Skip to content

Case Study № 01 · The Self-Build

The first client was itself.

Before Oasis built anything for anyone else, it built — and tracked, and gated, and receipted — its own construction.

Every number below links to how you'd inspect it.

§ 01 · The Wager

A system with one honest first test.

A system that claims AI agents can build real software under human gates has exactly one honest way to open: build itself, in front of the same gates, and keep every receipt. Anything less is a brochure.

So the wager was never a demo. It was a falsification test. If agents-under-gates couldn't produce the platform — traceably, with evidence a skeptic could reopen — then the method was wrong and we'd know it early, on our own time, at our own cost.

Honesty markerThis is the best falsification test we've found so far: make the thing build the thing, and refuse to trust any step that can't show its work.

Oasis became the first project tracked in Oasis. Its assumptions, its arcs, its stories, its test receipts — all of them live inside the platform they describe. The construction record isn't marketing copy written after the fact; it's the same ledger the machinery wrote as it ran.

Dogfooding as falsification, not as marketing.

What follows is one deep cut through that record — not a wall of statistics, but a single named story with the artifacts still attached, chosen because it shows the method doing the one thing a slide can't fake: changing an outcome under load.

§ 02 · Three Days, One Chain

One intent, three arcs, a production deploy — in seventy-two hours.

The platform needed its own roadmap to stop being a document and start being a feature — something the system could hold, query, and render, not a note someone kept in sync by hand. That was the intent: the roadmap should be a first-class object in the platform, not a page about it.

It entered the chain on June 22 and decomposed into three intents — the roadmap as data, the roadmap as a view, and the roadmap on the delivery hub. Each was ideated against the real code and verified by skeptics before a line was written; each became a supervised arc; each left artifacts on the way through. On June 25 the whole thing was live in production.

Jun 22Jun 23Jun 24Jun 25Intentroadmap →first-classroadmap as data · AR-021ideationratifyarcreceiptroadmap as a view · AR-022ideationratifyarcreceiptroadmap on the hub · AR-023ideationratifyarcreceiptDeployprod · live
  1. Intent · Jun 22the roadmap should be a first-class feature
  2. Roadmap as data — AR-021ideation → ratify → arc → receipt
  3. Roadmap as a view — AR-022ideation → ratify → arc → receipt
  4. Roadmap on the hub — AR-023ideation → ratify → arc → receipt
  5. Deploy · Jun 25all three arcs land in production
waypoint human gate receipt Jun 22 → 25 · three intents, three arcs, one production deploy

The point isn't the speed. The point is that nothing about the speed was untraceable. Each arc that landed left a receipt in the same ledger — here is one of them, the story that made the roadmap render from live platform data instead of a hand-maintained page.

T-114 · roadmap renders from the live ledger PASS
story S-114plan P-114 arc AR-022recorded 2026-06-24
  • AC-1 · PASS The roadmap view reads goals and phases from the live ledger, not a static file. roadmap.load.ts:44 · test renders from ledger snapshot · 5 assertions
  • AC-2 · PASS Every query is owner-scoped — no cross-project bleed. roadmap.query.ts:71 · where(project) enforced · 4 assertions
  • AC-3 · PASS Empty roadmap renders a real empty state, not a crash. roadmap.view.test.ts:132 · zero-goal render · clean build

Reproduce

$ pnpm --filter @oasis/roadmap test roadmap.load
$ pnpm --filter @oasis/roadmap test roadmap.query
$ pnpm build   # tsc --noEmit green

One receipt from one arc of the three. The other 88 read the same way: per-criterion verdicts, evidence a reviewer can open, a command anyone can run.

§ 03 · The Gate That Earned Its Keep

The gates aren't ceremony. Here is one changing the outcome.

It is easy to say a human gate matters. It's harder to show one earning its keep — a moment where the machine was confident, plausible, and wrong, and a person at the gate changed what shipped. The self-build has those on the record. This is one.

While wiring the platform's own plugin, an agent's ratification batch surfaced its usual bundle of decisions for a single human pass. Most were fine. One recommended swapping a skill in the plugin manifest — replacing the artifact-index skill with a newer-looking one. The reasoning read cleanly. It was also wrong: the "newer" skill didn't cover the same artifact families, and the swap would have quietly dropped Goals and Intents from the index the workflows depend on.

D-23-4 · plugin manifest · skill roster Corrected & ratified

Which skill should index artifacts in the plugin manifest?

Surfaced in the AR-023 plan-review batch (7 decisions, one pass). The agent ranked its options and recommended one.

  • ASwap in artifact-index-v2 — newer, leaner, faster scan. agent recommended
  • BKeep oasis-artifact-index — the current skill the ideation workflows already consume.
  • CRun both, diff their output, decide next arc. Safe, but defers the manifest change.
Operator ✎ corrected
Not A. v2 doesn't cover Goals or Intents — swapping it in silently shrinks the index the workflows read, and nothing would fail loudly. Keep B. If v2 earns its place, prove coverage parity in its own arc first. — jmcmunn · 2026-06-23 · overrode recommendation A → B

The agent recommended the plausible swap. The human, reading the coverage the agent didn't, kept the working skill. That reversal is the whole reason the gate exists.

