Insights ·
Type “next.”
Goldman Global's founder runs the AI side of his travel business — the company behind explorechinaholidays.com.au — with, on many days, a one-word instruction. This is the operating loop that answers that word — and the audit trail that keeps it honest. We're publishing it because it's the same delivery discipline we sell, running on a real business first.
One word in, nine stations out
Type “next” and the loop turns once. The output isn't a chat reply — it's merged code, a recorded verdict, and a written memory. Here is the whole factory:
- 1Intake. Anything the owner says, forwards, or screenshots lands as a raw note — nothing is lost in a chat scroll-back.
- 2Ticket. It's checked against live systems, risk-tiered, and written up as a ticket with an acceptance test attached.
- 3Seat. An engineer seat opens a fresh worktree for the ticket. No seat inherits another seat's context.
- 4Build. Code, copy, or config — the ticket defines “done”, not the model's enthusiasm.
- 5Checks. Types, tests, lint. On the ship audited below, a 240-test suite plus type and edge-function checks were re-run green — by a session with no stake in the answer.
- 6Gate. Customer-facing work stops at a review card that can only answer PASS, FAIL, or AMEND.
- 7Land. A pull request with a merge guard: database migrations land before the code that needs them.
- 8Cold audit. A brand-new AI session that heard none of the day's claims re-verifies the record from scratch, read-only.
- 9Memory. What actually happened is written into a git-markdown vault that the next cycle reads first.
Why this isn't “one LLM, one prompt”
Most AI-assisted work is a person and a chat window: the context lives in the scroll, the memory is whatever didn't get cleared, and the only verification is a human skim-reading. The loop owns the three things a prompt can't:
Context
Work moves between sessions through written handoffs. A seat boots from the ticket and the vault — not from a transcript of everything anyone ever said.
Memory
Decisions land in a git-markdown vault — one board, one ledger, one graph. When two records disagree, that's a bug with a paper trail, not a vibe.
Verification
Watchdogs hold gates open until a verdict exists, and a fresh-eyes audit re-checks the day from zero. Claims have to reproduce, or they get corrected in writing.
And authority stays where it started. The founding law reads “the seat proposes, the CEO ratifies, Finn vetoes”, and names the human founder as the loop-breaker of last resort. One word in — but the veto never left the room.
A company chart you can grep
The org itself is written down: a ten-node registry — the founder's board, agents, a human-driven seat, the watchers, and the customer-facing plane — arranged in a star of depth one, every machine-to-machine channel registered as an edge with an owner and a named failure mode. A heartbeat table probes each seat every cycle and publishes what it finds — including the unflattering lines. Dormant seats are marked SHELL, a cold reviewer is marked real-but-cold. The founding law's rules include “detection before rendering”: report what's true before painting anything that depends on it.
Verification with teeth
Customer-facing work stops at a review gate that must answer one of three words — PASS, FAIL, or AMEND — scored against written bars: 0.70 safety, 0.85 honesty. A gate can't quietly close without a verdict; a watchdog holds it open. Independently of that, migration-scanner checks run in CI on pull requests that touch migrations or audit-gated paths — reject-rollback-files, reject-irreversible-patterns, and cron-schedule-arg lint in the migration guard, plus the audit-evidence guard. Four checks in total — all four green on the head of the gated ship cited below.
Then the part we're proudest of: the cold audit. On 1 September 2026, that day's entire record was handed to a brand-new AI session — zero prior context, read-only mandate — with one job: prove it or flag it. The result: 16 of 18 checks reproduced live, including a green 240-test suite re-run from a scratch checkout. The two that didn't reproduce became recorded corrections: a gate card was actually held “in review”, not closed, and a database migration was correctly sitting on its branch rather than the main line. The audit even caught the day's flagship pull request had drifted into conflict with main — it was re-merged and the full suite re-run green before the record was amended.
That's the point. The loop isn't credible because nothing goes wrong. It's credible because whatever goes wrong is found by a session that owes nobody the benefit of the doubt, and the correction is written down where the next cycle reads it first.
The law on the wall
“10 good workers with a nervous system, not 1000 agents without one.”
That's how the founding record defines the system — followed immediately by what it must never do: hold money on its own authority, publish without a gate, or rewrite its own constitution. Boring boundaries, kept on purpose.
This is what we mean by “AI delivery”
Gates, receipts, and a memory that outlives any single chat — that's the standard we hold our own systems to before we'd hold yours to it. If you want AI output you can audit, not just admire, start with a free AI Audit and we'll map the loop your business actually needs.
Evidence appendix
Every factual claim above is quoted from our internal engineering vault for the ExploreChina Holidays system. That vault is private, so instead of links we quote the exact lines, each with its source and date — the one public surface of that system is the live ExploreChina Holidays site. Pull-request numbers are given so records can be produced on request at hello@goldmanglobal.com.au.
1. The loop, as written
“intake → ticket → seat (fresh worktree) → build → checks → risk-tiered gate (ACA verdict) → land (PR) → fresh-eyes audit (a brand-new AI session cold-verifies the record) → memory written down”
Source: Internal ticket T26 (EXP-399), 1 Sep 2026. Quoted verbatim.
2. The founding definition
“The org's pre-AGI collective intelligence: 10 good workers with a nervous system, not 1000 agents without one. … NEVER: autonomous money, ungated publishing, self-amending constitution. Finn = loop-breaker of last resort.”
Source: Founding record, internal vault — landed by PR #336 (merged 1 Sep 2026). Quoted verbatim.
3. The cold-audit result
“16/18 brief items reproduce [LIVE] cold — … 240/240 vitest + tsc clean + deno clean re-run in a scratch tree of the tip. Two corrections: (1) GATE card EXP-395 is in_review, NOT done … (2) migration lives on the T8 branch only, not origin/main (correct per migration-first).”
Source: Seat-mailbox entry from the independent audit session, 1 Sep 2026. Quoted verbatim.
4. The gate mechanics
“verdict format `VERDICT: PASS, FAIL, or AMEND` + 0.70/0.85 bar ref … close-guard = native watchdog + Sentinel GV1 (EXP-314).”
Source: Seat graph, edge E4 row — landed by PR #334 (merged 1 Sep 2026). Same verdict format on edge E8, the customer-facing publish gate.. Quoted verbatim.
5. The honesty marker
“Head of Sales … SHELL — dormant since 07-15, no routine, no cron wake. … ACA … real-but-cold.”
Source: Seat graph §2 heartbeat table, probed 31 Aug 2026. Quoted verbatim.