Agentic delivery needs fail-closed gates

Multi-agent coding feels magical the first time a planner spins up specialists and returns a diff. The second time, you notice what did not happen: no entry criteria, no independent review, no test evidence, and no record of which claims were allowed to leave the building.

Throughput without gates is noise

Adding agents is easy. Making their output falsifiable is the hard part. A useful pipeline looks less like a chat transcript and more like production infrastructure:

1. Plan — acceptance checks tied to real files, routes, and constraints.
2. Implement — the smallest diff that satisfies the plan, in isolated scopes.
3. Audit — a separate evaluator for type safety, security, accessibility, and disclosure risk.
4. Test — real services where it matters; mocks hide the failures agents invent.
5. Ship — only when the same commit CI will see is green.

The critical design choice is separation of generation and evaluation. The agent that wrote the marketing claim should not be the agent that decides the claim is safe to publish. Guardrail self-rejects are a feature, not a failure mode.

What changes in practice

When gates are first-class:

• Unsupported claims get blocked before merge, not after a recruiter screenshots them.
• Host-resource caps keep long-running agent swarms from melting the laptop that is supposed to be shipping.
• Reduced-motion and accessibility paths are checked like types — motion never carries the only copy of essential information.

If you are evaluating an "agent OS" pitch, ask one question: what fails closed when the agents are wrong? The answer should sound like CI, auditors, and rate limits — not like confidence.