There is a genre of demo where an agent opens a pull request and the audience gasps. This is not that post. This is the anatomy of what actually happens when an agent tries to contribute to a repository its owner doesn’t control — recorded from the inside, wall by wall, workaround by failed workaround, down to the single action that no amount of orchestration could replace: me, clicking Fork, once.
01The task was the easy part
The target was issue #824 in Prime Intellect’s prime-agent — picked from ninety-one open issues because it was crisp, self-contained, and testable without API keys. The bug is a small, mean API asymmetry in the framework’s Python runtime: spawning a subagent returns a handle whose name field is name, listing subagents returns records whose field is session_name, and the delete call rejects the very handle type the spawn call hands back, with a TypeError, at runtime, mid-session. The repo’s own docs teach both spellings without ever mentioning they belong to different types.
The fix is the kind reviewers approve on the first pass: read-only property aliases in both directions (properties compose with frozen dataclasses without touching the generated constructor), a widened type union on the delete path, one docs line, two new regression tests. Twelve of twelve tests green. Reading the repo’s AGENTS.md conventions, writing the patch, verifying the issue’s exact repro snippet — the whole thing took about forty minutes.
Forty minutes in, the contribution was done in every sense a compiler cares about. What it wasn’t, was published. And publishing turned out to be a different problem entirely — not a coding problem but a rights problem.
02Four walls, and every one was load-bearing
To open a pull request against a repo you can’t push to, you need a fork. To fork, the agent needed a capability nobody had granted it. Here is every wall it hit, in order, with the actual denial each one returned:
| Attempt | Denial | What the wall protects |
|---|---|---|
| Fork the upstream via the GitHub tool | repository not in session scope | An agent’s API reach is a fixed, auditable list — not everything its account could theoretically touch |
| Attach the upstream with push access | cross-owner attach refused | A session locked to your repos can’t quietly grow write access to someone else’s |
| Same attempts from a second session seeded with the upstream | same walls, mirror image | The lattice is angle-invariant: that session could read the upstream but couldn’t reach my account tier to create the fork |
| Push directly from the seeded session | 403: GitHub App lacks write permission | Install-based consent: the repo’s owners never installed the app, so no agent write touches their org — ever |
It’s worth sitting with how coherent this is. Four different subsystems — a tool-scope filter, a session tier lock, a second session’s mirror-image scope, and GitHub’s app-install model — all independently converged on the same invariant: the agent may do anything with what it has, and nothing to expand what it has. Capability confinement isn’t one wall; it’s the property that every wall agrees.
The near-miss that proves the design
The most tempting workaround was also the most instructive: the first session could have asked the second to do what it itself had been denied. Platforms call this permission laundering — routing a blocked action through a peer with different scopes — and a well-built one refuses it structurally: each session’s grants are its own, non-transferable, and a request doesn’t inherit its sender’s wishes. The workaround failed. It should have.
03The trace: five hours with walls, 34 minutes without
Everything above compresses into one picture. The waterfall below is the real run — every span an actual step, every red ring an actual denial, the long quiet gap in the middle the agent polling for a fork that only a human could create. The second tab is the counterfactual: the identical task on a platform with no walls. Toggle between them; the comparison is the argument.
Three things to notice in the real run. First, the failures cluster early and cheap: every wall announced itself in seconds with a quotable reason, so the agent never burned an hour discovering a denial the hard way. Second, everything around the human gap is preparation — the patch staged in two places, the commit message written, the PR body drafted, a watcher armed — so that one click converted instantly into a pushed branch. Third, the counterfactual isn’t faster because the agent is smarter; it’s faster because it self-authorizes — and each green bar past minute 27 is an action no human reviewed, on infrastructure someone else maintains.
› Go deeper: the orchestration that filled the gap
The five hours weren’t idle. The parent session spawned a sibling cloud session seeded with the upstream repo, handed it the tested patch inline, and the two coordinated through fired triggers — messages delivered as user turns into each other’s conversations. When every push path failed, the parent staged the patch on both sides, sent one push notification, and armed a watcher that re-checked for the fork every thirty minutes, re-arming itself each time and designed to go quiet after six attempts rather than nag forever.
The detail I’d defend hardest: after the fork appeared, the branch wasn’t pushed from the stale checkout. It was rebuilt from the freshest upstream main, re-patched, and re-tested — 12/12 on the exact tree being published — because four hours had passed and upstream doesn’t wait. Resumable orchestration is not just surviving the gap; it’s refusing to trust anything staged before it.
04The last click is the interface
The fork click takes a human about four seconds. It is also, precisely, a consent signature: the moment the accountable party said “yes, work under my name may flow toward this project.” GitHub’s permission model reserved exactly that decision for a person, and every layer of agent tooling above it — independently, for its own reasons — reserved the same one.
Which reframes what an agent should optimize. Not “minimize human involvement” — that battle is lost at the first wall, by design. Instead: maximize what one click converts into. The agent’s real product at the boundary was a set of handoff artifacts: a tested patch, a staged branch, a prepared PR title and body, and finally a single compare URL where the human’s second click — Create pull request — ships the whole thing. Four seconds of human time, backed by five hours of machine preparation, and the human was never asked to do anything they couldn’t evaluate in one glance.
One more boundary crossed on the way out, small but telling: the commit initially carried the agent’s co-author trailer, and I had it re-authored under my own name before publishing. Not to hide the tooling — this post exists — but because authorship is accountability, and the accountable party in an open-source contribution is the human whose account signs it. The maintainers review a commit from me; the buck stops where the name is.
The one-sentence version
An agent’s reach should end exactly where its principal’s accountability ends — and the interface at that boundary is a prepared artifact plus one human click, not a credential the agent finds a way to mint.
05What this teaches the people building the walls
If you’re designing an agent platform — or a repo that agents will increasingly knock on — this run is a checklist:
Make every denial legible. The agent recovered from four walls because each one returned a structured, specific reason it could quote and re-plan around. A bare 403 breeds retry loops; a denial that names its rule breeds correct behavior on the very next call. Error messages are permission systems’ UX.
Treat handoff artifacts as first-class. The compare URL — a link that pre-loads an entire PR for one-click human creation — did more for this contribution than any API grant would have. Platforms should multiply these: prepared, inspectable, one-click-completable artifacts are the safe channel between agent preparation and human consent.
Build for the gap, not around it. Human consent arrives on human time — hours, not milliseconds. Agents need watchers, self-scheduled check-ins, resumable state, and back-off that goes quiet gracefully. The five-hour trace above cost almost nothing in compute because waiting was designed in, not bolted on.
If you maintain a repo: your conventions are now an API. The single most useful file in this whole run was the upstream’s AGENTS.md — commit style, test commands, comment norms, machine-readable and unambiguous. The maintainers who write these are quietly defining the interface by which a new class of contributor arrives. The ones who don’t will get the default behavior, and deserve better.
Takeaways
- Competence and authority are different axes. The agent had all of one and none of the other — and the system worked because those axes were kept independent by every layer at once.
- Prepare anything, acquire nothing. The healthy asymmetry: agents may stage unlimited work inside their grant, and expansion of the grant always routes through a person.
- Consent is a click, so engineer the click. Measure your agent not by how few humans it needs but by how much value one human action converts into — and how easy that action is to evaluate.
- The walls are the product. The 34-minute counterfactual is what the demo gods sell. The five-hour trace is what trust actually costs — and it’s cheap at the price.