NOLA Build & Design· residential construction, Charlottesville VA · shared with permission
Ten days in, their software builds, reviews, and ships itself.
Freehold stood up an estate for NOLA Build & Design: a company brain their whole team queries through Claude, and a supervised fleet of AI agents that turns spoken frustration into shipped software — with no human reading the diff, fourteen times in one day. Every number on this page is measured from the system's own git history and journals, and the failures are reported next to the wins.
Not a chatbot. A place where the company's knowledge and its software staff live.
Three things, joined: a brain — every fact the business knows, with provenance; a front door — the team's own Claude, wired to that brain; and a factory — agents that maintain the estate and build what the team asks for, supervised around the clock. The client company runs on it; Freehold engineered it.
Anyone on the team can drive the factory. Today.
The part that changes how a business relates to its software: friction goes in as a sentence, working software comes out — often the same day.
The factory pedal. Claude files it into the backlog as a formed work item; the supervisor prioritizes it; the engine builds, adversarially reviews, and ships it. Ten build slots a day.
Steer the ingestion engine in plain English. Directives from leadership jump the queue on the nightly knowledge passes.
A rulings ledger with dates and verbatim words. The doctrine: a decision not in the brain didn't happen.
Open tasks are structured objects with owners and due dates — each linked to the page that created it.
Process pages pair per the manual with as practiced — the reality gap is first-class data, not an embarrassment.
An opportunity register mined from meetings, email, and documents — pain captured with provenance and an honest confidence score.
One weekend, measured
At 02:14 Saturday the engine merged its own work to production for the first time: picked the top-priority item at 02:00, built it in an isolated environment, passed a blind review it couldn't see the answers to, merged. Fourteen minutes, zero humans awake.
Commits per day
agents and one engineer, combined · last 11 days · July 2026
*Sunday still in progress at publication. Saturday's 306 includes the engine's builds, its review artifacts, and the 5-minute knowledge sync — every commit attributable.
Knowledge pages, last 48 hours
placed, linked, provenance-stamped · sampled every 5 minutes
+182 pages in 48 hours — capture drains continuously, not in batches.
Unprocessed inbox — captured but not yet placed
the honest ingestion metric: is material actually moving?
Saturday afternoon the supervisor ordered a bulk placement pass — 66 notes left the inbox in one afternoon.
98 items filed. 42 shipped. The queue drains this week — autonomously.
Every item ever filed, by state
Open items, last 48 hours — the honest chart
the queue GROWS: discovery outpaces even this engine
Every incident review, gap analysis, and user request files new work. The response, ruled Sunday morning: the build cadence doubled to ten slots a day.
Drain math at the doubled cadence
Velocity is measured from git merge history, never assumed from the slot count. This week the engine also ships its own scrum-master dashboard: live burndown, inflow vs outflow, and a standing "days of work queued" number.
The part that makes autonomy trustworthy instead of terrifying
The estate may change itself freely — and may not change the locks on its own doors, nor the judge that decides what merges, without a person. That sentence is enforced in code, not in a policy document.
Strictly by priority. A standing critical can summon a build off-schedule.
Fresh checkout, capped compute budget, no access to the live system or its own judge.
The reviewer sees the acceptance criteria and the diff — never the builder's claims — and must find independent evidence.
Deterministic. Runs the 113-check suite from the last human-approved copy — a build can never grade itself with a weakened examiner.
Auth, deploy configs, and the judge itself always stop here — a pull request lands on the engineer's phone.
The suite re-runs in CI; passing merges auto-deploy to production hosting.
Why the judge can't be bribed
The merge gate, reviewer, test suite, and build worker are all inside their own protected boundary — the engine cannot modify the thing that judges the engine. Changes to the judge get more scrutiny than normal code: independent reviewers plus a replay of every historical gate decision, where any decision flipping toward MERGE fails the change. Reference-monitor thinking, applied to an AI fleet — the part most autonomous-agent demos skip.
Knowledge that can't lie about itself
Every fact in the brain carries an authority tier (immutable → canon → firm → data → ideation), its source, and a confidence score. AI-generated text enters at the bottom tier no matter how polished — it rises only when a human ruling or a raw document corroborates the specific fact. Eloquence is not evidence; the system is built to remember that even when its humans forget.
Our best failure yet — and what it bought
Friday night the estate froze for nine hours. By Sunday lunch the whole reliability program a mature operation needs was designed, ruled, and queued. This is the section a fellow engineer should read twice.
A nightly ingestion pass hangs mid-crawl on a 26,000-file re-listing. Its log goes silent; its lock file stays.
Nine silent hours. Every scheduled build yields to the stale lock and forfeits its slot. The supervisor raises critical after critical on a dashboard nobody was told to look at — perception without remediation authority is wallpaper.
The humans notice. Hand recovery. New standing mandate for the supervisor: its job above all else is that last night cannot happen.
Four remediation items filed — one per causal layer. The first (locks name their owner and die with it) was built by the engine and merged to production the same morning. The general machine — runbook registry, incident swarm mode, automated root-cause analysis, weekly chaos drills, an off-site dead-man watchdog, an SLO board — was designed, ruled, and queued by 09:00.
Follow-up investigation found the "dead" pass had been alive and wedged for 12 hours. The root-cause analysis was corrected in the open and two more defects were filed from the correction. The estate keeps honest books about its own mistakes.
This week the engine builds, unattended
| PR-based shipping | held changes become pull requests approved from a phone — the notification rail went live Sunday morning |
| Runbook registry | every alert carries a machine-executable remedy or a named owner — enforced by lint |
| Swarm mode | incidents trigger a declared emergency state: 60-second repair loop, break-glass powers over runtime state only |
| Automated RCA | the supervisor reconstructs incident timelines from its journals and files the fixes itself |
| Chaos drills | weekly fire drills replay past incidents to prove fixes stay fixed — Friday night is fixture #1 |
| Scrum & SLO boards | live burndown and service-level objectives, charted — regressions visible as slope, before they're incidents |
SLO ambitions — measured, charted, owned
| Objective | Target | Today |
|---|---|---|
| Scheduled-pass success | ≥ 99% | recovering — Friday cost a night |
| Critical-alert MTTR | < 30 min | 9 h worst case, once |
| Fix-path health | ≥ 95% | unmeasured → drilled weekly |
| Knowledge dwell, median | < 24 h | days → hours after the drain |
| Silent stalls | zero | the entire program above |
Targets become charts this week; then a breach is just another alert that carries its own remedy.
Your business could have an estate.
Everything on this page was stood up in ten days, for a real company, on commodity infrastructure — by one engineer with a reliability director's day job and a fleet of well-supervised agents. None of it is demo-ware, and the safety engineering is the point.