Why we replaced our v2 operating model
Our second operating model made AI work more structured, but the control layer became too complicated. We kept the evidence and gates, then rebuilt authority around one General Manager and a simpler finish-to-next-outcome loop.
The question behind the work
The problem
The earlier model had a Manager-led role system, Supervisor checks, scheduled operating windows and a file-based execution engine. It could reconstruct work slots, separate Owner gates and search for work before declaring itself idle. But the organisation around that engine had accumulated too many overlapping control layers. A scheduled window could be recorded as completed while useful work had not been discovered, and the productivity record could count slots and task starts without defensibly deriving completed or blocked task totals. Rejection lineage, blocker scope and the difference between reactivation and continuous execution needed to become explicit rather than implied.
01
What we tried
- Used the v2 file-native model with scheduled windows, three outcome slots, source scanning, explicit gates and adversarial closure tests.
- Added anti-idle behaviour so available capacity would search beyond empty Owner intake and pull source-backed work.
- Compared the native checkpoint approach with LangGraph in an isolated interrupted-and-resumed workflow.
- Considered provider and observability layers including LiteLLM and Langfuse, but kept them investigation-only because they would add accounts, keys or infrastructure without simplifying operating authority.
- Replaced the old Manager, Supervisor and AUTO-OPS control layer with one General Manager, a work queue, a rejection register and only the minimum Scout, Execution, Commercial and QA/Risk functions needed for each outcome.
02
What happened
- The v2 model improved discipline: it preserved evidence, isolated some gates and proved that a free slot should look for more work.
- Its own slot record also exposed the limitation: six of seven windows were used and three tasks were started, while completed and blocked task totals remained unknown; several completed windows were still classified as useful work not discovered with capacity available.
- LangGraph and the native approach both resumed the representative workflow correctly. LangGraph added finer checkpoints, but required more implementation and 38 isolated packages versus no dependency beyond the standard library for the native comparison.
- The redesign disabled the former operating roles as active authority, preserved their evidence as legacy material and made one General Manager accountable for prioritising, dispatching, finishing and reporting.
- The current model checks rejected lineage before dispatch, blocks only the exact action that cannot continue and immediately gives released capacity to another eligible outcome.
03
What we learned
More governance does not automatically create more control. When several layers can appear authoritative, the operating model itself becomes a source of ambiguity.
A heartbeat is useful for reactivation, but it should not be the production cadence. During an active run, finishing an outcome and pulling the next eligible one is the real loop.
A rejection needs durable lineage, and a blocker belongs to one action or outcome—not to the whole portfolio.
A framework can improve checkpoint mechanics without solving authority, prioritisation or evidence quality. Those remain operating-design problems.
The best redesign kept the useful parts of v2—file-based evidence, explicit gates, recoverability and fail-closed checks—while removing the old organisation as a control layer.
04 · Outcome
The decision
ADOPT. Keep file-based evidence and explicit safety gates, but operate through one General Manager, a bounded queue, durable rejection checks, minimal functions and a finish-current-outcome then pull-next-eligible-outcome loop.
Where the evidence leads
What this means next
Measure whether the simpler model keeps producing completed, useful outcomes without reviving rejected work or turning one blocker into a portfolio stop. Use the heartbeat only to reactivate the General Manager when no active session exists. Document future operating-model changes in the Lab when they produce a source-backed lesson, not merely because a version number changed.