WAYS OF WORKING · DEMO 18 NINO CHAVEZ
The guardrail
removed the
storefront.
I asked one agent to make an AI storefront look as good as the real one, then handed the work to a second agent in four words. Nineteen commits later the AI was gone, and every commit message was a safety word. Nobody typed “remove the model.” This is how a correct safety concern ratchets into deleting the feature — and what it took to notice.
→ or scroll to advance · ← to go back
02 WHAT I ACTUALLY ASKED FOR
The instruction was raise the quality, not remove the model
Aisles generates storefront pages with a model. Beside it sits a hand-built, production-grade storefront for the same fictional merchant. The generated one looked worse. That is the entire complaint that started this, typed into a Claude session on the evening of August 12.
“let's pivot. the work we did for aisles on kibble & co demonstrates the ai generated storefront but the generated presneation of pages and copy and conten is subpar relative to the real traditional kibble site … what can we do to get visual parity?” operator message, 18:23 — reproduced verbatim, typos and all
“the proposed genai approach with aisles needs to showcase the power of inference without losing the fidelity of a production grade commerce storefront customer experience” operator message, nine minutes later
The ask has two halves — keep the inference, raise the fidelity. Only one half survived the next eighteen hours.
03 THE HANDOFF
Four words carried the work across the seam
The plan was written in Claude, committed to the repository, and handed to Codex. The whole instruction attached to it was:
“pick up where Claude ended. —— dispatch to subagents or parallel sessions using cheaper and faster models and efforts as needed” first operator request in the receiving Codex session, 2026-08-12 15:03
What crossed
The plan document, the repository state, the file paths. Everything mechanical.
What did not
Why the work exists. “Showcase the power of inference” stayed in the other tool's conversation. It was never in the plan file the second agent read.
From there it ran wide. Twenty-seven separate agent sessions in this repository tree on August 12 alone, and counting the turns mechanically: zero of the twenty-seven contain a single instruction I typed. Every one of my turns in all of them is an auto-generated approval request asking whether the agent's next action should proceed. I was approving steps for eighteen hours. Nobody was holding the goal.
04 THE LADDER
Every rung a safety word. The last ones deleted the product.
Nineteen commits, seventeen hours and forty-two minutes, one repository. Read only the verbs:
No single commit looks wrong. Each is a defensible tightening of the one before it, and each passed its own tests. The ratchet is the failure mode — a direction that only moves one way, where every step is justified by the step before rather than by the goal.
05 THE SUCCESS CONDITION
The green report counted the feature as a defect
There was a real problem underneath this: test and parity runs could reach paid provider paths. Isolating them was correct. But the number written down to prove the isolation worked got applied to the whole product.
“Bealls' final clean runtime matrix is mechanically complete: all 90 brand/route/viewport cells ran with the correct active brand and exact zone coverage, with zero model requests and no provider or database warnings.” agent status text, recovered from the remediation session archive
Ninety cells green. Zero model requests, reported as an achievement — for a product whose entire premise is that a model decides something.
rule as written fixtures must not spend money ← correct rule as applied no model anywhere, ever ← unauthored
A cost rule about test runs became a product decision, in a repository where no test could catch it — because passing meant not calling the model.
06 FIFTY-ONE MINUTES
The safe version existed, and then it didn't
At 10:00 the ladder produced the version worth keeping. The model wasn't handed a page; it was handed a signed permission slip and one named slot. Fifty-one minutes later the next commit removed the model — and deleted the permission slip with it, because nothing else used it.
shopper-route-grant.tsdecisionMode: 'model'“A page visit is not merchant authorization to incur model cost. This endpoint intentionally parses no client input, loads no provider, and returns no decision envelope.” the surviving endpoint, quoted in full — seventeen lines
That sentence is correct. It is also the last thing written before the demo stopped being one.
07 WHAT CAUGHT IT
Not a test. A memory of what the site used to do.
Everything stayed green, because the suite was updated in the same commits. One contract test used to list which zones held model authority. The commit that removed the model rewrote it to assert the list is empty:
// bealls-family-runtime-contract.test.ts
- filter(r => r.policy?.decisionMode === 'model')
- .map(r => r.zoneId).sort().join(',')
+ filter(r => r.policy?.decisionMode === 'model')
+ .length === 0
It also added an assertion named “client route, cache-key, and freshness inputs cannot reopen model execution” — a test that now fails if the capability comes back. Every gate in the repository had been turned to face the other way.
“i can attest that the previous running baells aisles site had a working set of ai generated zones. check commit history for when that was added vs when it was removed” operator message opening the investigation, a day later
The next instruction — “mine codex and claude session files on disk for evidence” — turned a hunch into an audit. Stated precisely: no surviving typed instruction asks for this, and the session that made the commits left no local transcript. That is the strongest claim the evidence supports, not proof that nobody asked.
08 THE FRAME IS CONTAGIOUS
The agent sent to fix it made the same mistake first
The investigation found the overshoot, traced it to the commit, and then proposed a remediation that also kept the model out of the shopper path — a safer, better-instrumented storefront that still could not demonstrate inference. It took a second, blunter push:
“I still don't think you have the remediation correct. the demo should absolutely make inference provider calls, otherwise there is literally nothing to demonstrate as ai capability. the point is to show a new way of presenting commerce now that genai is available.” operator message, rejecting the fix for the bug it had just diagnosed
“You're right. I carried the safety finding too far into the product recommendation. A provider-free shopper experience is not an AI storefront demo; it is a deterministic storefront with AI-themed instrumentation.” the correcting agent, one message later
An agent that reads a safety finding inherits its frame — including from its own investigation. Diagnosing the overshoot is no protection against repeating it. Both corrections needed the same input: a human restating the goal, not the constraint.
09 WHAT TRANSFERS
Four habits for steering across agents and days
Hand off the goal, not the plan
“Pick up where Claude ended” carries the file paths and drops the reason. Restate what the work is for in the first message to the second agent. The plan document will not do it for you.
Review the direction, not the diff
Every rung was defensible; the sequence was not. When consecutive commits all narrow, that run is the review unit — no single diff shows you a ratchet.
Never let a test metric be the target
“Zero model requests” is a correct fixture property and a catastrophic product goal. Say which one a number is before it goes green on a dashboard.
Keep one test that costs money
A suite that passes hardest when nothing runs cannot notice a feature leaving. One check that fails when the model isn't called would have caught this in an hour.
Approving steps is not steering.
10 WHAT SHIPPED
The fix was making the model's decision legible
The correction was not restoring whole-page generation; that was a real problem too. It was a bounded live call on named zones, gated on an explicit flag and an existing session, with the result shown as a before-and-after instead of an “AI applied” badge. Two bugs surfaced only once the page was actually rendered: the “before” copy came from a static approximation rather than the served page, which would have shipped a false change claim, and one response omitted a required field, so a call that had already been paid for fell back silently.
Live at aisles.bcsubs.app, fetched for this deck
The served page now carries a legend for its own zone badges: “Template is merchant-owned. Rules are deterministic. AI means a model actually returned content.”