Side project · Running log
Building Bluecliff
Bluecliff is a side project, an app to assess the security of the suppliers and partners a company depends on. This page is about how I build it, more than about the app.
I have three reasons for it: a problem I met in my audit work, technology I want to learn, and a way of working I want to test. The engineering team is made of AI agents, and I'm the only human on it. There's no funding and little spare time, so it has to stay cheap in money and in attention.
This is the log, newest first. Numbers come from GitHub and Linear. The failures stay in.
Product
A problem I met in my audit work, and an app to try a better way of handling it.
Now: Proof of concept. The first screen works on a private preview.
Technology
Recent technology, such as decision models, used for real. Building with it is the fastest way I know to understand it.
Now: Lessons will be shared here. Bluecliff's own design stays private.
Agent team
An engineering team made of AI agents on frontier models, run in Claude Code, with me as the only human.
Now: Three feature owners, plus QA, DevOps and an Orchestrator.
Timeline
October 2026
- Day 4
· Day 4
Product · Chapter
Thirty merges and nothing on the screen
A night of green merges, and no new screen in the app. Why six specialised agents shipped less than two, and what replaced them.
Read the chapter - Day 4
· Day 4
Agent team · Reflection
The sweet spot between rules and freedom
Prose rules were too weak and the lane guard too strong. What held was a few machine checks at the edges and room to decide inside them.
Read the reflection - Day 4
· Day 4
Product · Reflection
The cost of a mistake moved
With agents, changing code got cheap. What users see, their data and my attention did not, and that changes what I decide first.
Read the reflection - Day 4
· Day 4
Agent team · Reflection
Agents need their own way to talk
My agents coordinate the way people do, through tickets and comments, once an hour. Why that is the bottleneck, what exists, and what a tool built for agents would need.
Read the reflection Show 7 log entriesHide 7 log entries12 Oct to 13 Oct
- Day 4
· Day 4
Agent team
A failure nobody noticed
The second model's security review had stopped running the day before. Only 25 of 105 security requests ever ran, and the agents kept asking for it without noticing.
Product
Proof of concept first
The priority is a working proof of concept, not a production app. Progress is now counted in screens that work on the preview, not in merges.
Agent team
From a pipeline to owners
Three full-stack builders now each own a slice of the product and write their own tests. QA runs the whole flow once a day instead of gating each change. The role guard now catches honest mistakes and no longer tries to be a sandbox.
Product
No new screen overnight
30 pull requests merged during the night. Three were features and none was a screen. The four screens the proof of concept needs had been open for more than a day.
- Day 3
· Day 3
Agent team
A guard that kept growing
A hook keeps each agent in its lane by reading the shell commands it runs. Every review round found a new way around it. It grew to 2,433 lines, and most of the night went to fixing it.
Agent team
The review budget runs out
The second model reviewing every change posted 396 reviews on its first day, against a target of 40. Its weekly quota went in one day. It now reviews only high-risk changes, with a cap on rounds.
Agent team
First night with six roles
29 pull requests merged while I slept, and requests between roles were picked up within the hour. One question left waiting for me held four pull requests for four hours.
- Day 2
· Day 2
Agent team · Chapter
An org chart made of agents
From an empty repository to six agent roles with steps, lanes and gates in two days, and where I became the bottleneck.
Read the chapter Show 4 log entriesHide 4 log entries11 Oct
- Day 2
· Day 2
Agent team
Seven roles, written down
Each role owns a step and has files it never touches. The document describing it took 16 review rounds and 55 findings before it merged.
Agent team
CI stops for two and a half hours
Every CI job failed from early afternoon because of a billing block on the GitHub account. CI moved to my own servers the same day, where about 50 runs soon queued for two slots.
Product
Thirteen app features in one day
With one development session working beside the Orchestrator, the foundations of the app merged in a single day: 13 features, from the scaffold to the first working list.
Agent team
Agents merge their own work
Once CI and review pass, agents merge. They need a go-ahead from me for four things only: money, secrets, customer data, and anything that weakens a gate.
- Day 1
· Day 1
Product · Chapter
Why I'm building Bluecliff
A side project with three goals: a problem I met in audit work, technology I want to learn, and an engineering team made of AI agents.
Read the chapter Show 2 log entriesHide 2 log entries9 Oct to 10 Oct
- Day 1
· Day 1
Agent team
Foundations before a product
The repository started generic, with a base any project could sit on: rules for the agents, a security baseline, and a review by a different model on every change. Then four roles, with Linear as the one place where work is planned and handed off.
- Day 0
· Day 0
Product
Product and design before code
The product idea, a design system, a brand and a clickable prototype came first, the evening before the repository existed. The tech stack came last.