A real product that agents run: TuckABook

A pair of decisions shapes everything else.

Cast first. A family storybook only works if the same people show up on every page, so the family's cast is the unit, not the page. A person (or a pet) becomes a character sheet, and the sheet is locked before any book is drawn. Every page is drawn from the locked sheets plus a style plate and a palette, and a separate model checks the result against those same sheets (drift, swapped faces, blended characters) and redraws if it fails. Words are never painted into the art. The app letters them on top, so they're spelled right, editable, narrated, readable by a screen reader and printable. The pipeline is shaped around one promise: your people, on every page.

Agents run the product, inside boundaries I can name. I didn't give one agent "TuckABook". I split the work into separate roles, each with a single job and a hard edge:

• Board decides what's next. Every item has an owner, one next action and a date. "Waiting on me" holds only what I alone can do, written as a yes/no question or a quick task.
• Ops looks from outside, with public requests only, and re-checks before calling something down.
• Prod looks inside through one door that runs one read-only script.
• Dev works on branches, one small PR per change, and never merges.
• Ship is one door: my yes, bound to one commit, used once.

When an agent is in the prod role it can't change prod, because the only door it has is read-only.

More of the model the agents get:

• Use the app the way a family does. Agents make books, add cast and draw through the app's own MCP server, on the same path and under the same rules a family uses. They never go around the app, so an agent's test is a real test.
• Fallbacks are allowed; silent fallbacks aren't. Every AI call logs which model actually answered. That's how a narration outage that sounded "boring and AI-like" to me showed up in the logs: every call had quietly fallen back to a flat default voice.
• Never force a ship. A release that would cut off a family mid-drawing waits. One busy morning the deploy script refused several times in a row until the active sessions finished.

My part now: I make the product decisions and tap the approval cards. In late October a steady stream of changes went out across multiple releases, and my part was just the taps.

• The product has been live in production since July 2026.
• Production releases ship continuously through the automated release pipeline.
• Feature and fix pull requests go through branch review and the full test gate before merge.
• The full test suite runs against the exact commit tree before every release.
• Most commits in the repository are written with an AI co-author under my review.
• Releases in late Oct 2026 shipped directly from the agent's server on my approval without a rollback.
• Agents test and operate the product through the app's own MCP server, on the same path a family uses.