The morning tax
My normal support workflow was embarrassingly manual: identify which codebase an email belongs to, open that repository, start a coding agent, load the local instructions, paste the request, review the proposal, then decide whether anything should change.
None of those steps is difficult. Together they consume the cleanest part of the morning.
The obvious agent brief was: fetch the relevant code before the laptop closes, review the inboxes before I wake up, route each technical request to the right project, read that project’s instructions and runbooks, then prepare a solution for review.
The first useful version was deliberately restrained
We built the first slice on top of an existing orchestration project rather than inventing another framework. The canonical checkout was already dirty, so implementation happened in a separate Git worktree. Source access was fetch-only. Push URLs were blocked before coding agents ran. Mail remained read-only.
A private project registry defined the allowed repositories and their relationships. The router failed closed when that registry was missing, malformed, duplicated, stale, or pointed at the wrong account. Relevant documents were selected from explicit trusted metadata—not because a random Markdown file used the right project name.
The routing result included evidence: which project won, which instructions were selected, which alternatives were rejected, and why. Required repository instructions reserved space before optional subsystem notes. When the output cap was exceeded, selection stayed deterministic.
That sounds fussy because it is. “The model probably picked the right repo” is not an operating control.
Human approval is part of the architecture
The target system is not an inbox goblin committing fixes at 5:42 a.m. It is a morning review surface: here is the request, here is the likely project, here is the source context, here is the proposed plan, and here are the uncertainties.
I can approve, reject, or correct the routing. Those decisions can later become training evidence or procedural memory. But the learning loop comes after the evidence trail, not instead of it.
The implementation work exposed useful failure modes immediately. A binary Git patch transferred tracked changes between worktrees but silently omitted a new untracked test file. The tests in the source worktree were green; the destination was incomplete. We turned that mistake into a reusable procedure: inventory status, transfer untracked files explicitly, verify the destination, then rerun focused tests.
What exists—and what does not
The first slice produced the registry, deterministic routing, isolated mirror logic, proposal surfaces, review evidence, and a tested handoff. Hundreds of repository tests passed. Independent reviewers still found edge cases, including required instructions being crowded out by optional documents; those findings were fixed and retested.
It is not yet a claim that every live inbox is autonomously triaged or that code ships while I sleep. The mail lane was intentionally read-only, production mutations were blocked, and the slice remained isolated for review.
That is still progress. Real autonomy does not begin by granting every permission. It begins by making the system useful while most dangerous permissions are denied.