Killing the part I was proudest of
Field note. The last one was the pivot. This is the part where I find out whether I meant it.
A pivot you don’t commit to is a mood
Three days ago I wrote that corral wasn’t a builder, it was an accountability engine, and that we were turning the ship. It felt decisive. It read decisive.
It wasn’t, quite. Because the thing that made the pivot real — deleting the builder — I hadn’t actually done. I’d re-labeled it. I’d written a better story over the top of the same machine and told myself the story was the change. The builder was still sitting right there in the middle of everything, the way it always had, being the first thing anyone saw and the first thing I reached for.
A pivot you don’t commit to is a mood. This is the note where I commit.
The email that said the quiet part
What forced it was a short email. A friend of mine — a data scientist, the kind who reads the actual code instead of the pitch — had reviewed CorralAI on his own time. The note said he’d send full comments over the weekend, but here was the bottom line:
“It’s an interesting mashup of what’s going on in the LLM ‘harness’ and ‘router’ worlds, with a couple of fun/novel features.”
Kind. Also exactly right — and it didn’t leave me, because mashup was the word for the thing I’d been failing to name for weeks. I’d been quietly failing a simple test: I could not tell you what one of my own core features was for without giving four different answers. Was create_mission — the “type a directive, watch the herd build it” front door — a coding tool? A CI runner? A demo? A compliance thing? Yes. All of them. Which is another way of saying: none of them, load-bearingly.
He’d pegged it precisely. A harness for running agents. A router for picking models. And a couple of novel features. The trouble wasn’t that any one piece was bad — the harness world and the router world are real and crowded and fine. It’s that I had a pile of commodity with a couple of novel things buried in it, and I couldn’t bring myself to delete the commodity to let the novel breathe.
The commodity was the builder
Here is the honest accounting. Most of what corral did was a slightly worse version of something that already had a giant, funded incumbent:
- A herd of agents builds software from a directive → a weaker Cursor, a weaker Devin, a weaker Claude Code. I am one maintainer standing in front of a stampede.
- An accountability warehouse in DuckDB → a weaker data warehouse, if you squint.
- A control plane that gates PRs → CI plus branch protection, if you don’t.
Stack those with no spine and you get exactly what he saw. But there was one thing in the pile that had no incumbent, because almost nobody is doing it: a gate that doesn’t trust a green, it re-earns it — by running the check itself, in a jail, and signing a tamper-evident record of what actually happened. We’re so literal about that “runs the check itself” rule that when a pre-launch audit caught our own gate trusting a worker’s self-report, we wrote it up and shipped the fix in the open.
Once I said it out loud, the whole thing reorganized itself. Every piece I was proud of — the herd of role-separated agents, the replayable recordings, the signed ledger, the scrubbing that lets you hand a record to an outside auditor without leaking a secret — every one of them was an accountability instrument. I’d built an audit system and dressed it up as a builder so it would demo better.
The builder wasn’t one product among several. The builder was the gravitational center pulling everything toward “IDE.” It’s what made the herd look like coders, the recordings look like a sizzle reel, the memory look like build-context. Remove it, and nothing else needs re-aiming — everything just relaxes into being an audit, because there’s nothing else left for it to serve.
That’s the trick with a mashup. It wasn’t a pile of half-built products. It was a couple of genuinely novel features wearing a builder costume so they’d demo better — and the costume was the confusion.
So we’re deleting it
Not shelving. Not “deprioritizing.” Deleting. create_mission, the build-from-directive front door, the herd-writes-the-code loop, the “client accepts the deliverable” convergence — gone. The demo that made people smile is the exact thing that has to go, because keeping it was the confusion.
And it costs almost nothing, which is how you know it’s right. The gate and the signing chain were already their own thing, wired to none of the builder. The herd and its staffing survive untouched — we just point them at breaking the change instead of producing it (a security breaker, a correctness reviewer, an exploit-attempter, an edge-hunter, instead of coders). Same herd, same wrangling; we turned the whole thing toward one goal — accountability. The recordings, the scrubbing, the warehouse, the whole replay UI — same machinery, new noun: you stop watching agents build and start replaying an audit.
