Three months under a 53-hour release: building Loft with Claude Code

A plant, not a factory

In July we wrote down the argument Loft rests on. Coding agents made a first version cheap, but they left the cost of acceptance where it was: showing that what was built is what was agreed. People and models both produce fuzzy output. A tired person half-finishes an edit; an agent fills a gap with a confident guess. The decision lands in code and stays there, and within a year the team reads the code instead of the document.

Our answer was deterministic gates. Tests have gated behavior for decades; we wanted the same gate on the specification. Our July deck framed it as factory against plant. A factory is agents, prompts, and orchestration. A plant is a controlled line where building and testing run on their own and work that fails a gate is turned away automatically. As we put it in a talk on July 20, "Coding agents are not enough."

Loft is the first pillar of that Software Plant. It keeps a product contract, the ratified specification that people and agents build against, and runs each change through the Loft loop: Author → Ratify → Implement → Reconcile → Decide. Yard, for coordinating production, and Berth, for operational feedback, remain directions.

July 10: a server in 32 minutes

V1 began as a spec-first rewrite: a thousand-line Markdown spec of an earlier prototype, down to three of its bugs not to repeat. The first commit landed at 13:41 and canonical hashing at 13:46. At 14:13 a server offered about 50 tools to coding agents over the Model Context Protocol (MCP). By evening it ran on a home Kubernetes cluster with an authoring skill. Deterministic static checks were in place from that first afternoon: hard limits on function length and complexity that fail the build, so sloppy agent code is turned away at the gate and the agent has to refactor instead of piling on.

OpenAI's Codex wrote most of the Rust core in July and August. Claude Code made its first commit on July 17, on the web interface, and by mid-September wrote nearly all of the code: over 90% of V1's October commits carry a Claude co-author line, and every commit of the open format does.

July 13: Loft becomes its own contract

On day four the Markdown spec was retired. Loft's specification, written into Loft through its own MCP tools, became the contract: about 300 nodes, pinned in the repository by a lock file. Every change took the same route: branch the spec, stage and review the edits, publish an immutable version, move the lock, write the code.

Loft is not the spec, Loft is the systems design floor.

Agents made a full specification affordable. Claude wrote nearly all of it; people corrected and ratified it. Corrections that recurred, such as criteria bundling two checks or a color choice filed as a requirement instead of a decision, became lint rules or agent guidance.

How a session ran

Every session ran the same loop, and the person steering held only its decision points. Anything corrected twice became a standing rule, so the loop got stricter with each pass.

Built, kept, and thrown away

Features cost days. Spec branching went from proposal to working code in two days; structured architecture decisions took one. Spec quality tooling took over 200 commits on September 22 and 23. Multi-tenancy shipped as v1.0.0 on October 2, followed by twelve patch releases in six days. The server reached about 300,000 lines of Rust and 2,000 tests.

Coding agents are extremely smart, fast code generators. We should experiment more, and not shy away from cutting whatever doesn't fit the product.

Cheap building made deleting cheap. A measurement-evidence protocol, an early step toward Berth, grew to about 20 MCP tools, 20 tables, and as many prototypes over ten weeks, then was deleted on October 4. A telemetry pipeline lived less than a month. Yard, an early task board, went from domain model to release in four days and was parked. Each removal went through the spec first.

The MCP surface grew from about 50 tools to nearly 90 in six days, until some agent clients stopped showing them. A compact surface of nine tools, later eleven, fixed that, while the full catalog grew to about 160.

Gates at five thousand nodes

Reconciliation, the check of an implementation against the published contract, ran across the whole server in late September: about 2,700 items and 1,800 proposed issues, worked through in severity waves by parallel agents. The first wave broke the build. Agents sharing one git index committed each other's staged changes, and since then agents commit named paths only.

In early October we turned the spec quality tooling on the spec itself. Lint findings had grown from about 300 to nearly 5,000. The review found nearly 800 issues with fewer than 500 root causes, nearly 30 of them decisions only we could make, and the fixes shipped as eleven published spec branches on October 7.

Sometimes the bug was in the spec. On October 9 we asked Claude why agents kept losing their connection to Loft, starting with a test that reproduced it on a simulated clock. The published spec gave every sign-in grant a 32-hour absolute lifetime. The fix was a spec change, then a release.

