Deep dive — codebase & ground truth
All findings dated 2026-07-18, from three recon agents over fresh clones + 34-agent legacy fleet run. Evidence IDs [E1]–[E10] are cited by the steelman court (04) and matrix (00).
Current state (codebase)
[E1] Zaruba greenfield doctrine — repos/monorepo-development
75 commits, sole author Tomas Zaruba, repo 2 days old, ~86k hand-written TS LOC, runs (pnpm backend:core boots Encore against Docker Postgres; ~660+~84 tests green per _documentation/coverage-status.md).
Doctrine (reasons-and-decisions/01, 04): rebuild-from-audit, not porting. AI measures legacy via 30-day production telemetry (HOT/WARM/COLD/DARK buckets) → business+engineering panel signs scope (burden of proof on KEEPING a capability) → build to Given/When/Then use cases → dual-run/shadow comparison until parity (“Dual-run live by week 6… write ramp 1→100% through M3 with ledger reconciliation ≥99.999% before each step”) → legacy turns off. Legacy code is evidence, never input. 4-person “Strike Unit”, M4/M8/M12 kill gates, serial flagships (Orders → Deal Factory → Merchant-Everything → Inventory/Booking).
[E2] Two-plane architecture — BUILT
apps/backend-encore-core-ts (19 services, human-gated CODEOWNERS) + apps/backend-encore-internal-ts (6 services; reads core via generated client, writes only via core proposal endpoints: submit → validate → apply/reject → audit). Quote from decision log: “hundreds of agents need structural, not procedural, boundaries.” Claude-only tooling (root CLAUDE.md + .claude/rules, decision #12); .claude/skills/ as institutional memory; reasons-and-decisions/11-environment.md explicitly designs for hundreds of agents: merge queue (planned, not built), machine-generated docs/services.json, ADR folder as shared memory, worktree-safe parallel work, budget alerts as a design case.
[E3] Zaruba services overlapping our candidates — BUILT
tasks(core):TaskType.INFORMATION_REQUEST/APPROVAL/SIGNATURE, assignee user or group queue,TaskWorkflowStamp(workflowId/runId/signal — workflow mints task, human answers in Admin UI or public tokenized link, completion signals workflow back). Generic human-task infra; no agent-scale dedup/batching/rate-limits.workflow-management(core, 50+ files) +workflows/_coreTemporal worker pool +workflow-proxy(internal plane): definitions/executions/logs/schedules CRUD, attach-when-present dev mode, fail-loud cloud mode (decision #24), versioning discipline, working admin UI screens (execution table, timeline, logs, signal-send). One real business workflow (merchant-contract-signing).service-management: catalog only (name/owner/tags/contacts). Health probes, cost queries, alert-policy sync, GCP incidents, OpenAPI diffing deliberately dropped — “re-added later, never inline.”mcp: OAuth2 + tool-registry skeleton; onlyping+ docs tools (docs_tree/docs_get/docs_searchover thedocsservice which mirrors_documentation/with adocs-sync.mjsfreshness gate inpnpm validate). Zero code-graph tools.
[E4] Not built / actively rejected
- No LiteLLM gateway in greenfield (old estate’s
ai-gatewayexists but greenfield is Claude-only by decision #12). - MBUS rejected: “
orders_mbus_client(Java) — DROPPED, replaced by direct Pub/Sub and the Adyen webhook.” - No codemods (zero hits: ast-grep/gritql/codemod), no knowledge graph, no fleet monitoring (frontend-admin has orphaned
ServiceHealthDashboardcalling endpoints that don’t exist — dead ported UI).
[E5] repos/monorepo-infra — 0% provisioned
Temporal (Helm 0.62.0, Postgres-only persistence, numHistoryShards: 512 permanent) + Grafana (Helm 8.5.1, zero dashboards, zero alerting) + GKE Autopilot — all scripted idempotently, nothing applied; blocked on human-only GCP billing/quota gate. Temporal wired for exactly one consumer (workflow-management service). Ops doctrine strong: WIF-only (no JSON keys), budget alerts (25k CZK/mo), AI-first runbooks + 3 operational skills.
[E6] Legacy estate sample — analysis/legacy/
26 repos / 11GB / 34-agent fleet: ~1.05M active backend LOC (Ruby 702k, Java 349k) vs 2.8M vendored. Hubs by in-degree: orders(9), voucher-inventory-service(8), deal-catalog-jtier(7), users-service(6), billing-record-service(5). MBUS load-bearing in 16/33 components. Two half-finished strangler migrations rotting in code (VIS3 still calls legacy VIS; identity-service abandoned 2022). EOL runtimes (Rails 3.2 / Ruby 1.9.3–2.6 / JRuby 1.7) → running legacy for characterization is itself an engineering project. ~12% delete candidates in a curated sample.
Constraints
- [E8] Collision constraint: Tomas is decision-bound (“víc agentů mi nepomůže”), his human hours ARE the rulebook;
monorepo-developmentis the system of record; startup-mode process until ~2027-01; Robert’s committed lane = execution tooling + fleet monitor. Collision protocol designed inresearch/12: CODEOWNERS partition, claim-before-work queue, OWNERSHIP.md, MADR ADRs with DRI, ≤8–10 worktrees/host, one committer/host. - Review capacity is the scaling constraint: AI-authored PRs wait 4.6× longer for review, 32.7% acceptance vs 84.4% human (research/12 §1.7).
- Infra billing gate (human-only) blocks any provisioned runtime; local/dev-mode work is unblocked.
- [E10] Robert’s constitution: Postgres-first, simplicity, agentic-fit, DDD, TDD seams, named evolution paths.
Candidate tech — docs findings
No new technology enters the decision: every option composes already-vetted tech (Temporal via Zaruba’s platform, Encore.ts, OTel→Prometheus→Grafana per research/12 §2, Postgres, Tree-sitter). See research/02-web-research.md for the original tech sweeps.
Negative results
- [E7] Fleet-monitor market: nothing off-the-shelf covers 50–100 sessions with task-level metrics (confirmed twice: doc 12 pass + 02-web-research §7). Terragon dead, Conductor macOS-only, sniffly stale, Vibe Kanban relicensed-not-maintained.
- Question-triage market: HumanLayer deprecated;
langchain-ai/agent-inboxonly live reference (LangGraph-coupled). Dedup/rate-limit/stakeholder-overload unsolved in public literature. - 1000-concurrent orchestration: no published prior art (best documented: Bun, 64 concurrent).
Assumption log
| # | Assumption | Why unverified | Impact if wrong |
|---|---|---|---|
| A1 | Tomas will accept Robert-owned services in the internal plane (or a factory path) under CODEOWNERS partition | Not yet discussed — answer draft research/14 unsent |
Options B/C need a Robert-owned repo fallback that consumes Zaruba’s APIs cross-repo |
| A2 | Dual-run/shadow machinery is NOT already built by Tomas beyond the merchant-accounting reconciliation oracles | coverage-status shows no generic harness; but repo moves fast (75 commits/2 days) | Harness scope shrinks to per-domain adapters — still Robert-ownable |
| A3 | Billing gate resolves within weeks | Human-only GCP quota step | Fleet monitor runs local-Grafana/dev-mode first; Temporal stays attach-when-present |
| A4 | Legacy production telemetry (for audits + shadow traffic) will be accessible to Robert’s fleet | Old-estate DataDog/GHE tokens exist, GCP greenfield differs | Knowledge-graph/audit tooling limited to static evidence until telemetry access lands |
| A5 | Josef Sima’s involvement in groupon2 unknown | Doc 11 open question #2 | Bus-factor and review-capacity math changes; collision protocol gains a third party |