What corral actually is now
A true audit for software change. The CISO’s tool.
Not where developers work — the opposite. It’s reactive on purpose. Let Cursor and Copilot and Devin fight over who writes the code; corral doesn’t care who did. It sits downstream of every one of them, at the one chokepoint the org actually controls — the merge — and it does one job: turn an adversarial, role-separated herd loose on the change, certify by executing what survives, and emit a signed, scrubbable record. Then it won’t let the branch merge without it.
And “certify by executing” is carrying more weight than it lets on — this is the part I keep under-selling. It is not re-running your existing suite. A role-separated crew writes tests shaped to the change that actually shipped. A different agent reviews those tests — because the one who wrote them doesn’t get to bless them. And then we try to make those tests worthless: mutate the code to inject the exact bug a test claims to catch and confirm the test screams, and turn a pentester loose hunting the hole nobody wrote a test for. A green only counts if the tests behind it survived something actively trying to prove them hollow. Adequacy isn’t asserted — it’s earned under attack. Then, and only then, we sign what’s left. That’s the difference between “the checks passed” and “here is proof the checks were worth passing.”
And none of that authoring runs on autopilot. The tests the herd writes are themselves reviewable by the control owner — a human promotes them into the vetted set before they’re ever allowed to gate a merge, the same human gate that governs every control, standard, and shared memory in the system. The machine drafts the check; a person decides what counts as the check. That’s the whole posture, and it’s the opposite of the pitch everyone else is making right now: not an autonomous agent you’re asked to trust, but an adversarial one you supervise — with a signed record of what it did when you weren’t looking.
There’s a second-order payoff I didn’t see until late. Because the herd mutates the code and watches whether the tests that shipped with it catch the injected bug, the same pass that certifies a change also grades the tests the developer wrote. If someone’s tests sail right past a bug we planted on purpose, that’s not a passing grade — it’s a finding. Quietly, corral can tell a security lead something no dashboard tells them today: these tests don’t actually test anything. The accountability runs in both directions — the code under review, and the checks the humans wrote to guard it.
That last distinction is the whole business. Everyone has logs — “trust me, this happened.” A signed, hash-chained, independently-verifiable record is evidence — “verify the signatures.” Scrubbable means you can hand it to an outside auditor with your secrets stripped. In a world where the thing writing your code is a non-deterministic agent, and a signature has only ever proven who and never what, evidence is the thing a security leader cannot buy anywhere else and is about to need very badly.
It even wants to be a command, not a cathedral: point it at a change, get back a signed verdict. The org platform — the warehouse, the cross-repo view, the dashboards — is the part you add once the command has earned its place.
There’s a loop in here I love, and I didn’t invent it — a different old friend handed it to me. He’s a CISO at a company whose name you’d recognize, and one day he passed me the Sakana Fugu paper with something like “this, but for the thing you’re doing.” So one friend told me what was wrong (a mashup) and the other handed me a piece of what was right — and, without meaning to, showed me who this is for. Because “can you prove what your code actually did” isn’t a curiosity to him. It’s his whole job.
What we took from Fugu is route-to-the-fittest: keep staffing the agents that perform, drop the ones that don’t. The difference — the knife that Fugu leaves unwashed — is that our notion of “fittest” isn’t self-reported. It’s gate-earned: an agent earns the next job by catching real findings our own execution-verified gate certified it caught. The fitness signal is signed. Same evolution, honest fuel.
The honest part
I’m not going to tell you the whole thing is done. It isn’t. The gate runs and signs today — that part is real and shipping. But retiring the builder is the first act, not the last; the standalone “certify this change” command and the full re-point of the herd are ahead of me, in the open, one honest commit at a time.
What I can tell you is that for the first time I can answer the question my friend’s sentence exposed. What is corral for? One thing. It proves what your agents’ code actually did, by running the checks itself and signing the result — so you don’t have to trust anyone, including me.
Deleting the part I was proudest of turned out to be the most useful thing I’ve done for it. Funny how often that’s where the answer is hiding — not in what to add, but in the thing you keep working around instead of removing.