Ephesus keeps an unusual amount of its own history. Requirements live in a specification,
decisions in append-only records, design in a description document, and every milestone
leaves an implementation record behind it. When those documents disagree with the code, the
code is wrong.
327commits
26decision records
197test files
106documents
53implementation records
11days
Counted from the repository on 5 September 2026.
The method
A claim without evidence is not done
The recurring defect of this codebase is a check that cannot fail.
That sentence is from the project’s own build log, written after five separate instances
were found in a single day. A coverage figure that rose while the wiring stayed untested. A
matcher for claude auth status that looked for phrases the CLI never emits —
forty-five green tests, every one feeding it strings we had written ourselves. A suite
reporting green over 1,406 lines that nothing in the application could reach.
What followed was mechanical rather than cultural, because a resolution to be more careful
is exactly the kind of check that cannot fail:
A wiring seam with no test is a defect, not a gap. A package’s evidence names the production call path — file and line — or records that there is none.
Every production module must be reachable from an application entry point. A script walks the import graph from the three real entry points; a deliberate exception is allowlisted with the decision that made it deliberate.
An engine adapter may not match on output this repository has never seen. Every probe is backed by a capture from a real installation, with its command, version, platform and date recorded — or waived in writing, with the reason.
Coverage floors are per subsystem, and they only rise on corroborating runs. A single number over a whole repository is the classic check that cannot fail.
How milestones close
On a run, not on a checklist
Every milestone is audited by two independent passes before it is called done: one that
verifies by executing — running the commands, the suites, the app — and one that checks the
diff against the documented design. Neither trusts the implementer’s account.
Those audits have caught real defects at close, not hypothetical ones:
A research brief citing a commit that existed in no repository. The record was amended and the chain re-proven end to end against a remotely verifiable pin.
A ledger column quietly wrong, fixed with a named regression test.
A spoken refusal that confirmed the very gate it should have blocked.
A Pixi initialisation failure that was silent. It now surfaces a visible “floor unavailable” state, because a silent fallback is an invariant violation.
A Stoa brief. Every finding must cite a path at the pinned commit, or the brief is refused
before a human reads it — which is what caught the citation that pointed nowhere.
The milestones
What each one actually settled
M0
Skeleton
Electron shell, the preload bridge, a real PTY vertical, the floor, app state. Closed by a two-agent audit: ten execution checks and a design-conformance pass.
M1
One real agent
A single agent CLI under management on both data planes — the process, and the record of what it did.
M3
The floor becomes true
Stations that are facts rather than decoration; the breaker armed; gates that actually hold work.
M5
The accountable company
A review task is mechanically unclosable until its deck is archived. A new dependency is held at the choke point until a memo exists and is verdict-ed. Briefings refuse to render a sentence without a resolvable reference.
M5b
The learning company
The Stoa lands: registered sources, pinned commits, read-only researcher plans, and briefs whose every finding must cite a path or die.
M6
The floor’s face
Citizens at spec, stations, act-coloured envelope flights — and the milestone that shipped 1,406 lines nothing could reach, which is where the reachability check came from.
M7
The outward missions
Skeleton Crew and Front Office: the company watching something real.
M8
The company you can leave running
The hardening milestone. Coverage baseline and the seam rule; a quit path that actually runs; a degradation channel where every give-up is visible and countable; log-derived surfaces reading the whole book instead of its oldest 500 entries; every hire in its own checkout, and its own engine install.
The company’s primary mission is its own improvement
Improvement proposals rise from the company’s own operating records, carry a falsifiable
success metric before any human sees them, pass the same memo and gate machinery as any
other change, and are measured after they land. Every outcome stays in the ledger —
including the rejections and the rollbacks.
The Gymnasium. A proposal without a falsifiable metric never reaches a human; verdicts are the architect’s alone; authority-widening is refused before an approver could say yes.
