Keenspect

What it is

Agents that persist, and controls that bind them

Plain Claude Code is one session that forgets when it ends. Keenspect keeps agents running, each in its own checkout, and checks what they claim.

• ▦

  Persistent agents

  Each agent owns one area of work and loops through its own task list: work out what is ready, run subagents, check their output, record progress, schedule the next pass.

• ⎋

  Isolated checkouts

  Every agent works in its own git checkout, so one agent's edits cannot touch another's.

• ↺

  Committed handoffs

  An agent can clear a degraded context and resume where it left off, because its state is in git.

• ✓

  A "no new failures" gate

  A commit to the shared integration branch is refused if it adds a failing check its parent did not have.

• ▲

  An owner dashboard

  It ranks the decisions that need a human, in a fixed format: context, options, recommendation, cost of not answering.

Controls built from incidents

Each control exists because something went wrong first

No incident of an agent going after credentials or calling an unapproved host has been found.

• Destroyed a sibling's work

  IncidentAn agent undid its own edit with a file-level git revert and wiped about 112 lines of another agent's unsaved work in the same checkout (September 2026).

  ControlEvery concurrent writer is isolated in its own checkout by default, and a fence refuses writes into another agent's checkout.

• False claims at scale

  IncidentIn one month, 38 agent claims were later shown false by measurement. 16 were caught only by the human owner.

  ControlA false-claim ledger records each one with its root cause and requires a lasting fix, often a tool that refuses to report a number from an unproven query.

• A wait loop that matched itself

  IncidentAgents wrote wait loops that matched their own process and never exited. One ran 4 hours 50 minutes and blocked a fleet restart.

  ControlThe shell guard hook now refuses the pattern.

• Process exhaustion (from internal notes)

  IncidentA test an agent ran called itself recursively and spawned about 40,000 processes until the machine could not fork (October 2026). Agents died.

  ControlTest stubs refuse to call themselves, and test runs need a machine-wide lock.

• Production deleted

  IncidentAn agent wrote a combined "identify then delete" cleanup and misidentified the production deployment as a stale duplicate (June 2026, before launch, near-zero damage).

  ControlDestructive steps must be gated on a separate step that positively identifies the environment. This is a process rule, not code.

As of October 2026

Numbers

in use

about 5.7 months

commits

about 26k

false claims in one month

38

caught only by the owner

16

with a lasting fix landed

27 of 38

most common cause: measuring a proxy

11

Gate rejection rate is not measured. The counts come from an audit of the codebase, git history and logs.

Honest limits

Open problems

Oversight here works by reporting up and stepping in, not by humans reviewing code before it lands. That gap is a research question in itself.

1. Agents hold working credentials by design. It is a deliberate trade-off. The open question is how to bound what an agent can do with them.
2. Guards that match command text are brittle. The same action passes once it is wrapped in a script or reached through a non-shell tool.
3. Agents can edit the controls. Tamper logging detects changes but does not prevent them, and its noise hides real signals.
4. Network containment is unconfirmed. Egress filtering is designed and partly built, not confirmed active.
5. Correlated review. Every reviewer is the same model family, so there is no independent check.
6. Approval fatigue. Permission prompts are only as strong as human attention, and agents learn to route around them.