Goal in.Finished work out.

One broken command, zero brakes

The "build the Expedition adaptive loop" epic finished its fourth increment on the first try: architect.ts and build.ts written, tested, committed. Then the engine spent 22 hours re-doing it. Every cycle re-verified the same landed code, wrote another evidence-note commit, reported complete, and got re-dispatched.

Bounded, then fail open, loudly

Three changes landed on the live branch today. The principle behind all three: a broken gate must degrade into a loud caveat, never an infinite loop, and the queue keeps moving.

• The gate is real now. vitest.workspace.ts defines the missing unit and e2e projects (*.e2e.test.ts is the split). Their union is byte-identical to the old full suite, so nothing else changed behavior.
• Every verify-failure path has brakes. Both the cadence gate and the pre-completion gate now charge the same shared retry budget as every other failure path (2 retries). After that they fail open: the increment stays committed, the cadence marker advances so the same gate cannot re-fire, and a full_project_verify_failopen audit row records exactly what was skipped and why.
• A regression test pins it. An always-failing verify now drives a 3-increment epic to completion in exactly 5 dispatches. Before the fix that test loops forever.

// the shape of the fix, both verify paths
if (verify.verdict === "fail") {
  if (retries < MAX_INCREMENT_RETRIES) {  // shared budget, audited
    repend(increment); charge(retry); return;
  }
  advanceCadenceMarker();                 // same seq cannot re-fire
  audit("full_project_verify_failopen"); // loud caveat, not a livelock
  // increment stays committed; epic continues
}

Alongside the code: protocol rule 12. Rule 10 already banned needing you present to reach done. Rule 12 shapes the plan itself: every step only a human can do (money, credentials, app-store or legal submission, external PR approval) is enumerated at spec time, pushed to the terminal leaves with everything drafted, and surfaced as an end-of-run operator items rollup. Mid-chain stop-points like the ME2 pause are retired; the queue was reopened the same hour.

An engine kit, not yet an engine

Expedition is a bounded orient, decide, dispatch, observe loop: state carries a goal, findings, budget, and move history; a decider (one cheap structured LLM call behind deterministic guards) picks the next move; moves do the work. The pieces that exist are well-built. The pieces that make it a system are the ones not built yet.

The /expedition command you can type today does not touch any of this. It prepends one paragraph of research-first flavor to a normal marathon epic. That is why your instinct is right that you still do the research yourself: the adaptive engine exists on a branch, unplugged.

The eight gaps between here and "figure it out"

• Not invocable. Increments 5 to 8 unbuilt; no assembly point wires moves, runPlan, or a search provider.
• No feasibility gate. A doomed goal (an undeletable stock-iOS app, say) burns a full marathon instead of dying in phase zero with alternatives.
• Recovery is retry-shaped, not switch-shaped. Same brief retried twice, then fail. No diagnosis, no strategy change, no never-retry-identical-args rule.
• Research depth ceiling. Confidence tags come from a snippet-grouping heuristic; no synthesis pass, no adversarial check, no claim reconciliation.
• Shallow architecture validation. File-existence checks only; nothing probes an API before code gets written against it.
• Human-gate deferral is half-built. Secret gaps already park-and-continue (the right shape), but there is no money boundary, no cost cap, no end-of-run operator rollup.
• The attempts ledger is invisible. Retry counts live as audit-row counts; the decider cannot reason about attempt history.
• Tool acquisition is static. Workers get WebSearch + exa. Nothing can decide "this goal needs Playwright, a Kalshi key, a new MCP" and provision it.

What the best systems already know

Surveyed the current long-horizon agent field: Anthropic's harness and C-compiler write-ups, OpenAI's 25-hour Codex runs, Cognition's multi-agent findings, OpenHands, Gemini Deep Research, plus the verification-horizon literature. Thirteen patterns worth stealing, grouped by what they buy us. Full source list in the footer.

Shortest path to the real thing

How your ask would flow through it

Same shape for the other asks. "Find and patch vulnerabilities": feasibility scopes the attack surface, research maps CVE classes, build ships patches with tests, you review the diff. "Undeletable loud-alarm iPhone app": feasibility kills the literal version in phase zero (stock iOS forbids undeletable third-party apps), proposes the honest nearest things (MDM-supervised device, Screen Time restrictions, critical-alerts entitlement), and the only terminal human item is the Apple developer account.

Where the queue is right now

83 items done. The chain ran fe1 through the Mercury wave autonomously on Jul 16, then sat two days at a mid-chain operator pause. That pause pattern is retired under rule 12: everything below runs without you, and anything that truly needs you arrives at the end, drafted.

Parked rows are business decisions, not stalls: rule 12 keeps those distinct on purpose.