Skip to main content
A Corolla’s quality is fixed at the gate. An agent’s quality is a distribution over future runs, and every input to that distribution drifts: the model gets swapped, the APIs change, the environment moves, the context stack goes stale. The factory-level conclusion: the factory never releases a unit. Deployment is not exit; it is transfer from a high-frequency inspection zone to a low-frequency inspection zone. Every certificate carries an expiry. The right industrial analogy for the back half of the line is not Toyota’s shipping yard but aviation’s continuing airworthiness: telemetry return, scheduled re-certification, and a recall mechanism — the kill switch, correctly understood, is a recall.

​
The evidence is our own history

Everything built in the factory’s March 2026 burst was rotten by July without a single defect occurring: a decommissioned agent’s access credential sat expired for a month, the export pipeline shipped empty context placeholders, all roadmap dates elapsed unrevised. Nothing failed. Everything decayed. Staleness is this factory’s corrosion, and corrosion protection is a designed system, not a virtue. No amount of diligence keeps certificates current; only machinery does — expiry sweepers, re-certification triggers, and a bill of materials precise enough that a model swap reopens every certificate binding that model as a query, not an investigation.

​
What it changes on the floor

  • Certificates carry an expiry interval and trigger conditions — model swap, dependency change, N production failures (Station 4).
  • Operate is a permanent station with no exit gate, because there is no exit.
  • The warehouse of finished goods that agent builders imagine they have does not exist. What exists is a fleet under continuing inspection, each unit’s trust renewed on schedule or withdrawn.
An agent that was correct yesterday is not thereby correct today. The factory does not argue with that fact; it builds for it.

​
Self-audit