There is a way of building software with an ensemble of AI systems that produces work of a rigor most teams never reach, at a cost that is a rounding error on the payroll such rigor normally requires. It is not “let the model write the code.” It is closer to the opposite: humans stop authoring and start governing, and the machines do the drafting, auditing, verifying, and attacking under rules that no participant’s memory can override. This note describes that method as we practice it — what it is built on, what it produced, and what it costs. It does not describe the operating manual. The manual is the part that took a year to learn, and we consider it as much a product as the systems it builds.
The premise
Multi-model work has a characteristic failure. The ideas are good and their provenance is unknown; drafts contradict each other in ways nobody notices because nobody holds the whole; and decisions get silently remade every time a new session starts. The instinct is to fix this with fewer models or more meetings. Neither works. The fix is structural: contributions come from many; coherence comes from one; and the one does not author — it ratifies.
Everything else follows from that sentence. If the human’s job is ratification, the human needs a record to ratify into — a single place where every decision lives, versioned, cited, and never contradicted by anything downstream. If the machines’ job is drafting, their drafts must be graded by something that cannot be argued with. And if the whole thing is going to survive the model being swapped, the session ending, or the person having a bad day, then nothing can depend on anyone’s memory. We write that last rule on the wall: nothing mortal is load-bearing.
The shape
Five roles, and they never overlap.
A principal decides. Not details — releases, and the handful of questions that are genuinely questions of meaning, safety, scope, or disclosure. Everything that follows a stated convention is decided elsewhere, and the principal’s attention scales because it is spent only where judgment is irreplaceable.
Drafters generate: design documents, specifications, code, tests. They work within written mandates that say what they may decide alone, what they must record when they decide it, and what they must stop and escalate. A draft that makes a choice the mandate didn’t grant is not “initiative”; it is a defect.
An auditor keeps the record and grades the drafts against it — and against every prior decision, so that consistency is enforced rather than hoped for. The auditor never writes what it grades.
A judge that is not a mind at all: deterministic test corpora, pinned by hash, that an implementation either reproduces byte-for-byte or does not. There is no “close.” When a specification and its corpus disagree, the disagreement is a finding, not a negotiation.
An attacker from a different model lineage than the drafters, because models share blind spots along family lines, and the review that matters most is the one that doesn’t share yours.
The rule that binds the five: the party being graded never writes the yardstick, and never defines the party that holds it. We learned that one the hard way, more than once, and now a machine refuses to let it happen.
The record
The method runs on artifacts, not conversations. A decision register where every architectural question routes and every answer has an id, a status, and a citation. A fixed template so that thirty documents can be checked for the same thing in the same place. Charters — one per unit of work — that say exactly what a drafter may decide and must record. Deterministic corpora authored alongside the prose, never after, because a test vector cannot be written vaguely and so it forces the prose to be precise. Audit records in two layers: the drafter’s own, which is required and not trusted alone, and an independent one, which is where assurance actually rests. And when a drafter becomes an implementer, its charter becomes a constitution that lives in the repository and is read at the start of every session.
Three habits keep the record honest. Bytes over prose: when a written rule and an executable artifact disagree, the artifact corroborated by the rule’s own worked examples governs, and the prose gets an errata. No silent fills: every choice a drafter makes classifies itself — implements a decision, fills a gap within its mandate, or escalates — and a fill with no entry is a defect. Ratification by acceptance: the principal’s acceptance of an artifact ratifies every decision in it, which is what lets one person’s attention cover a body of work no one person could write.
The discipline
Most of what makes the method work is a set of laws, each learned from a specific failure and each now enforced by something other than memory. A few, in the form we say them:
A control described in a document is not a control. If a rule matters, a hook, a gate, or a test enforces it, and the enforcement is proven to bite before anyone trusts it.
A check over an empty set is not a check. A verifier that matched nothing has verified nothing, and it says so loudly.
Fix inputs; never coach drafts. When a draft fails, the failure is classified against the input that caused it — the charter, the source material, or the model — the input is corrected, and the draft is regenerated. Arguing with a draft compounds; regenerating is one clean pass.
Instruments fail in different directions; keep several. Linters see constructs, test vectors see behavior, fuzzers see inputs nobody imagined, mutation testing sees tests that cannot fail. No one of them is enough, and the interesting defects live where exactly one of them is looking.
The author never triages its own findings. Classification decides whether anyone else looks. It is done by someone else.
Locate inputs by content, never by name. A wrong file cannot be planted under a right name when files are found by hash.
Every participant is replaceable except the record. Drafters have changed three times. Sessions end. The record did not care.
What it produced
We built PolyCap — an authority substrate for people, devices, and agents — this way. Nineteen design documents. Eighteen byte-level module specifications with deterministic vector corpora and a closed catalog of hundreds of typed errors. A conformance oracle that regenerates every corpus from enumerated inputs on a bare machine. A reference implementation graded against that oracle from its first commit and reproduced independently — a second implementation, in a second language, forbidden from reading the first’s output, agreeing hash for hash on the entire reference corpus. The research behind it spanned eighteen months. The design set was written in six days across three design sprints; the eighteen module specifications in three days after that. Within two weeks of starting implementation, the first nodes were exchanging capability-checked frames. The compression is not in the thinking — that took as long as thinking takes — but in the labor of turning settled judgment into byte-level artifacts, which is the labor the method is built to accelerate. The implementation phase then found dozens of defects in the specification that no review had caught, because for the first time the reviewer had to make the bytes — and every one of them went back into the record as an errata item with a witness.
The method also found its own defects, which is the part we’re proudest of. It caught a gate that had never been installed, a check that had passed over nothing, a claimed control that existed only in a document, a rule that routed trivia to the Tech Lead. Each became a law. Each law became a check. The machine now corrects itself more often than it is corrected.
What it costs
Attention. The method scales in human judgment, not in typing; its bottleneck is review, never budget. It is also, in a way, humility: the humans in it give up authorship, the machines give up initiative, and everybody gives up the comfortable belief that a thing described is a thing done.
And it costs rigor of a kind that feels excessive until it isn’t. A test corpus for every specification. A witness for every decision. A pin for every finding. A signature on every release. These are not overhead; they are the product’s warranty, and they are why the reference implementation could be reproduced by a stranger’s code without a single conversation.
What it is not
It is not automation of engineering; it is governance of engineering, with automation doing the labor. It is not a way to build faster by checking less; it checks more than any human team could afford to. It is not model-specific — it has run with three different drafters and will run with the next — and it is not finished; the second version is being designed from what the first one taught.
The industry is discovering that AI systems can write a great deal of code very quickly. The harder discovery is that speed without a record is just a faster way to lose track of what was decided. The method exists so that the record comes first — and so that the humans in it can carry the part they need.
Affectron is a combined AI and human engineering organization. This note describes the method; the operating manual is not published.