Document begins

The agent ecology

The honest summary of AI’s role in this project is not “AI built a community campaign” and not “AI helped a bit with the writing”. It is this:

A group of volunteers with day jobs used five different AI systems to do the research, drafting and review work of a much larger team, inside a constraint architecture designed on the assumption that every one of those systems would confidently tell them something false.

That assumption was correct. It happened repeatedly. The interesting part of this record is not the output — it is the machinery that made unreliable systems produce a trustworthy corpus anyway.

The roster

Five systems did substantive work. They were not interchangeable, and they were not used interchangeably.

None of them had authority. Every one of them was wrong about something load-bearing at least once.

The constraint architecture

The contracts were layered, and read in a fixed order — base first, shared prompts second, role overlay third, task brief last — deliberately matching the model’s own priority ordering.

   Base contract          FACT / ASSUMPTION / CHOICE / RISK / TODO
        │                 conclusion first · name uncertainty · no borrowed authority
        ▼
   Shared prompts         stage discipline  ·  claim language  ·  escalation rules
        │
        ▼
   Role overlay           19 seat and stream contracts (steering seats, working groups)
        │
        ▼
   Task brief             the actual question

Three shared prompts did most of the safety work, and all three are short enough to read in a minute — they are published intact on the constraint architecture page.

• Stage discipline pinned the whole project at Stage 1: gauging interest and told every agent that if a requested statement belonged to a later stage, it must be labelled RISK/ASSUMPTION/TODO or escalated. This is what stopped the drift from “could this work?” to “here is the offer”.
• Claim language enumerated the things no agent could state or imply: that the property was available, that the owner was willing, a fixed return or repayment schedule, that a co-op could hold a liquor licence, that a case study was real or analogous. “When in doubt, phrase the point as a question, constraint, or next-step item.”
• Escalation rules listed the topics on which an agent could identify issues and options but must not present an unreviewed recommendation as settled fact: legal structure, returns, licensing, member rights, public wording, forecasts, owner-willingness.

Underneath the prompts sat machinery that did not depend on any agent complying. A claim scanner grepped the project’s own text for banned language and failed the build. A test suite verified every inline style and script hash against the site’s content-security policy. Neither can be talked out of a finding.

Where the agents caught things

An AI read the founding documents and found a securities offence

The original proposal — written by humans, in good faith, before any of this machinery existed — promised community investors a 5% annual dividend, capital returned at year 15, and a first mortgage over a $2.5M+ property as security.

The first thing the project did with an AI was point Gemini at those documents with a prompt whose second line read: “Your job is NOT to make the project more exciting. Your job is to make it more defensible.”

Its top finding, ranked Critical, was that the three promises together constituted an unregistered public offer of debt securities — the kind of thing that triggers ASIC consequences if marketed to the public. Every one of those claims was stripped, and the prohibition on re-introducing them became a line in the base contract, a rule in the claim scanner, and a permanent entry in the project’s guardrails.

This is the single highest-value thing any agent did on this project, and it happened in the first week, to the humans’ own work.

An AI was told to attack the project’s own finance language

Once the finance assumptions book existed, Claude was pointed at it in the role of financial model skeptic, with an instruction that is worth quoting because it is the whole method in one line:

“Do not create a forecast. Create the structure required before a forecast can be trusted.”

The resulting safety report flagged 11 items and rated the book MEDIUM risk — explicitly not HIGH, because the book’s own confidence-label system and its blanket “no number here is approved for external use” caveat were a strong defence. The flagged risk was leakage: figures correctly hedged in place that would read as promises if lifted out. The recommended fixes were things like moving a comparable co-op’s interest rate out of a table column headed “Figure” and into one headed “Notes”, with a bolded warning that it was not a Cygnet rate.

That is a nitpick. It is also exactly the sort of nitpick that becomes a screenshot.

An AI debunked the precedent the proposal was built on

The original documents leaned on a UK community pub as proof the model worked. Verification found it completely debunked: the pub was not a community-owned co-operative at all. A family had bought it in 1991 and privately invested about £2 million restoring and reopening it. Two further case studies were also found to be debunked or structurally incompatible with Australian co-operative law.