Why it mattersA silent shrink is the worst kind of failure — nothing breaks, nothing alerts, the index just quietly stops seeing half the work. The gate caught it because a person was accountable for the batch, not just present at it.

A recommendation is a starting point. The gate exists so a human can overrule it — and the ones that matter most are exactly the ones where they do.

§ 04 · The Skeptics That Doubled the Analysis

The draft was good. The verified version was the truth.

Before any of those three arcs was framed, its ideation had to survive a verification pass. An ideation is a set of claims about a codebase — what building this will touch, break, and require. The draft gets no vote in its own defense. Skeptic agents read the real code the draft cites and try to falsify every claim.

Here is the pass on the roadmap ideation — the impact analysis behind the middle lane.

skeptic-pass · IDB-004 · roadmap-as-first-class · grounded against apps/roadmap
▸ reading  39 cited artifacts + 1,180 files under codeRoot
▸ verdict per claim ──────────────────────────────────
 #02  "no roadmap query layer exists yet"            CONFIRMED greenfield · apps/roadmap absent
 #05  "goals + phases share one table"               CORRECTED separate tables · schema 0016
 #08  "the ledger already exposes goal events"       CONFIRMED ledger.emit('goal.*') · ledger.ts:210
 #11  "hub render can reuse the canvas origin"       REFUTED   cookieless origin required · DEC-052
 … 9 more confirmed …
▸ gaps the draft never mentioned ─────────────────────
 +   roadmap query needs owner scope — no RLS fallback   ADDED
 +   empty-roadmap state unhandled — would crash render   ADDED
 +   goal→phase cascade must survive a re-index           ADDED
 … 22 more added …
confirmed 11 corrected 2 added 25 → the skeptics roughly doubled the analysis

Eleven claims confirmed, two corrected, twenty-five impacts the draft never mentioned — dragged into the light by agents reading the real code.

The draft was useful. It was not trustworthy — not yet. The twenty-five added impacts included the two that later became acceptance criteria on the receipt you just read: owner-scoping every query, and rendering a real empty state instead of a crash. A slide would have shipped the draft. The method shipped the verified version.

The principleClaims are falsified before they're trusted — not asserted and hoped over. The verified analysis and the draft are not the same document, and only one of them is safe to build on.

§ 05 · Lessons Into Machinery

The process eats its own failures.

The self-build was not clean. Agents claimed things that weren't true, raced each other, and once destroyed real work. What makes the record worth showing isn't that nothing went wrong — it's what happened after. Thirteen named failures became thirteen permanent guards: each one encoded back into the workflow so the same mistake can't recur silently. Four of them, etched:

L-04The empty worktree

FailureAn implementer reported a story Done and merged — but the worktree it claimed to have committed to was empty. The claim of success was believed on its word.
Guard nowCompletion is a claim, not a fact. A verification gate re-reads the branch and confirms the commit exists before any “Done” is trusted.

L-07The raced id space

FailureTwo arcs framed in the same window both minted S-131. The second silently overwrote the first's story — same id, different work.
Guard nowArcs lease their id ranges at framing. An id is reserved before it's written, so two arcs can never claim the same one.

L-09The fabricated path

FailureA dispatch named a substrate repo that didn't exist. With no canonical record to read, the agent invented a plausible one and proceeded.
Guard nowPre-flight empirically verifies every path, repo, and key a dispatch names — the last three fabrications were all caught here, before work began.

L-11The cold-rebuild wipe

FailureA rebuild preflight checked that the substrate was clean and destroyed the VM — taking a week of un-tracked, in-VM work with it.
Guard nowPreflight now recons operator state inside the target before any destroy — and every destroy is a human's key, never an agent's.

None of these are apologies. They're the reason the method is worth trusting: a process that turns its own failures into machinery gets safer with every mistake, instead of repeating them at a client's expense.

Every scar on this list is now a wall no agent can walk through.

§ 06 · What This Proves

What it proves — and what it doesn't.

It proves the machinery works under real load, with a demanding operator, on software with no tolerance for hand-waving. Agents produced the volume; a human held every irreversible gate; skeptics falsified the analysis before anyone built on it; and every claim landed with a receipt you can reopen. Twenty-six arcs, a hundred and nineteen stories, eighty-nine receipts — all tracked in the platform they built.

It does not prove your domain. Your constraints, your data, your regulators, your edge cases — this case study can't stand in for those. That's the honest limit of a self-build: it shows the method holds on the one system we know best. What it holds on yours is a question only the receipts on your own engagement can answer.

The honest closeThis is the strongest evidence we can offer that the process works — and the clearest reason the next proof has to be built on your ground, not ours.

26Supervised arcs
119Stories
89Receipts