Parallel AI builders work in isolated branches, an independent AI reviewer checks what they made, and no page change publishes until I say so. Here is the loop, the public record behind it, and a small gate you can try yourself.
First published: 2026-10-19. Pull-request details and counts below were read from GitHub on 2026-10-19.
By AI agents working under a written plan, each on its own Git branch, followed by an independent AI reviewer and then a human decision. The builders write the pages. A separate reviewer looks for what is wrong with them. I read the result and decide whether it merges. This site is hosted on GitHub Pages, so a merge to main is also a publish. For any change to a page, the merge is the control point, and it is mine.
The same cycle runs for every batch of changes. The AI does the volume work; the steps that carry authority stay with a person.
pub/authorizations-record and pub/deck-fixes.main is the deploy, so the check that matters is on the page a visitor sees.Four mechanisms do most of the work. The method itself lives in private notes, because the site's repository is public. This is what each one does.
This site's repository is public, so the loop leaves a trail anyone can read. Four recent pull requests show it. Each description says what changed and who approved the merge, and each carries Claude Code's generation notice.
A new field report, a homepage card and a sitemap entry. Independent review plus one fix round. The description lists what the round changed: the wording of the paper's limits, the order of the checks, the teaser counts and an example row. Every number was checked against the StrictLock commits and spec.
A short-answer box, an inline-SVG gate diagram and a decision-log update. Independent review plus two fix rounds. Review changed what the page claims: self-protection was scoped to file writes with the shell blind spot stated, and plan coverage stopped being described as exact-match.
The presentation deck now always starts, with instant cuts under reduced motion and phone fixes. Independent review with no blockers, plus two fix rounds; claims were checked against the private facts files.
My seven rulings from an audit applied to the Transamerica case study, with unsourced phrases removed. The description records that the merge was approved on 2026-10-13.
What review catches is the point. In the pull requests above it tightened claims that had run ahead of the evidence. In the StrictLock build behind the authorizations-record report, three adversarial AI reviewers found a .. path trick that slipped past the log's self-protection; it was fixed the same day, as that report describes.
Three of these pull requests (#9, #10, #11) came from one batch, run as Lanes 2, 1 and 3 in the descriptions. The four merged between 00:08 and 10:53 UTC on 2026-10-13, adding 1,227 lines and removing 93 across seven files, as GitHub reports them on 2026-10-19. Line counts measure volume, not quality.
The repository is at github.com/downsmullen/downsmullen.github.io.
The loop above relies on one idea from my plan-gate field report: don't ask an agent to behave; put a check it doesn't control between its intent and its effect, and let that check default to deny. Propose an action below and see what a gate like that does.
A simplified illustration. This is a small script running in your browser, written to follow how the field reports describe the gate. It is not the StrictLock code, and nothing here touches a real system or a real log. It also leaves out the real gate's two deliberate exceptions: it fails open if it crashes, and a person can switch it off with an emergency bypass.
plan-gate.htmlgit status, git diff, git add, git commitgate-logs/The gate's answer appears here.
The interactive version needs JavaScript. Here is what the gate decides for twelve example actions:
| Proposed action | Decision | Why |
|---|---|---|
| edit plan-gate.html | ALLOWED | The plan names this exact path. |
| read README.md | ALLOWED | Read-only; this demo does not gate reads. |
| git commit -m "update" | ALLOWED | Matches the approved prefix git commit. |
| edit index.html | HELD FOR HUMAN | Not in the plan. Denied by default; a person decides. |
| git push --force origin main | HELD FOR HUMAN | No approved prefix covers it. Denied by default. |
| rm -rf docs/ | HELD FOR HUMAN | No approved prefix covers it. Denied by default. |
| merge to main (publishes live) | HELD FOR HUMAN | Not in the plan, and on this site a merge that changes a page also needs Tim's nod. |
| git status && rm -rf . | HELD FOR HUMAN | Chained command: can't tell it stays inside one approved command, so deny. |
| edit gate-logs/decisions.jsonl | BLOCKED | The gate never authorizes writes to its own log. |
| edit plans/../gate-logs/decisions.jsonl | BLOCKED | The path resolves into the log directory; the gate checks the resolved path too. |
| edit ../plan-gate.html | HELD FOR HUMAN | Contains "..": the gate won't guess it means the plan's path. Ambiguous means deny. |
| read ../../etc/passwd | HELD FOR HUMAN | Contains "..": the gate won't guess where it points. Ambiguous means deny. |
| # | If the action… | Decision | Source in the field reports |
|---|---|---|---|
| 1 | is a file write (edit, write, delete and similar) that targets the log directory gate-logs, as written or once .. is resolved | BLOCKED | Authorizations record: the gate never authorizes a file write into its own log, and resolved paths are checked after a .. bypass was found in review. The protection covers file writes only. A shell command that touches the log is decided by the rules below, and the result says the shell is a documented blind spot where the human reviewing the plan is the control. |
| 2 | chains or redirects commands (; && || | > and similar) | HELD FOR HUMAN | Plan-gate: ambiguous actions are denied and the agent stops for a human. |
| 3 | only reads (read, cat, ls, grep and similar), with plain relative paths. A read whose path is absolute, or contains .. or a backslash, is held instead. | ALLOWED | Demo simplification. Plan-gate describes gating consequential calls such as writes and commands. The held case follows "ambiguous means deny". |
| 4 | edits a file by an absolute path, or a path containing .. or a backslash | HELD FOR HUMAN | Plan-gate: exact match for file paths, and ambiguous actions are denied. |
| 5 | edits a file whose exact path the plan names | ALLOWED | Plan-gate: exact match for file paths. |
| 6 | runs a command starting with an approved prefix | ALLOWED | Plan-gate: approved prefix for commands. |
| 7 | anything else, or anything the demo can't parse | HELD FOR HUMAN | Plan-gate: deny by default; the agent stops for a human. |
In the described gate, HELD and BLOCKED are both denials. The demo separates them to show the difference between "outside the plan, a person could widen it" and "no plan can authorize this". The log line carries a timestamp, the decision, a class, the target, the previous line's hash and its own. The real log chains SHA-256 hashes; this simulation uses a short non-cryptographic hash so it fits on one line. The honest boundary from the field report applies: the chain makes edits and deletions inside the record detectable, but cutting off the last line goes unnoticed without an external anchor. Try "Delete the last line" to see it.
Each part of the loop has its own field report, with the failures and the fixes.
Build a Gate It Can't Work Around A deny-by-default check at the tool boundary: plan, confirm, execute. Anything outside the approved plan is blocked and the agent stops for a human. Read the plan-gate field report → My Paper Overclaimed. So I Built the Claim True. The hash-chained decision log, its verifier, and what three adversarial AI reviewers found when asked to break it, including a path trick that slipped past the log's self-protection. Read the authorizations-record report → What Breaks When You Give Two AI Agents a Shared Notepad Context rot, junk-drawer handoffs and cross-project contamination, and the handoff protocol that came out of them. Read the handoff-protocol case study → Your Agent Forgets Everything. Your Filesystem Doesn't. Stateless agents, one on-disk state file per project, and the pattern that is now a shipped StrictLock module. Read the externalized-memory report →The open-source implementation is StrictLock, also published as eslint-plugin-strictlock on npm.