← Blog

Engineering · · 3 min read

We rewrote the kernel in Rust — with agents writing most of the PRs

Three PRs deleted about 1.03 million lines of Go from evalops/platform. That week, 90% of merged platform PRs came from agent-named branches.

Jonathan Haas

On 1 July 2026 (UTC), three pull requests landed in evalops/platform within minutes of each other:

PR Title Lines deleted
#3891 chore: remove Go service implementations (internal/) 909,314
#3892 chore: remove Go shared runtime (pkg/) 61,237
#3890 chore: remove Go service entrypoints (cmd/) 59,986
Total 1,030,537

That was the end of the Go service tree in the monorepo checkout: implementations, shared runtime, and entrypoints. What remained as the active runtime path is the Rust workspace under rust/ (protos, platform-api, typed core crates).

This post is about why we did that rewrite, how agents participated, and what we can measure from GitHub for the surrounding week.

Why leave Go#

The Go monorepo had tests, lint, and review. What it did not have was a type system that could refuse to compile a swapped tenant_id and principal_id. Both were strings. Isolation lived in convention and review.

For a multi-tenant control plane that records agent actions, spend, and approvals, that is a weak floor. We wanted tenant, principal, lease, idempotency, and lineage identifiers as distinct types at trust boundaries, plus property tests for operation spines that hold regardless of what an individual reviewer remembers to check.

What the agents wrote#

The rewrite did not land as one mega-branch. For the GitHub search window merged 2026-06-29 through 2026-07-03 (UTC) on evalops/platform:

  • 255 PRs merged
  • 229 of those had head branches matching codex/*, claude/*, or cursor/*90%
  • Median time from PR open to merge: ~28 minutes
  • 68% merged in under one hour; 86% under four hours

Branch names from that period are explicit about the work: codex/rust-platform-primitives, identity/auth wiring, CI hardening, SQLx migrations, console/settings, eval pipeline, operating chat, connectors UI. Co-author trailers on commits name Codex, Claude, and Cursor Agent; some Claude commits carry session URLs.

That does not mean “no human.” Merges are still gated by CI and human merge rights. It means most of the authored branch surface for that week was agent-named.

Instruction layer#

Under .agents/skills/ the repo carries reusable instruction packs the agents load (workspace layout, PR contract, tracing, follow-through). Those skills are versioned next to the code. When the enforcement rules change, the skills change.

Numbers for the same week (platform only)#

Metric Value (measured)
Merged PRs (platform) 255
Agent-named head branches 229 (90%)
Median lines changed (add+del) 338
P90 lines changed ~2,700
Titles starting fix 34%
Titles starting feat 13%
Merges 00:00–07:00 UTC 47%
Merges 08:00–14:00 UTC 8%
Merges 15:00–23:00 UTC 45%

Across the whole evalops org in the same window, GitHub search reports 473 merged PRs (platform is the bulk; also deploy, orb, and others). The agent-rate and TTM stats above are platform-only, where we inspected every merged PR’s head ref and timestamps.

Scope of this post#

The 90% agent-branch figure and the merge-time numbers describe GitHub's merge graph and CI outcomes for one week; whether the resulting code is safe is a separate question that CI and review answer per PR, same as before. Deixic is the app surface (spend, agent list, approve/deny, tools, activity); this post is about the control-plane kernel underneath it.

Related: The operating model is the agent control surface, Policy at action time, What an agent audit row should carry.