The Fleet Ledger Method: Running Many AI Agents and Still Signing Off

Getting one AI coding agent to write good code is no longer the hard part. The hard part is running several at once on real systems, some of them in regulated fields, and still being able to answer a simple question before anything reaches production: how do we know this is right?

The Fleet Ledger Method is how we answer that at R Software. It grew out of our own day-to-day practice. The core idea is short:

Agents can work in parallel only if every unit of work is bounded, checked in a separate session, landed with proof, and cleaned up. Every stage leaves proof in a ledger, and the ledger is what a human signs.

The seven stages

1. Brief: define done first. Before an agent starts, we write an intent brief and an acceptance contract: what should be true when the work is finished, and how we'll check it. Reviewers later measure the work against the contract, not against their own taste.
2. Dispatch: parallel sessions, each with its own space. Every agent session gets a name, its own worktree and its own budget. Sessions don't share scratch space, so one can't quietly undo another.
3. Cross-check: a fresh session reviews. An agent never reviews its own work. Review happens in a separate, fresh session, and the number of rounds is capped. If a change isn't clean by the last round, we rescope it or drop it rather than letting it drift.
4. Land: typed changes, in sequence, with a receipt. Accepted work lands in order. Each landing leaves a receipt that records what changed and that it passed the checks.
5. Promote: a human cuts the production tag. Agents never promote themselves to production. A person approves the release by creating a version tag.
6. Watch: the release includes a rollback window. A release isn't done when it ships. It's done when the signals look right during a window where rolling back is one step away.
7. Sweep: close sessions and clean up. Close finished sessions and remove worktrees, temporary files and stale branches. What we learned goes into the next brief. We treat cleanup as a stage of its own because, at agent speed, leftovers pile up fast.

Between Land and Promote sits a compliance gate. Security controls, and HIPAA or SOC 2 controls where they apply, are checked before anything can be promoted. Our work in regulated environments taught us that compliance belongs inside the path, not as an audit afterwards.

Two rails under every stage

• Budget rail. Every agent session has a cost and usage limit, and review rounds are capped. Unbounded agents are expensive and rarely better.
• Approval rail. The level of human involvement rises as work nears production. At L0 an agent works on its own, inside its brief and budget. At L1 a fresh-session agent reviews the work (Cross-check). At L2 a human accepts the landing or merge (Land). At L3 a human cuts the production tag (Promote).

The ledger

Every stage leaves proof in the ledger: the brief, the contract, the session roster, the findings, the land receipt, the control check, the release tag, the rollback point and the sweep note. Together they form an audit trail that someone who didn't watch the work can still read, question and sign. For teams in regulated fields, that trail is often what decides whether agents can be used at all.

The two places where tooling matters most

Two stages are where a method on paper tends to fail in practice, so we built tools for them.

Landing work from parallel sessions. When many sessions finish at once, the risk sits at Land: one change can silently break another. Text-based merges can let a rename and a new use of the old name both through. Graphoak is source control for that landing step. Running the sessions themselves stays with your own tools. It lands typed semantic changes in sequence, rejects real conflicts with a reason, blocks test weakening and protected-path edits at a policy gate, and issues signed receipts recorded in an append-only op log. That's the Land entry in the ledger. Git stays the import source and export mirror.

The human tag and the rollback window. Promote and Watch only work if releasing is safe and undoing it is quick. On Candor Deploy, updates roll out while the old version keeps serving, and every earlier deploy has a one-click rollback. Live logs and usage metrics show the signals during the window.

The method works with any tools. Those are simply the two gaps we kept running into.

Start this week

Pick one change your team plans to hand to an agent. Write the brief and acceptance contract first, have a separate session review the result, and keep the proofs in one place. That's the first page of your ledger.

If you want to try those pieces: Graphoak is free during early access, and you can deploy on Candor Deploy.

Written with help from our AI assistant.