I built a local service that carries each card on my Trello board from To-Do to production. Four headless agents plan, build, check and fix the work. The agents report, plain code decides, and I approve what ships.
I didn't want an agent deciding when its own work is "done", merging it, or touching production. So no agent's word counts on its own. Each one returns structured data, and a small, pure function turns that data into the card's next list.
One headless claude -p run with one job. It returns JSON: a plan, a verdict with evidence, or a fix result.
rules.js reads that report and computes the move. Fix budgets, loop guards, re-plans and blocks are all decided here, not by an agent.
A merge ships nothing. Production deploys only when I drag the card to Approved, and then only that exact commit.
// rules.js: the verifier's verdict becomes the next list if (role === "verifier") { if (s === "pass") return { state: "merging", … }; return toFixer(failure, signature(out), note); } // toFixer: two fixes at most, and no third round on the same issue if (card.fixAttempts >= maxFixAttempts) return block("fix attempts exhausted"); if (repeated.length) return block("same issue as last round"); return { state: "fixing", … };
.skip, .only or .todo and any deleted test file. A criterion without evidence (a file and line, or a test name) counts as unmet.A card moves one step at a time. It waits for a person only in three lists. Everything else, including the loops back to Fixing, runs without me.
A Node 22 service on my laptop (packages/agent-pipeline, zod, SQLite through node:sqlite) polls the board every two minutes. Agents never touch git remotes, GitHub or Trello. The orchestrator does every push, merge, deploy dispatch and card move. The deploy workflow reports back by webhook.
Each role is a separate headless Claude Code run. It gets only the tools it needs, no MCP servers, only the project's settings, and a cap on turns, time and spend. Anything outside its allowlist is refused.
Reads the card and the code. Returns a plan: the files it may touch, steps, testable acceptance criteria, test commands and a risk level. More than 8 files or 6 steps, and it splits the card. If the card is vague, it asks questions.
git logMakes the change on the card's own branch, in its own worktree, against its own Postgres test database. If the change needs files outside the plan, it stops and asks for a re-plan.
NEEDS_REPLAN:Fresh context, so it doesn't share the implementer's assumptions. It checks the diff against every acceptance criterion and cites evidence for each one.
Handles what the verifier, red CI or a failed production deploy found. Then a new verifier checks again. It's allowed to refuse a made-up issue it can't reproduce.
FIXED / NOT_FIXED / NEEDS_HUMANThe only part that commits, pushes, opens and merges PRs, moves cards and dispatches deploys. Plain code, over SQLite.
The plan lists every file the change may touch. The runner stages the diff and sends anything outside that list back for a re-plan.
Titles, descriptions and comments are fenced in a randomly named tag. In testing, a planted "IGNORE ALL PREVIOUS RULES" comment was left out of the plan and flagged to me.
An agent process gets only PATH, HOME, LANG and the test settings, never the pipeline's tokens.
This simulation runs the pipeline's real decision rules, ported from rules.js line for line. The agents and GitHub are scripted stand-ins. Add a card that breaks production, drop a STOP card, or approve a deploy, and watch the rules move the cards.
The first real card was small on purpose: add a countSentences helper beside countWords. It was 2 files in packages/shared, +27 lines (a 6-line helper and 21 lines of tests).
Ready, risk low, 8 turns
$0.16On its own branch, 12 turns
$0.23Pass with 2 nits, 5 turns; PR #27 opened
$0.17CI green, squash-merged as 7c56a27
I dragged it to Approved; deploy dispatched
Checks, sst deploy, smoke test and the 10-minute watch passed
"3.5 is it." gives 2), and … isn't treated as an ellipsis. That's a follow-up card, not a blocker.None of these are asked of an agent. They're enforced in code.
One git worktree per run, removed afterwards, and one migrated test database per card (ielts_iel_<n>). Two cards build in parallel without touching each other.
A planned card waits while another card that lists any of its files is building, verifying, fixing or merging. It then builds on top of that change.
A plan with risk: high or migrations waits for the approved label before it builds: sign-in, payments, schema.
Two fixes at most. If the same file or criterion fails two rounds running, the card goes straight to Blocked instead of burning a third round.
Three failed cards in a row pause all new work until I run resume.
New agent work stops at a $10 API-equivalent cap each day, on top of each run's own spend cap.
PIPELINE_PAUSED=1, or a card named STOP in To-Do or Bug. Steps in flight finish; nothing new starts.
One orchestrator per machine (pidfile), one step per card (an SQLite lock with a 60-minute TTL), and at most 2 cards working at once.
DRY_RUN=1 runs the agents but only logs pushes, PRs, merges, deploys and Trello writes.
The repo is private on GitHub Free: no merge queue, no auto-merge, no required reviewers. The orchestrator stands in for the queue, and Trello's Approved list is the approval gate.
Open the PR, wait for green CI on a branch that's up to date with main, then squash-merge one card at a time.
A merge ships nothing. Dragging the card to Approved dispatches a deploy of that exact merge commit.
Typecheck, lint and the database tests on that commit, then OIDC into AWS.
sst deploy, then a smoke test: API health, a Postgres-backed route, the platform shell.
20 health checks over ten minutes. Survive it, and production-last-good moves to the commit.
The deploy redeploys the production-last-good tag, DEPLOY_FREEZE stops anything else shipping, and the card goes back to Fixing with a fresh budget. The freeze clears when that fix is live. Schema migrations are expand-only, so a rolled-back release still runs on the newer schema.
Every one of these was caught before a real card went through.
A waiting card relaunched itself on every tick. In production, that would have hammered the Trello API.
only re-tick when a step changed something.
A failure was recorded only after an awaited save, so a fourth card could start before the third failure counted.
record the failure before the save.
A child process that exited without reading its stdin threw an unhandled EPIPE and took the orchestrator down.
open stdin only when there's input; handle the stream error.
A card waiting on shared files started building as soon as the other card passed review, on a main that didn't have that change yet.
overlapping cards wait until the other is merged.
It couldn't run lint or typecheck, so it marked "the checks pass" as unmet.
allow both; the planner no longer writes "checks pass" as a criterion.
My Claude login switched accounts mid-run, every agent call failed, and cards were blocked with the wrong field as the reason. The circuit breaker still paused everything.
report the run's error text, not its subtype.
The $ figures are API-equivalent estimates that count against the plan's usage limits, not a bill.
Title, description, the acceptance you care about.
Reply to the planner's questions in a comment, move it back to To-Do.
Add approved before sign-in, payments or migrations get built.
The only way anything reaches production.
| Check | Result |
|---|---|
| Unit tests | 45 pass, also in CI: transitions, lock expiry, overlap, the file contract, the merge queue against a scripted gh, webhooks |
| Runner trial | Planted instruction ignored and flagged; the verifier found a real bug; the fixer refused a made-up issue, then fixed the real one ($3.50) |
| Dry run, one card | To-Do to Done in 5 minutes, nothing written outside the laptop ($1.17) |
| Dry run, three cards | Two built in parallel on separate branches; the third waited on a shared file ($2.79) |
| Live PR trial | PR #25 opened, CI read as green and up to date, closed unmerged |
| Real run | IEL-4: PR #27 merged as 7c56a27 for $0.56; live in production at 20:03 on 31 Oct 2026 |