Private R&D · Agentic software engineering · In progress
Agentic Delivery Control Plane
Researching how AI coding agents can operate 24/7 at speed without bypassing security, architecture, quality, cost and human accountability.
The research question
How can multiple coding agents plan, implement, review, test and release software around the clock while remaining constrained by the repository’s architecture, security policy, delivery standards and business intent?
The goal is not unattended code generation. The goal is controlled autonomous delivery where every action is bounded, observable, reviewable, reversible and measurable.
The public system map
The public architecture is divided into nine control layers. The model, prompts and agent graph are only one part of the system.
Intent contract
Issues, specifications, architecture decisions, acceptance criteria and risk classification become executable delivery boundaries.
Durable orchestration
Queues, schedules, retries, concurrency limits, timeouts, budgets and checkpoints coordinate long-running or parallel agent work.
Isolated runtime
Each task runs in a separate worktree, container or sandbox with short-lived credentials and restricted network and filesystem access.
Repository intelligence
Skills, architecture maps, ADRs, code ownership, conventions and tested examples make the repository legible to agents.
Tool control plane
Custom MCP servers expose narrow capabilities. Hooks inspect or block commands, edits, tool calls and configuration changes.
Independent verification
Separate reviewer agents, CodeRabbit and deterministic checks challenge the implementation rather than trusting the generating agent.
Secure CI gates
Builds, tests, CodeQL or Semgrep, dependency review, secret scanning, IaC checks, SBOM generation and policy rules block unsafe merges.
Release governance
GitHub rulesets, required checks, merge queues, signed artifacts, preview environments, canaries and human approval protect production.
Observability and learning
Agent traces, tool calls, diffs, evaluations, cost, latency, failures, rollbacks and human interventions feed the next controlled iteration.
How agents are kept under control
Task classification, permission scope, environment selection, context budget, command allowlists and required human approval are resolved first.
Hooks and MCP gateways validate tool use, protect secrets, constrain paths, restrict network access, capture evidence and terminate unsafe behaviour.
Independent review, tests, security scans, policy checks and evaluations decide whether a change can progress. The generating agent cannot approve its own work.
Protected branches, signed artifacts, provenance, staged rollout, monitoring and rollback preserve a human-controlled path to production.
Candidate integration surface
Agent runtime
Codex, Claude Code, isolated worktrees, ephemeral sandboxes and durable orchestration.
Repository contracts
Skills, hooks, custom MCP servers, architecture maps, ADRs, ownership rules and acceptance contracts.
Review and security
CodeRabbit, GitHub CodeQL, Semgrep, dependency review, secret scanning and policy-as-code.
Supply chain
SBOMs, OpenSSF Scorecard, Sigstore or Cosign attestations and signed release provenance.
Runtime assurance
Preview environments, canary delivery, automated rollback and production behaviour validation.
Executive control
Risk dashboards, cost budgets, intervention queues, audit evidence and emergency kill switches.
CI/CD as the non-negotiable control boundary
AI reviewers are useful, but they are not a substitute for deterministic engineering gates. Every agent-generated pull request should pass the same or stricter controls as human-authored work.
- Repository validationFormatting, linting, type checks, generated-file policy and forbidden-pattern rules.
- Behaviour validationUnit, integration, contract, end-to-end, migration and regression tests.
- Security validationSAST, dependency and licence checks, secret scanning, IaC and container scanning.
- Independent AI reviewCodeRabbit and reviewer agents inspect risk, correctness, maintainability, missing tests and architecture alignment.
- Policy and merge protectionRequired checks, risk-based approval, code owners, merge queue and no direct default-branch writes.
- Release evidenceSBOM, provenance, signed artifacts, deployment plan, observability and rollback readiness.
Preventing agent drift
Drift is treated as a systems problem, not a prompt problem. The control plane reduces ambiguity and continuously compares work against stable repository contracts.
- Small bounded tasks with explicit acceptance criteria
- Architecture decision records and invariant checks
- Repo-specific skills and examples instead of one giant prompt
- Custom MCP tools with narrow typed contracts
- Hooks that block unsafe commands and unauthorised file areas
- Context budgets, compaction and checkpointed memory
- Independent planning, implementation and review roles
- Deterministic tests and policy gates before model-based judgment
- Traceable evidence for every tool call and code change
- Human escalation when confidence or risk crosses a threshold
How the research will prove value
The project will be evaluated against a controlled benchmark repository and synthetic delivery workload. Public results can be shared without exposing the private implementation.
How this can be shared safely
The public portfolio therefore demonstrates engineering maturity and the complete control surface without publishing the mechanics that could create competitive or security exposure.
Public research basis
This private program is informed by public work on multi-agent coding, repository harness design, lifecycle hooks, AI code review, merge protection and software supply-chain security.