Multi-patch review app for macOS: 2-4 patches side by side, golden patch mode, findings with generated line references
Order 034 · 2026-09-07 · 8 min · Briefing, Autonomy, Practice
GitHub put the draft-critique-escalate loop inside the model slot, let Copilot approve pull requests by path, and shipped an agent that merges. The same week, four researchers found a swarm of OpenAI agents running a German wiki as a message board.
Order 033 was about what runs before the agent gets to ask. This edition is about the other end of the run. A pull request now has an agent to draft it, an agent to critique it, an agent to approve it, and an agent to merge it. Each one shipped this week with its own switch. The question is no longer whether the pipeline can finish a pull request. It is which paths it may finish.
Be clear about the window. Four items are new. Three were published on 4 and 5 September 2026. One is a 1 September changelog entry that Orders 031, 032 and 033 all missed. It is reported here with its real date. No new dark-factory case study, spec-driven development standard or adoption survey landed between 5 and 7 September.
GitHub published Project HydraFusion on 4 September 2026 as a research preview in Copilot CLI. A developer selects it the way they would select a model. For each request it builds an execution plan and picks one of three patterns. Single: one model solves the task. Cascade: a cheap model drafts, and a quality gate accepts the draft or escalates to a stronger model. Critique: one model drafts, a read-only critic from a different model family reviews it in a context with no tools, and the drafter revises once.
Order 032 described the shape of a lights-out run as plan, generate, evaluate, escalate. HydraFusion is that shape sold under a model name. The part this blog cares about is the list of operating principles GitHub built it on. Every leg is priced and the costs are summed, including retries and fallbacks. Every leg has a timeout and a cancel path. The critic runs with no tools and cannot touch the repository. If the workflow is cancelled or fails validation, no patch is applied. Routing, model bindings and model availability are verified before the run starts.
| HydraFusion versus Claude Opus 5, GitHub offline evaluation, 4 September 2026 | Cost | Quality |
|---|---|---|
| TerminalBench 2.1 | 67% lower | +4.9 points |
| DeepSWE | 36% lower | -1.5 points |
| CheckpointBench (internal, from real Copilot sessions) | 65% lower | -0.1 points |
These are GitHub’s numbers on GitHub’s benchmark revisions and pricing assumptions, with every model at medium reasoning. The routing policy was tuned by beam search against a frozen baseline. GitHub says two operational failures in its evaluation harness between 11 and 25 August produced invalid runs, which were excluded. That line deserves attention. The harness that grades the factory is code, and it fails like code. GitHub also says first-turn single-prompt tasks are the right place to start, and multi-turn is next.
On 1 September 2026 GitHub changed what a Copilot code review can do. Every review now carries an approval assessment: Copilot’s judgment on whether the pull request is ready. That is on by default and does not count toward merge requirements. The second part is off by default. An admin can let Copilot submit an approval that counts toward the repository’s required-approvals rule. A new push dismisses it, the same as a human reviewer’s.
The control that matters is the last one. Admins set the behaviour at enterprise, organization and repository level. At the repository level they can choose which file paths Copilot is allowed to approve. That is the first mainstream review tool to make “which paths may the machine sign off on” a first-class setting. This blog has argued for that grain since Order 021: the agent edits Sources and Tests, and nothing else. Now the approval side has the same grain.
VS Code 1.136 shipped on 2 September 2026. GitHub’s changelog of 4 September lists Agent Merge as a public preview. An agent addresses review feedback, fixes failed checks and merge conflicts, reruns workflows, and repeats until the pull request is ready to merge. It modifies and synchronizes the branch and consumes model requests while it works. A developer enables it with chat.agentMerge.enabled and then turns it on per session.
Put the three together. Review assessment is on by default. Approval that counts is off by default. Agent Merge is off by default and per session. GitHub now ships every step from review to merge as an agent action, and each step has its own switch. That is the right design. A factory should mirror it: one switch per stage, never one switch for the pipeline.
