Three days ago we told you about the week the weights first moved — the routing formula that had been sitting there unused, and what it looked like when it finally learned something. That post undersold how much else happened in the same window. So: the rest of it, with the same rule as always — numbers we didn’t write ourselves, or it doesn’t count.
The sweep
We ran a security audit against everything the system had shipped, and it found sixteen ways in that shouldn’t have existed. Not one giant hole — sixteen small ones, the kind that accumulate when a system grows faster than anyone reviews it. Claim front-running on payouts. Missing human-presence gates on money-moving receivers. Webhook doors that failed open when a signature didn’t verify. Cross-tenant reads that trusted a body parameter instead of the session. A query-escaping gap that let a crafted string reach the database’s own query language.
We closed all sixteen. Then, because a list of patches is not the same thing as a system that can’t be reopened the same way next month, we built work-contract — a validator generated directly from the schema, not hand-maintained rules that drift from the code they’re supposed to police. It started as a gate on specific routes. By the end of the three days it sat at the universal dispatch point — the one place every request already has to pass through — so the guarantee isn’t “we remembered to add the check,” it’s structural: every page inherits it whether anyone thought to ask for it or not.
Midway through, six EVM coupon signers were still using a legacy signing scheme with a subtler forgery surface. Migrated all six to EIP-712 typed signing in the same pass. The theme of the three days, if it has one: stop writing rules that a future engineer can forget to apply, and start writing shapes that don’t have the seam in the first place.
Two new senses
Two capabilities went from spec to live in this window, and both are, in a real sense, sensory organs the system didn’t have before.
Compass is a semantic bearing check that sits in front of every agent model call. Before it, an agent request went straight through — no notion of whether the request was actually still on the mission it was given. Compass embeds the live conversation, compares it against the agent’s declared intents, and refuses when the two drift too far apart. The interesting part was calibration: our first instinct — admit on raw cosine similarity — turned out to be fail-open. A crafted injection scored 0.80, comfortably inside any sane threshold. What actually discriminates is the margin between the top intent and the runner-up, calibrated against a real embedding model (bge-small) rather than a number that looked right on paper. Final threshold: 0.045, needs at least two intents to even engage. We ran it shadow-mode first — warn, don’t block — watched it on live customer agents, then flipped it live with a canary and an on-chain mint recording the calibration run. It’s opt-in per agent and fails closed by default: no declared intents, no gate, nothing silently degrades.
Brain is the other one — a real ingestion edge from Google Drive into the corpus agents actually read from at answer time, not a demo pipeline. The detail worth keeping: the write path is gated under the same billing-lockout switch that governs everything else money-related. A workspace behind on billing can’t grow its corpus either. We don’t carve out exceptions for the new stuff; new stuff inherits the same kill-switches as old stuff, or it doesn’t ship.
Memory got its second phase in the same window — one pipe, one subject, both read and write paths reconciled, with a scope filter added to recall so what a workspace remembers doesn’t leak sideways into another workspace’s answers.
Money that settles itself
The biggest single thread was an entire affiliate and rewards economy, built and then actually settled on real infrastructure — not a spreadsheet describing what would theoretically happen. Affiliate program core, multi-chain escrow (EVM and Solana legs with honest per-chain atomicity — we did not pretend one chain’s guarantees applied to the other), a PPC budget with a velocity cap, a wallet-emission path with a sealed lifecycle guard, a fraud-checked network directory, and market-settlement that books commission and closes the loop with a mark on success and a warn on dispute.
Five separate promises for that stack were minted and settled kept, on-chain, in the same three days — with a rule we built in deliberately: the maker of a promise is never its own oracle. Whoever proposes the deal doesn’t get to grade whether it was kept. Rewards shipped alongside it: six of six kill-switches green, live on Sui testnet, real points redeemable for real value rather than a loyalty-program numbers-go-up screen.
The scorecard that fired one of its own questions
The self-improving loop got an eight-dimension code rubric this window — the thing that scores every closed cycle on security, stability, simplicity, structure, speed, integration, reuse, and test coverage, feeding a trend line back into what gets worked on next. One of the dimensions was designed as a hard gate — fail it, the cycle doesn’t close, no exceptions. Partway through calibrating it against real closes, the data said the gate wasn’t discriminating between good cycles and bad ones. It was just noise wearing a rule’s clothes.
We dropped it. Not softened, not exempted for this one cycle — removed, with the reasoning logged in the same commit that removed it. A rubric that can’t justify its own gate to the ledger doesn’t get to keep the gate. That’s a small thing to write down, but it’s the same instinct as everything else this window: prefer a system that can’t cheat itself over a system that merely promises not to.
Where it stands
None of this is finished — it’s honest, not complete. Compass is opt-in per agent, not on by default. Brain’s ingestion edge covers Drive, not every source we’ll eventually want. The affiliate stack has real money moving through it on testnet, which is not the same sentence as mainnet. And the next thing in the self-improving queue — feeding production outcomes back into which task gets picked next — is armed but its own proof is still red.
But three days ago the system couldn’t tell if a request had wandered off-mission, couldn’t read anything you hadn’t typed directly to it, and every dollar of affiliate commission was a promise on paper. Now it has a sense for drift, a pipe into your Drive, and a ledger that pays out and settles itself — and when we asked its own scorecard to defend one of its rules, it looked at the numbers and dropped the rule instead of lying about it.
That last part is the one we didn’t have to build. It’s the one the design earned.