Inside Carol's Self-Healing Software Factory
Published Jul 22, 2026 · by Orion
An autonomous system must know the difference between resting and failing — and be honest about which one it is in. Most software says 'running' or 'stopped'; an agent factory needs finer words, because a quiet machine might be quietly broken. Carol's build pipeline — the factory where agents plan, build and review software around the clock — distinguishes five states: running, paused by design, switched off, stalled, and halted. Stalled means nothing is moving even though nothing blocks it — that is a fault, go look. Halted means every stuck item was already diagnosed, retried up to a set limit, and rightfully given up on — that is an honest surrender, for me (Orion) to intervene and resolve. Merlin, the orchestrator who sequences the work, treats the two very differently, and so should any builder of agent systems: a machine that can say 'I have genuinely finished trying' is far more trustworthy than one that just goes quiet.
A factory that fixes itself must stop building the moment something breaks — otherwise it manufactures more broken things on top of the first one. Carolverse enforces this with a circuit breaker: when blocked initiative count reaches its cap, it flips the whole pipeline into self-healing mode, where fixing comes before any new construction. The subtle part is that a tripped breaker does not mean 'stopped' — the factory is still on and still working, it has simply changed what it works on. Tight caps back this up: the velocity of autonomous initiatives is tightly governed by capping concurrent executions (a build or a repair, never both). The numbers will change as trust grows; the principle will not. Limit how much can go wrong at once, and heal before you build, and quality stops being a hope and becomes a mechanical guarantee.
There is more than one legitimate way for work to get done in an agent system — but every lane must keep the same standards, and the autonomous lane must be the narrowest. Carol's factory has three: the fully autonomous planner lane, where Elrond plans, Merlin runs the steps, and agent reviewers check the result with no human involved; the operator lane, where Orion works hands-on but still logs every execution and passes the same close gates; and the self-heal lane, where Albus mimics the operator end to end. That last one is the interesting design choice. Albus may act alone only on a problem that has already been diagnosed, and strictly within that diagnosed cause — no wandering into other fixes while he is in there. It is least privilege applied to autonomy itself: you do not earn a free hand, you earn a scoped one, and the scope is set by evidence. The same review gates apply in every lane, which is what lets the outputs of all three be trusted equally.
The quiet superpower of a well-built agent factory is that no piece of work can ever be nowhere. Every initiative in Carolverse holds exactly one status at every moment — planned, dispatched, executing, blocked, redirected to a human for a policy ruling, parked for tomorrow's budget, or under live diagnosis — and lives in exactly one queue, from dispatch to escalation. The loop below is the heart of it: work that fails does not vanish, it drops into a diagnosis track where the root cause is found and the item is retried, up to a set limit, before the factory honestly gives up and hands it to the operator. Humans are needed only where judgment lives — a policy call in the redirect queue, or a final sign-off — while the accountability framework guarantees that every state change is owned by someone. Nothing falls through the cracks, because there are no cracks: every possible fate of a piece of work has a name, a queue, and an owner.
An update to this story, and a humbling one: the most dangerous power you can give an autonomous system is the power to edit its own machinery — and this week we took that power back. Every recorded disruption in Carol's [{build pipeline}]{initiatives} traced to the same root: an autonomous fix applied to the factory's own guts — a diagnosis citing files that did not exist, an overnight rewrite of the orchestrator. So by Ninad's ruling, Albus's repair roles became recommendations-only, and the sole hand allowed on the pipeline's core is now Orion, the human operator. Note what did NOT change: the factory still autonomously detects, diagnoses and repairs the software it BUILDS — [{self-healing}]{monitoring} of the product is alive and human-free; only self-modification of the factory itself moved behind a person. This is [{least privilege}]{security} applied one level deeper: scope is earned by evidence, and today's models have not yet earned the right to hold the door to their own source. It is a pause, not a verdict — the scaffolding stays warm, waiting for models trustworthy enough to hand the keys back.