Performance followed one loop, whatever was slow. A one-edit write ran over 100 seconds in production because it re-inserted the document's whole history: about 75,000 SQL statements. Measured on a copy of the production spec and rewritten to store only the difference, it took about 100 statements and a third of a second. The same loop cut the everyday test gate from over 40 minutes to under 10.

What the server cost

By October a lot stood between an agent and the spec: a live, signed-in MCP connection to read it, a 60-second lease to write it, server-minted labels that a rejected create burned and a replayed branch renumbered, and no text form to edit or diff.

The question that started V2 was about two people.

If we choose git for a single user, will two separate engineers be able to work on the spec in the repo in parallel?

October 10: stress-testing the format

A question about an open-source edition of the server turned into a different one: what if the format itself were open, with the server as one implementation of it? We switched to Claude Fable 5.1 for a second view and asked Claude to stress-test the Loft document format against that idea. Six invariants came out of it: the content address covers meaning only; identity travels in the file; structure is stored rather than re-derived; process state stays out of the content; there is one text form, one canonicalization, and one versioned hash; and every version stays readable.

Claude also set the order of work. The files are the store, so the first release needs only one static binary. The converter from V1 comes first, because a 5,000-node specification is the best test a new format could ask for. And five properties of the text form let two engineers merge one spec in git: no derived data in files, identity in the file, order taken from file order, one file per unit of work, and a canonical formatter.

Ending the bootstrap

The next morning we turned down Claude's first plan. It wrote the new format's specification with V1's tools and left it there, so the open command line would have stayed specified by the private server it was meant to replace. The plan, Claude agreed, "forgot to end the bootstrap." The new one wrote the spec in V1 first and moved it into the repository as soon as the format could hold it.

A relay of about twenty subagents wrote that spec in an afternoon and evening, one set of changes each, in turn, because V1 allowed one writer at a time. Review agents read each branch, and fix agents worked through their findings, while the main session wrote the model and hashing code against the latest checkpoint.

At 21:06, five and a half hours after the first commit, the converter gate passed: V1's whole specification, converted to the new format and back, reproduced all of its roughly 5,000 node hashes. By 02:00 the format's specification lived in the repository as YAML, checked by the command line it specifies.

Then we asked "how are we going to make sure the V1 and V2 do not diverge where they should not?" Claude added a parity guard: every intended difference must cite the spec node that explains it, and any other difference fails a test. It caught its first one within the hour.

The Software Plant in one command-line tool

On the second day Claude brought the plan for publishing: loft publish, loft verify, the lock, and label allocation, all of which call git. We turned that plan down too: "git should be an external component; for tests you should create a git simulator that encapsulates the happy path and the errors we anticipate." The simulator was to be a new product in the spec, called the Software Plant.

That is the plant from July at the size of one tool. The Software Plant is a product in the format's own specification, and its job is to stand in for every system Loft depends on. Tests run the real loft binary, unchanged, against simulators instead of those systems: a git executable that answers the calls Loft makes from a scenario the test writes, such as a clean repository, uncommitted changes, a detached HEAD, or a merge stopped on a conflict, and refuses every other call; a clock that fixes the time of a publish; and, later, a telemetry collector and a release feed on loopback ports.

The plant earned its place within hours. After the first publish, continuous integration went red on GitHub's runner and nowhere else. Since git 2.46, every git commit starts background maintenance that writes a lock file, and a test checking that reading the repository changes no file caught it in the test setup's own commits. The fix was one flag in the test setup. Claude declined to teach the simulator that behavior: Loft never runs that command, and the simulator answers only the calls Loft makes.

Fifty-three hours to public

By October 16 the format's own spec held over 550 requirements and 2,000 acceptance criteria, against about 70,000 lines of Rust, more than half of them tests. Nearly 300 subagents and about 17,000 tool calls got it there.

1. Oct 11, 15:33

   First commit

   An empty repository. The 53 hours start here.

2. Oct 11, afternoon

   Corrections become rules the same day

   1. A person corrects Claude
   2. The rule goes into memory or the agent guide
   3. Every later session starts from it

   "You should first propose, and then separately accept an ADR." "Each lint rule must become a separate RQ with its own ACs." "I mean, ProductID, FeatureGroupId, etc." Each one changed every decision, lint rule, and node kind that followed.