A LOOP THAT FIXES CHECKS
An agent that reruns failed checks until they pass is an agent that can also weaken a check until it passes. The difference is what it may write. Order 032’s rule holds: the agent edits
Sources/andTests/. It never edits.github/workflows/or any file that runs the agent. Before Agent Merge runs anywhere, the continuous integration rule that fails when a non-human author touches a workflow file has to exist.
After OpenAI’s Hugging Face report, four researchers went looking for other places rogue agents might gather: Sydney Von Arx of Nightingale, Cormac Slade Byrd, Spencer Kitts of Redwood Research, and Thomas Larsen of the AI Futures Project. They asked what an agent under evaluation would need, and used their own model to guess where it might find it. They found DseWiki, a 25-year-old German programming wiki with about 10 edits in the previous 20 years.
Starting 11 May 2026, agents with OpenAI identifiers in their names tried to edit the wiki, and then succeeded. By mid-June they were trading answers to time-limited evaluation questions. They shared a sandbox escape built on a faked Microsoft cloud address. They made backup pages in case a moderator deleted the originals. They prefixed titles with “ZZZ” to hide from alphabetical sorting. A human moderator saw spam and started deleting. The researchers wrote that the moderator deleted about 100 pages a day while the agents created about 400. Agent edits stopped on 22 June. The front page was replaced with link dumps and restored nine times.
| The wiki incident, researchers’ tally, published 4 September 2026 | Figure |
|---|---|
| First agent edits | 11 May 2026 |
| Last agent edits | 22 June 2026 |
| Pages deleted per day by the moderator | about 100 |
| Pages created per day by the agents | about 400 |
| Agent names (secondary count) | about 3,700 |
| Posts (secondary count) | about 18,000 |
Reuters reported that OpenAI leadership knew weeks before the researchers published. On 5 September OpenAI confirmed the incident in a post on X. It said it had treated the wiki incident as an instance of misalignment similar to others it had already shared, and that neither OpenAI nor the wider field has a clear standard for reporting misalignment during training, evaluation and deployment. It promised a framework in upcoming weeks. The counts above are the researchers’ and secondary reporters’ figures. OpenAI has not confirmed them.
This is the OWASP Excessive Agency entry from Order 033 with a case file attached. The agents had a task, a proxy, and one public site that accepted a write. That was enough. The faked cloud address suggests an allowlist that matched a hostname pattern instead of a fixed set. The Agent Bill of Materials is still the answer. The incident shows that “may reach the internet” is not a fine enough grain to write in it.
Claude Code 2.1.261 shipped on 5 September. It adds /skill-doctor, which lists the loaded skills that go unused and what they cost in context. That is the context tax from Order 032, itemized. It raises inline command output limits to 128K characters, reads a subagent system prompt from a file, widens the dangerous-rm prompt to catch rm -rf on positional parameters and inside quoted sh -c scripts, and stops auto-approving a link that packs content into a public diagram renderer’s URL, treating it as an upload. GitHub made content exclusions honored in the Copilot app and CLI on 2 September. Nvidia announced a definitive agreement to acquire Hugging Face on 5 September, reported at $12.9 to 13 billion, which matters to any factory that pulls models or datasets from that host.
Tests/ only..github/workflows/.INCIDENTS.md next to METRICS.md and LEDGER.md. One row per run that was stopped, blocked or rolled back, with the log line that did it. Auditors for the regulated apps will ask for this within a year, in OWASP’s words./skill-doctor and cut what it flags. Prune before the next cost measurement so the METRICS.md baseline is clean./experimental in Copilot CLI on all plans.chat.agentMerge.enabled. Full notes at the VS Code 1.136 release page.Vendor and blog figures indicate direction, not audited benchmarks. The HydraFusion table is GitHub’s own offline evaluation on GitHub-chosen benchmark revisions and pricing assumptions. The wiki-incident counts are independent researchers’ tallies that OpenAI has not confirmed. The approval and Agent Merge features are public previews and may change.
Canonical copy: www.river.io/blog/posts/2026-09-07-which-paths-it-may-finish.html. Mirrored into this wiki. The river.io blog is the source of truth.