WAYS OF WORKING · DEMO 05 NINO CHAVEZ

The product that files
its own tickets.

End users type free-form feedback into a live tournament platform. An LLM judge triages it on a cron, files GitHub Issues, and an agent implements the safe ones — with the autonomy boundary written in deterministic code, and a human holding the only merge key.

#13Fix typo in pricing FAQ cancellation answer: 'you' → 'your'

bugfeedbackready-for-agentarea:contentpriority:P5

or scroll to advance · to go back

02 THE LOOP

Four stages, each on its native substrate

The design principle from the ADR: don't build a custom work queue when a better one exists. Each stage runs where that kind of work already lives.

Capture
feedback table + API + a widget in the product; reporter identity resolved server-side, never client-asserted
the product
Judge
LLM classifies each item on a cron — category, subtype, priority, disposition, dedupe
llm on cron
Work queue
GitHub Issues, labeled: lane + area + priority. PR linkage, CI, review, audit trail — free
github issues
Implement
a GitHub Action fires on the ready-for-agent label, implements, opens a PR
github action

And the rule that makes the whole thing tolerable in production: the Action never merges. PR review is the human gate, and it is load-bearing.

03 THE GATE

The model's opinion is advisory

The judge proposes a disposition — but what actually reaches the autonomous lane is decided by applyAutonomyGate, a plain function. Its rules, from the source:

questions & kudosnever become actionable issues — forced out regardless of what the model said
enhancementsalways human-gated. New behavior is never built unattended
bugsauto-PR only when the subtype is on a two-item allowlist: ui, content. Logic, data, auth, billing — human lane, always
duplicatesmust point at a real open item, or they're demoted to needs-info
priorityclamped to range in code — even the model's numbers aren't trusted raw

The gate is also pinned by an invariant test — its behavior asserted per subtype, so a refactor can't silently widen what auto-PRs. The gate guards the product; a test guards the gate. That's demo 03's discipline applied to autonomy itself.

04 THE DESIGN FIX

Deciding and coding are different gates

Version 1 had one gate — "does a human need to code this?" — and force-routed every change request to the human lane. The ADR records the correction verbatim: "a real team separates 'a human must DECIDE/DESIGN this' from 'a human must CODE this.'"

needs-info

The reporter must clarify before anything can happen. The loop asks instead of guessing.

needs-product

Is this worth building? Does it fit? Product answers whether.

needs-design

How should it look and work? Design answers how. Kept distinct from product even when one person wears both hats — different inputs, different next action.

Decision-lane items file a tracked issue so a human picks them up — but they are never labeled for the agent. Nothing undecided or undesigned gets implemented unattended.

05 IN THE WILD

Six real tickets, every lane represented

The loop's actual output — real issues from the production repo, titles verbatim. Watch the gate sort them exactly as coded:

#13Fix typo in pricing FAQ: 'you' → 'your'

bug · content · P5ready-for-agent

#9Footer copyright year shows 2024 instead of current year

bug · content · P5ready-for-agent

#10Pool standings tiebreaker ignores head-to-head results

bug · logic · P3ready-for-human

#25TypeError: standings page blank — undefined 'wins' in derivation

bug · logic · P3ready-for-human

#20Live scoreboard: low-contrast score text on mobile

bug · ui · P3needs-design

#11Live win-probability display during matches

enhancement · P5needs-product

Content typos went to the agent. Scoring logic went to a human. The contrast issue went to design — a fix exists, but which fix is a taste call. The feature request went to product. Nobody hand-sorted these.

06 THE RUN LEDGER

The best thing it ever did was nothing

One hundred runs of the agent workflow, straight from CI history:

skipped
96
failure
2
cancelled
1
success
1

96 skips are the gate working

The workflow wakes on every issue event and declines everything without the agent label. The skip column is what "the autonomy boundary holds" looks like in CI history — boring, by design.

The one success fixed nothing

The single successful run investigated the pipeline-test typo — and found the described typo didn't exist. The closing comment, verbatim: "the agent correctly declined to fabricate a fix. Pipeline verified end-to-end."

The lesson: an autonomous lane you can trust is one that can conclude there is nothing to do.

07 HONEST LIMITS

Pilot-scale, and honest about it

The volume is small

Six issues, a pilot-stage product. The value demonstrated here is the shape — the lanes, the gate, the substrates — not throughput. The shape is what transfers; the throughput comes with users.

It took three tries

Two failed runs preceded the one success, and the rollout hit real deployment friction — platform secrets that only apply on rebuild, a cron pointed at a stale deployment. Unattended loops multiply the cost of wiring mistakes.

Trust is scoped, not earned-then-total

The allowlist is two subtypes wide after a month in production. Widening it is a code change with an invariant test watching — a deliberate decision with a diff and a reviewer, never a drift.

08 YOUR VERSION OF THIS

Write the boundary before the automation

If you never touch code

The question for any AI automation is not "is it smart enough?" but "what is it allowed to do, where is that written, and who reviews the output?" If the answer is "the AI decides," walk away.

If you're technical

Let the model classify; never let it authorize. The autonomy boundary is an allowlist in code — small, testable, reviewed — and the model's output is advisory input to it.

If you build systems

Separate the decision lane from the execution lane. Use substrates that already exist — an issue tracker gives you linkage, CI, review, and audit for free. And keep the merge key human.

product DB + API · LLM judge on cron · GitHub Issues · GitHub Action allowlist: ui, content — nothing else auto-PRs the Action never merges
Colophon. All artifacts verified against source on publication day: gate rules read from the live service code, issue titles and labels pulled from the production repo, the run ledger counted from 100 real workflow runs, the ADR and closing comments quoted verbatim. No user-submitted feedback text or reporter identity appears anywhere on this page. Demo 05 in the ways-of-working series — the enforcement discipline underneath it is demo 03.