The flagship example in the project’s own pitch was false. It was removed, and the cleaned case-study register records why.

Where the agents were wrong

This is the more useful half.

Three agents reviewed a plan; the adjudication rejected several of their findings

Before a large site migration, the 1,440-line plan was reviewed adversarially by Codex, Gemini and Hermes independently, and then every finding was adjudicated by Claude against the actual repository — grep and read, not recollection. Findings the agents got wrong or overstated were explicitly marked REJECTED or DOWNGRADED, with evidence.

The most instructive systematic error: because both the plan and its specification were in context, the agents conflated line numbers between the two documents. Several confidently-reported “plan defects” were drift in the spec that the plan had already fixed. Three independent models made versions of the same mistake, which is a useful reminder that model diversity buys less independence than it appears to.

The real defects the process found were real — a compile risk in a template, and, more interestingly, a build gate that could not have caught it: the plan’s verification step ran a build at a moment when the file in question was not yet imported by anything, so it would never have been compiled. An illusory gate is worse than no gate, and no single reviewer had spotted it.

An agent raised a blocker that dissolved on inspection — and was still useful

Reviewing a pull request, Hermes reported a blocker: an inline style block’s hash needed recomputing in the security headers, or the page would break under the content-security policy.

Verification against the code found this was a false alarm. The style in question was not inline at all — it was written to an external stylesheet and linked, which the policy already permitted. No header change was needed, and the build was green in a way consistent with that.

But the reason Hermes got it wrong is the interesting part: the project’s own specification document wrongly claimed the style was hash-pinned. The agent had read the documentation and believed it. The agent was wrong about the code and right that something was broken — the documentation was the actual defect, and it would have gone on misleading the next reader.

In the same review, four further findings were confirmed as real-but-latent, one was downgraded from high to low severity after being empirically tested rather than reasoned about, and one flagged a possible privacy problem in a name that turned out to be an insolvency firm rather than a person.

The rule that came out of all this

The project ended up with an explicit standing instruction, written after enough incidents to justify it:

Verify every named specific in an agent’s output against the primary source. The figures may be right while the specifics are invented.

That is the actual lesson. These systems fail in a particular way — the shape of the answer is right, the reasoning is often right, and a zone code, a surname, a line number, a regulation name or a file path inside it is fabricated with total confidence. A reviewer who checks the conclusion and not the details will pass a document that cannot survive a reader who checks one link.

And they were not always available

The QA record includes a reviewer being routed to a different provider entirely because its usual endpoint was rate-limited and its only fallback was also exhausted. There is a note, in the project’s own working memory, that one agent simply returned “no final response” on file-reading review tasks three times in a row. This is infrastructure, and it fails like infrastructure. A campaign on a three-week clock cannot treat any of it as reliable.

What the humans kept

The gates were never delegated. Public releases, fundraising and return language, owner-willingness claims, legal-structure recommendations and forecast financial models all required human sign-off, and the base contract required agents to say so rather than proceed.

In practice the humans did three things no agent did:

1. Verified rather than obeyed. Every load-bearing specific in an agent’s report was checked against the diff, the code, or the primary source before it was acted on. Agents that reported blockers had their blockers tested.
2. Made the choices. Twenty-three decisions were mapped; the agents mapped them, laid out the trade-offs on each, and did not make any of them. No agent ever wrote a decision into the log — and, as it turns out, neither did anyone else: the log in the repository is empty, and its only three rows are pre-drafted examples that still carry their placeholders.
3. Overruled on judgement, not fact. An AI-generated video was removed from the site not because it was bad but because AI-generated media is divisive enough to give people a reason to discount the argument before hearing it. No agent would have reached that call, and it was the right one.

The claim worth making

If there is a transferable finding here it is not that AI can do civic work. It is that a heterogeneous fleet of unreliable systems, made to disagree with each other in the open and checked against primary sources by humans who did not defer to them, produced a body of work that survives scrutiny — and produced it at a scale a handful of volunteers could not have reached otherwise.

The corpus in this archive is the evidence for that claim. So is the fact that its worst error — a legal fact inverted while removing identifying details — was caught by a human reading the derived copy against the original, at the last gate, after every automated scan had passed.