Engineering · · 3 min read
We rewrote the kernel in Rust — with agents writing most of the PRs
Three PRs deleted about 1.03 million lines of Go from evalops/platform. That week, 90% of merged platform PRs came from agent-named branches.
On 1 July 2026 (UTC), three pull requests landed in evalops/platform within minutes of each other:
| PR | Title | Lines deleted |
|---|---|---|
| #3891 | chore: remove Go service implementations (internal/) |
909,314 |
| #3892 | chore: remove Go shared runtime (pkg/) |
61,237 |
| #3890 | chore: remove Go service entrypoints (cmd/) |
59,986 |
| Total | 1,030,537 |
That was the end of the Go service tree in the monorepo checkout: implementations, shared runtime, and entrypoints. What remained as the active runtime path is the Rust workspace under rust/ (protos, platform-api, typed core crates).
This post is about why we did that rewrite, how agents participated, and what we can measure from GitHub for the surrounding week.
Why leave Go#
The Go monorepo had tests, lint, and review. What it did not have was a type system that could refuse to compile a swapped tenant_id and principal_id. Both were strings. Isolation lived in convention and review.
For a multi-tenant control plane that records agent actions, spend, and approvals, that is a weak floor. We wanted tenant, principal, lease, idempotency, and lineage identifiers as distinct types at trust boundaries, plus property tests for operation spines that hold regardless of what an individual reviewer remembers to check.
What the agents wrote#
The rewrite did not land as one mega-branch. For the GitHub search window merged 2026-06-29 through 2026-07-03 (UTC) on evalops/platform:
- 255 PRs merged
- 229 of those had head branches matching
codex/*,claude/*, orcursor/*→ 90% - Median time from PR open to merge: ~28 minutes
- 68% merged in under one hour; 86% under four hours
Branch names from that period are explicit about the work: codex/rust-platform-primitives, identity/auth wiring, CI hardening, SQLx migrations, console/settings, eval pipeline, operating chat, connectors UI. Co-author trailers on commits name Codex, Claude, and Cursor Agent; some Claude commits carry session URLs.
That does not mean “no human.” Merges are still gated by CI and human merge rights. It means most of the authored branch surface for that week was agent-named.
Instruction layer#
Under .agents/skills/ the repo carries reusable instruction packs the agents load (workspace layout, PR contract, tracing, follow-through). Those skills are versioned next to the code. When the enforcement rules change, the skills change.
Numbers for the same week (platform only)#
| Metric | Value (measured) |
|---|---|
Merged PRs (platform) |
255 |
| Agent-named head branches | 229 (90%) |
| Median lines changed (add+del) | 338 |
| P90 lines changed | ~2,700 |
Titles starting fix |
34% |
Titles starting feat |
13% |
| Merges 00:00–07:00 UTC | 47% |
| Merges 08:00–14:00 UTC | 8% |
| Merges 15:00–23:00 UTC | 45% |
Across the whole evalops org in the same window, GitHub search reports 473 merged PRs (platform is the bulk; also deploy, orb, and others). The agent-rate and TTM stats above are platform-only, where we inspected every merged PR’s head ref and timestamps.
Scope of this post#
The 90% agent-branch figure and the merge-time numbers describe GitHub's merge graph and CI outcomes for one week; whether the resulting code is safe is a separate question that CI and review answer per PR, same as before. Deixic is the app surface (spend, agent list, approve/deny, tools, activity); this post is about the control-plane kernel underneath it.
Related: The operating model is the agent control surface, Policy at action time, What an agent audit row should carry.