It built itself. Then a human found what the tests could not.
Graphban was built by agents running Graphban. Then a human drove it for two days and found defects a green suite never reported.
Graphban · · 3 min read
The absence this makes loud: a suite that is green about the wrong thing.
The dogfooding account, including the number that matters most — how many of the defects found by hand the test suite had caught.
The repo is its own case study: the specs were grilled in Graphban, decomposed into items in Graphban, built by a fleet of agents claiming through Graphban, and reviewed by other agents that the server would not let sign off their own work.
48
days old
first commit 2026-07-21
1,468
commits
808 non-merge
57
MCP tools
as of 2026-09-07
4,200
tests green
3,471 backend · 729 frontend
0
defects the suite caught
of those found by hand
The green bar is real, and it is not evidence. Nine defects, documented
with ticket ids, every one invisible to a suite that was green throughout.
What the walk found
Eight steps run against a real stack with real agents. The walk’s own summary: “Five defects found, four fixed, one filed.” Its defect table lists nine rows across six ticket ids — a count that drifted inside the document written to catch drift, which is either embarrassing or exactly the point.
Ticket
The absence
GRPH-377
The role gate was unreachable.update_item never advertised agent_id, so the ceiling had never gated anything in production — leaving a hole under the self-review ban.
GRPH-377
Reviewers and planners died 150s after registering.heartbeat was gated to workers — refusing the only call that keeps an agent on the roster.
GRPH-378
A bounce required a reason and discarded it. After a real bounce the string appeared in no row of any table. The author got the item back with nothing to act on — the exact failure the requirement existed to prevent.
GRPH-379
The pin was invisible. A refused claim returned {"claimed": false, "item": null} — byte-identical to an empty backlog. A worker that should idle and retry concludes the project is finished.
GRPH-395
A review claim never expires. A reviewer that dies strands the item in review forever, looking like ordinary queued work.
GRPH-396
A dead agent's branch is never flagged. The flag is written only inside quarantine — reachable only by an agent that is demonstrably alive. The agent that crashes holding a branch is recorded nowhere, and that is the common case.
GRPH-376
The self-review ban is unprovable after the fact. Sign-off clears the claim, so every done item reads built_by: -. Enforcement is fine; the audit trail is not. Filed, not fixed.
Predictions, scored
Stated in advance so the walk would test claims rather than confirm them. One of four held.
Prediction
Outcome
Vendor strings never tested against real clients
wrong real clients report xai and cursor
host is self-reported and nothing reports it
wrong reported, and seats made it moot
wait_seconds has never parked against a real proxy
right 504 at exactly 60s
The directive downlink has never reached a real client