July 2026
The only implementation of our budget was named NoBudget
Our agent budget interface had exactly one implementation, named NoBudget, that never capped anything. The types checked and the guarantee was absent, which is the defect a model author produces at scale, and the reason correctness has to move out of the reviewer and into the grammar.
title: The only implementation of our budget was named NoBudget summary: When the author of the code is a model optimizing for plausibility, hardening the reviewer is a losing race; the move that works is to shrink the space of programs you can even write until the wrong one no longer parses. date: 2026-07-09
For a while, three of our apps shipped a trust rail that did not exist.
The agent stack has a Budget interface: before any agent effect runs, the gate calls Check, and after, it records the spend, so a runaway loop hits a daily dollar cap and stops. The interface was there. The call sites were there. The wiring diagram had the box. What it did not have, anywhere in the module, was a single non-test implementation that caps anything. The only one was named NoBudget, and its doc comment said, without embarrassment, that it “never caps and never records.” moneybox handling real user financial data, cstore’s Oracle, every generated MCP mount: all of them composed the gate with NoBudget in the slot. The types checked. Go was happy. The guarantee was absent, and nothing in the build could tell, because a correctly-typed no-op is exactly as well-typed as the real thing.
That is the failure I keep coming back to, because it is not a bug in the usual sense. Nobody wrote wrong code. Every function did precisely what its signature promised. The gap was between what the code said it did in the diagram and what it did in the binary, and that gap is invisible to a compiler, invisible to a test suite that mocks the budget, and, it turns out, invisible to a code reviewer skimming for whether the shape looks right. The shape looked right. It was permissive-by-default, and permissive-by-default rots exactly this way: the seam is exercised, never bypassed, and quietly does nothing.
Here is why that matters more now than it would have two years ago. The author of the code is increasingly a language model, which is a conditional distribution over tokens trained to emit the most plausible next one. Plausible is its whole job and its strongest axis. A model will produce a gate wired to NoBudget that reads beautifully, names the ADR in a comment, and passes review, because “reads like a correct trust rail” and “is a correct trust rail” are different properties and the model is optimizing the first. So the instinct to catch this with a better reviewer, a stricter eval suite, one more grading pass, is a race you lose by construction. You are hardening the grader against the one thing the author is best at producing: output that grades well.
The move that is not a race is orthogonal. Stop trying to detect the plausible-but-wrong program after it is written. Shrink the space of programs you can write until the wrong one is no longer well-formed. The small version of this idea is old: make illegal states unrepresentable, parse don’t validate, push the check from the reviewer’s judgment down into the language’s grammar so the bad value cannot be constructed. The bet we made is that this scales past a single type, up to an entire codebase and every I/O a platform exposes.
Concretely, it looks like a compiler. Every surface an app exposes, its HTTP operations, its MCP tools, its authorization relations, its event streams, its WebSocket frames, its jobs, is a declaration in the OpenAPI spec, and the set of things you may declare is a closed-world registry: a Go slice of blessed x-* grammars. Write x-mcpp by a typo, or invent x-authz-relations because it sounds real, and the spec lint rejects it as an unregistered key in a reserved namespace. It is a hard error at the author’s line, not a silent drop. Generators lower each declaration into Go and TypeScript, and they are generic transforms, fixture-tested against synthetic grammars, forbidden by arch-lint from importing any app. A generator here never knows what a budget is. It emits mechanics; the essence stays hand-written. That boundary is the whole lesson of model-driven architecture, which drowned trying to generate the essence: the moment your generator understands your domain, you have moved the plausible-but-wrong problem into the generator and lost.
Then there is the census. A totality check enumerates every surface actually used in the tree and subtracts the ones declared. The remainder, used and not declared, is a red gate and a complete work-list, never a sample, with a shrink-only baseline so a newly-invented class of surface lands at zero and can only go down. Name resolution runs the same way: an authz relation that does not resolve against the declared authz model fails at the author’s line, not at a 403 in production three weeks later. Boot audits are the linker: a declared operation with no handler refuses to start the process. Correctness has become well-typedness, completeness has become a totality check, and “done” has become a computation the environment runs rather than a sentence the author writes.
That last property is where the builder fleet changed. An agent finishing a ticket cannot declare success. Finished is moon run <app>:check passing plus a post-merge gate that reruns everything and blocks the queue on red. The agent’s claim carries no weight; only the check does. This is the same principle as NoBudget, run in the other direction. There, a plausible claim (“the trust rail is wired”) was false and nothing caught it. Here, we refuse to let the claim exist as anything but the output of a command.
So the claim is narrow, and worth stating narrowly. None of this makes the wrong program impossible. It makes a growing class of wrong programs unrepresentable, which is a smaller and more honest thing. The census remainder shrinks toward zero and, on any real day, is not zero. The generator that never knows what a budget is also cannot check that a budget is generous rather than absurd; that is essence, and essence stays in a human’s or a model’s judgment, gated but not typed away. NoBudget itself we fixed the ordinary way: flip the default to enforced, assert the wiring per app, a boot-time check plus a review convention, stated as such and not oversold into a grammar it does not have. What the substrate earns you is exactly the failures that were always structural and were being caught by hand. Not that wrong is impossible. Just that a widening class of it no longer parses.