In Empryo, a bug fix should leave a guard behind

A developer building the AI coding agent Empryo has published an "immune system" workflow that requires every bug fix to leave behind a guard so the same pattern cannot be reintroduced by another agent. Hunters must reproduce a failure in an isolated throwaway directory, an independent reviewer reruns the reproduction, and fixes are proven against both old and new code, with statically catchable patterns encoded as GritQL rules in Biome backed by two fixtures. Bug records live as markdown files whose folders track state (found, ready, fixed, rejected), with claims taken via `mkdir claims/<id>` and disputed findings escalated to human triage; the workflow is public in SoulStack's immune-system skill.

i don't want to fix the same bug again next week because another agent wrote the same pattern. so this is the rule in Empryo, an AI coding agent i'm building: a fix should leave a guard behind i call this the immune system. here's the useful part if u want to build one for ur own project. a hunter gets a slice of the code and one kind of bug to look for. it has to reproduce the failure in a throwaway home directory, away from my real config. a convincing paragraph about a possible bug isn't enough. an independent reviewer reruns that reproduction. if it doesn't hold up, the report gets rejected. the agent that found it doesn't get to approve its own finding. the fixer has to show the failure on the old code and the passing case on the new code. another reviewer checks the diff and reruns the proof. for patterns i can catch statically, the fix also gets a GritQL rule in Biome. two fixtures go with it: then i run the rule over the production code. if the pattern exists somewhere else, there's more work to do. that's what i want from a fix. the next agent shouldn't need to remember a warning buried in an old conversation. lint should catch the pattern when it writes it again. a lint rule still has limits it catches the shape i taught it, not every possible version of the bug. the reproduction and real-app checks still matter. a bug is a markdown file. its folder is its state: found, ready, fixed, rejected. an agent writes its evidence there before handing it off. claiming a record uses mkdir claims/<id . only the agent whose mkdir succeeds owns that claim. stale claims still need handling when a worker dies. the record survives the session. and anything disputed comes back to human triage. i'm not letting a pile of confident reports decide what's true. the workflow is public in SoulStack's immune-system skill https://github.com/proxysoul/SoulStack/tree/main/skills/immune-system . u can use the approach with an agent that runs shell commands; it doesn't require switching coding agents. Empryo https://empryo.com is the app i'm building it around. its Genome maps symbols, callers and imports, which gives the hunters somewhere concrete to start. start small: one reproduced bug, one reviewed fix, one guard u can prove. scale after that.