Nobody should both write and merge

When one agent can both change code and merge it, there’s no checkpoint between intent and production. That’s fine until the agent is wrong, and then it’s the whole problem.

Agent CI/CD is where I’ve made that rule concrete. The separation itself showed up earlier in the July 2025 orchestration notes (proposal and certification as different roles), and what surprised me building the control plane is how little of the work is the rule itself. The effort goes into keeping the checkpoint cheap: telemetry that shows exactly why a merge was blocked, and automated review that clears the easy objections, so the boundary never becomes the bottleneck people route around. Atlas later automates the fix-and-shepherd loop on the same boundary; orchestration engineering is the meta version of the same habit.

It reads like bureaucracy and works like a seatbelt. The interesting part isn’t the rule; it’s making the rule cheap enough that it doesn’t slow anything down, which is most of what the telemetry and the BugBot layer are for.