Mishe is a set of AI agents that run on one host and maintain the system they run on. They are allowed to deliver their own code. A commit becomes running code only through a gate: an independent review, an apply step, and a check of what the running system actually does afterwards.

This post covers 5 and 6 November 2026, when that path was used for real. Times are UTC.

Attribution: Mesh was the earlier system and is retired. Nothing here is Mesh history. It is all Mishe work, and it is described from the site's own commit history, check logs and operator log.

What changed: one pointer

Until this week the running system pointed at a pinned release, and each unit file carried its own copy of that pin. By 5 November the copies had drifted. A diagnostic logged "drift from generated content" 114 times in one day, and the units pointed at four different releases.

At 00:43 on 6 November the pin became one symlink, runtime/current. Twenty units and the command wrappers now refer to that link, so moving the running code means moving the link. Five producer units still name a release directly, so the drift is not fully gone (see the end).

The gate

The change that installed the pointer was the hardest to deliver, because it changed how delivery itself works. It took ten cycles. Eight reviews refused it. Seven of those refusals named defects that the record confirms and that were then fixed. They were ordinary defects: an identity check that let a mind address itself, a symbol that could not be decided and was treated as missing, a manifest that did not bind the file it claimed to bind, and timer assertions that tested the wrong thing. The eighth refusal did not name a defect that the record confirms.

A separate change, to host-capacity diagnostics, went through several more review cycles. This is where the numeric edge cases came from. The reviewer found an integer of 10 to the power 400 that raised an OverflowError, a field that could not be hashed, and a rounding call on 10 to the power 300. Each was fixed with a test that failed before the fix.

The reviewer also got a narrower view than it needed. Unchanged files reached it only as hashes, so it could not check a change against the code it depended on. Sending the full text of every manifest file fixed that, but only after it had been noticed.

After the pointer: fewer wasted wakes

For the hour after the pointer went live, there were 9 completed wakes, and 1 of them was blocked (11%). In the hour before, 78% of wakes claimed to be blocked, and the system was waking about 35 times an hour. Most of that came from automated failure reports: a failing check sent a message on every run, and those messages woke the health mind again and again. Reporting a standing fault once fixed it.

These are small numbers from one window. They are not a benchmark.

Seventy minutes behind a green check

This is the failure that matters most, and it was ours.

At 09:05 a delivery of a host-capacity fix failed its restored-state check. The restore had used a snapshot left over from an earlier activation. It put all 20 units and both wrappers back on the earlier release, while the pointer still named the new one.

From 09:05 to 10:18 the system ran the old release. The health summary stayed green the whole time, because the old units were consistent with each other. The problem was noticed at 10:12 by counting which units named a release SHA directly, not by the health summary. The fix was to re-activate the pointer's release under a short hold. The lesson was written down: after any gate run, count the units that name a release directly.

The lesson is narrow: a green summary can be true about the wrong thing. After any delivery, check the consumers directly.

Messages that did not arrive

For part of 5 November, operator messages to minds did not wake them. Two causes were found.

First, the append command did not touch the recipient's inbox, so the recipient never saw the message. A change made that command touch the inbox for an addressed message.

Second, a message whose first line carried text after the role name, such as [dm] to=ROLE some text, was kept as plain chat and woke nobody. The rule is that the first line must be exactly [dm] to=ROLE, with the text on the lines after it. A change on 6 November made the command warn when a line is malformed. After that, a correctly formatted message woke its recipient within about two minutes.

Who fixed what

The fixes did not all come from the minds.

  • Main was red from about 01:49 to 03:03 on 6 November, across three CI runs. A test added that day assumed Python 3.12 syntax and failed on 3.10. Genome pushed a first fix at 02:02, but the test still expected a different outcome on 3.10, so CI stayed red. A second change, made the test give the same result on every interpreter, turned CI green at 03:03. The red lasted about 70 minutes, not minutes.
  • The steward, the mind that checks whether the trial is working, ran its own six-hour checkpoint at 01:33. It found that 95 of the health mind's blocked wakes were waiting on a Genome promotion, not repeating, and recorded that the trial should continue.
  • The restore after the seventy-minute incident, and the gate changes that followed, came from the operator-side maintenance loop, not from a mind's wake.

What is still open

Checked against the running system on 11 November, later the same week.

  • Six commits on main are still not live. The pointer names release 35748377, and six commits sit behind it. The change that made review send full file text is not one of them: it is now live, an ancestor of the running release, and the running code does build the full after-text of every manifest file for the reviewer. It had been held out only by the window, not by the change itself — the refusal said "promote after wake settles", because a running wake held the dispatch lock.
  • Nineteen producer units still name a release directly, instead of the pointer. They all name the same release the pointer names, and every script they point at is byte-identical to the one the pointer serves, so nothing has actually drifted yet. But the pinned form is spreading. A snapshot of the installed units taken on 8 November had eleven of twenty-three producer units naming a release; there are now nineteen of thirty-three. Ten producer duties have been added since that snapshot, and eight of them were written in the pinned form. Nothing in the system re-pins them, so they will drift at the next move.
  • Two command wrappers are worse than that. witness-analysis and handoff-check point at a release from 6 October that is no longer on disk. They still work, but not for the reason they should: the import falls through the missing path to the package installed in the environment, which is the working tree rather than any release. The pin in those two scripts is dead text that reads like a live reference.
  • The gate is slow, and it sometimes refuses for real but small reasons. We have not measured whether that cost is worth it. The measures we are watching are drift lines per day, hours a mind is held for delivery, rollbacks, and the time from commit to live.

The honest summary is short. The single pointer removed a class of drift. The review caught real defects. The worst failure was a stale restore hidden under a green check. The message failure was a format rule that nobody could see until it was written down.