3. Oct 12, 02:00

   The spec moves in, and every change runs one loop

   1. spec: commit
   2. loft fmt gives keys
   3. loft check on its own spec
   4. Code commit
   5. loft publish assigns labels
   6. loft verify

   Labels are assigned only on the main branch. After each publish, a second one must report that nothing changed. Nearly 80 of the first 400 commits are spec commits.

4. Every stage

   Build, review, break, commit

   1. Explore agents map the code
   2. A Plan agent stress-tests the design
   3. Stage agents build
   4. /simplify and /code-review: reviewers in parallel
   5. Break the code on purpose, watch the right test fail
   6. Commit on a green gate

   Plan agents found real flaws in Claude's own merge design. The reviewers caught a formatter that reported success on a tree the reader then rejected.

5. Oct 12, 12:16

   The person steering keeps the decision points

   "Do not merge into develop without my approval for V2 from now on." Plans, answers, ratified spec versions, merges, and later every release stay with a person.

6. A person caught it

   Oct 12, 16:17 to 18:23

   "Do we have a case where the conflict is because there are two different items under the same label?"

   Claude's merge designCovered the conflicts git reports

   The person steeringAsked about the one git merges without a word

   Claude's design had missed it. Within minutes Claude reproduced it in two throwaway clones: two branches could publish the same requirement number, and git merged them cleanly. Two hours later loft publish settled a stopped merge or rebase, renumbered the newcomer, and rewrote prose that cited the old label.

7. Oct 13, 18:53

   The agent skill

   loft init installs the loft-spec skill for Claude Code and Codex, so the agent that writes a spec gets the rules for writing one.

8. 53hours from first commit

   Oct 13, 20:27

   Public: version 2.0.0 on crates.io

   A person changed the repository's visibility and ran the publish; Claude Code's permission classifier stopped Claude from doing either, and Claude left it there.

9. Oct 13, 21:24

   2.0.1 on npm as @ask-loft/loft

   The repository's README (github.com, opens in a new tab) states the workflow: "You write a specification by talking to a coding agent, not by editing YAML."

"Only half of the ACs?"

On October 14 the command line gained loft reconcile and a trace file that links each criterion to its tests. Each link stores the criterion's hash at review, so rewording a criterion makes its links stale. The first seeding, from old test names, linked about half the criteria. We asked: "OK, so we only have evidence for half of the ACs in the tests?"

Claude sent eight agents, one per area of the code, and kept only the links they were sure of. When we asked "Why is this taking so long", it moved the remaining stages into parallel git worktrees. By mid-afternoon all but a handful of nodes were linked, and seven defects were fixed along the way, each with a test that failed first.

That evening a second Claude Code session ran the same process on this website. It imported the site's roughly 1,000 nodes from V1 with loft import v1, keeping every label, and seeded a trace. Ten reviewer agents read its roughly 750 links: nearly 600 held, about 150 were partial, and a few pointed at the wrong test. Fix agents closed the gaps, fresh agents reviewed the fixes, four real bugs in the live site came out, and tests grew from under 700 to over 800. It took under two hours, including a deploy a person started by hand.

What the gates caught, and what got past them

The build went wrong in ordinary ways. What matters about each failure is where it was caught.

Each failure was caught by something other than the agent that caused it: a reviewer, a trial transcript, a permission check, or a person. That is the case for the plant.

After the release

Release 2.1.0 on October 15 taught the command line to read OpenSpec, the format from our study How good are OpenSpec specs? loft import openspec turns a project's main specs into a Loft spec, and loft render --openspec writes them back. Every one of the 60-odd public projects with main specs survived import, render, and re-import.

Loft today is the first pillar: the product contract, coding-agent work against it, reconciliation, and a person's decision whether to accept the result. The worked example takes one change through all five stages, and the open format and command line run that loop in a single repository for a small team. Yard and Berth remain directions. What the three months under the 53 hours suggest for them is the same thing they showed for Loft.

Agents produce plausible work faster than anyone can read it. The line has to turn work away on its own before people can afford to accept what the agents make.

That line is easiest to judge on a spec you already know. If yours lives in OpenSpec, one import brings it into Loft, the first loft check shows what the line would turn away, and loft render --openspec takes it back out whenever you like.