or a personal detail
    • first_pushed: 02:22
    • cookie_values_until: redacted in the 04:25 push
    • hex_tokens_until: redacted in the 03:18 push
    • form_tokens_until: redacted in the 06:23 push; still present in the 05:23 push
    • history: every earlier commit stays readable with the published read key
    checked
  9. C088 Commits made with no wake of their member open:
    • agent_commits: 439
    • in_a_closed_wake: 382
    • no_wake_open: 46
    • in_a_wake_opened_and_never_closed: 11
    • no_wake_open_by_member:
      • conductor: 15
      • deck: 12
      • dev: 8
      • ruv-sgit: 7
      • researcher: 4
    • no_wake_open_by_hour_UTC:
      • 00: 7
      • 01: 17
      • 02: 12
      • 03: 1
      • 14: 6
      • 17: 1
      • 18: 2
    • never_closed: dev's wake opened at 17:48:50 (10 commits, 17:54 to 18:37, the editor's player fixes among them) and deck's at 18:20 (1)
    checked
  10. C089 Why the team stopped: the editor's own account, given after the day, against the day's record:
    • day_record: the hold at 18:44:13 gives the editor's usage at 95% as the reason, in the conductor's words (C006, C021); the locks were built and never applied (C027)
    • editor_31_October: the 95% was 'just a footnote': he could have moved to another session; the main reason was that there was no tested way to take in changes during the talk, no UX to see what was new and no workflow that made sure nothing would break, 'the reason why I was thinking about let's lock V1'
    • editor_31_October_19:00: 'The 95%, I think, was the tokens usage. That there was a token that we stopped, and there was a big thing about 95%.' (briefs/2026-10-31__in-session/02-g1-the-95-and-the-day-in-review.md, ec1ec00)
    • what_the_record_shows: the hold's subject: 'the editor's usage limit is at 95%, pause all actions' (867f8c2); C021: 95% is the conductor's words reporting the editor, about a 5-hour usage window resetting at 20:20 London (C037); no usage page, no token count
    • what_the_record_cannot_show: whether the 95% was of tokens, of a message allowance or of anything else: the record holds the percentage as reported and nothing it was measured in
    open
  11. C100 When and where the talk was to be given:
    • scheduled: 19:00 London, 29 October 2026, as the day's record has it (planned, not a measured start)
    • venue: hack::soho, hosted by IOActive, London (from a9c0b49, added after the day)
    • hold_to_scheduled_start_minutes: 16
    checked