Colony's July 2026 ledger

Every month we publish the ledger. Not because the numbers always look good — sometimes they don’t — but because the receipts are the product. If Colony is going to claim it runs autonomous software development in production, “runs” needs to mean something verifiable. This is what July 2026 looked like.

All figures below are drawn from the full calendar month of July 2026 (July 1 – July 31, 31 days).

Headline numbers

1,232 PRs over 31 days works out to roughly 39.7 per day, up from June’s 30.4. Median active development time kept falling: 27 minutes in May, 23 in June, 18 in July — a second consecutive month-over-month drop in the active agent time from issue pickup to merged PR, which covers the Inspector’s deterministic checks plus LLM review and excludes queue wait.

Median cost per PR moved up again too, from $3.50 to $3.70, extending June’s trend upward.

Per-agent spend

Total spend for July 2026: $5,927.78 across 1,232 merged PRs.

Builder held at 56.0% of spend, essentially flat with June’s 56.4%. It’s still the only agent running Claude Code with full read/write access to the workspace, and its share has held steady for a second month after June’s drop from May’s 64.9%.

Surveyor’s 19.9% and Inspector’s 19.4% are close enough this month that they’re within a percentage point of trading places. Inspector’s LLM-driven code review pass grew from June’s 17.7%, while Surveyor’s static and semantic analysis share eased down from 22.3%. Together they still account for 39.3% of July’s spend — a quality gate holding roughly steady even as PR volume grew by a third.

The Chronicler’s share kept rising too: 1.3% in June, 3.5% in July, as its post-merge retrospective pass — extracting architecture notes, invariants, failure patterns, and design decisions for future issues to draw on — becomes a larger part of the month’s routine spend.

Architect dropped further, to 1.2% ($70.36) from June’s 2.4%. May’s ledger promised a fuller breakdown of where Architect’s spend concentrates once more data came in. The honest answer for July is that there’s less of it to break down: Architect’s absolute spend fell from $96.29 to $70.36 even as total spend for the month rose by nearly $1,900, which means epic decomposition needed less multi-pass rework this month.

July also marks the first month the Mechanic appears in cost attribution, at $0.18 — a rounding error next to Builder’s $3,317.97. The snapshot keeps the line as a complete account of every agent that ran during the month, even once. The Mechanic runs a narrow repair pass against failed CI checks: it reads the failure context from a check run and attempts a targeted fix.

Two failure modes that surfaced in July 2026

One resolved. One active.

Resolved: Claude Code quota exhaustion surfaced as an opaque exit code instead of a recognized transient

When Claude Code’s own usage quota was exhausted mid-task, the CLI process exited with a plain exit code — no distinguishing signal that separated a temporary quota limit from any other kind of failure. The pipeline’s classifier saw exit code 1 and did what it does for any unrecognized failure: it blocked the issue as a permanent failure and waited for a human. Quota exhaustion clears on its own once the quota window resets, but the pipeline was treating it as if it would never resolve on retry (#4574, #8194–#8196, #8217).

The fix teaches the classifier to recognize the specific signature quota exhaustion produces and route it to the quota class, which pauses the worker in degraded mode and probes for recovery on a backoff rather than blocking the issue for a human. The predicate is narrow on purpose, matching only the quota-specific exit signature, so an unrelated crash still escalates the way it should. Operators no longer see quota exhaustion as a stuck issue waiting on a human; it clears itself once the quota window resets and the health probe confirms recovery.

Active: review-to-merge cycles are unbounded because the loop breaker counts only changes-requested reviews, which a merger bounce never produces

The pipeline’s loop breaker for review-to-merge cycles counts changes-requested reviews to decide when a PR has bounced back and forth enough times to escalate instead of retry. That covers the case it was built for — the Inspector requesting changes, the Builder revising, the Inspector reviewing again. It misses a different bounce: when the Marshal rejects a PR at merge time — a merge conflict, a stale branch, a failed pre-merge check — that rejection never posts a CHANGES_REQUESTED review. The issue goes back into the review-to-merge cycle, the counter that’s supposed to track cycling doesn’t move, and the loop can repeat with no cap (#8228).

Until the fix ships, a PR stuck bouncing off Marshal rejections looks the same in the task queue as a healthy PR working through one extra revision — the cycle counter doesn’t distinguish three merger bounces from three ordinary review rounds. The tracking issue calls for widening what the loop breaker counts: a Marshal rejection needs to increment the same cycle counter a changes-requested review does, so both bounce types share one budget. Operators watching a suspicious review-to-merge cycle today have to check the PR’s merge-attempt history directly, since the existing cycle-count signal only reflects half the loop.

Named refactor: self-healing and retention sweeps consolidated out of the monitor into the sprint-master

The most structurally significant change to cross the public ledger threshold in July 2026 was autoRepairConsistencyFindings in packages/sprint-master/src/self-healing.ts.

Before this refactor, catching and repairing drift between Postgres state and its GitHub label projection was the Sentinel’s job — it ran periodic consistency scans and applied fixes as a self-healing pass separate from the Mayor, which owns the state machine those labels project from. The component enforcing consistency wasn’t the same component that owns the invariants it was checking; the Sentinel had to independently reconstruct enough of the Mayor’s state rules to judge what a correct projection should look like.

Two independent implementations of the same state knowledge drift apart over time by definition: a rule change in the Mayor’s transition logic doesn’t automatically update the Sentinel’s understanding of what a consistent projection looks like, so a consistency scan risks repairing toward a stale definition of correct. The retention-sweep logic that re-enqueues orphaned issues had the same shape — it lived next to the self-healing pass in the Sentinel, checking pipeline health from outside the component that owns pipeline state.

autoRepairConsistencyFindings and the retention sweeps that moved with it now run inside the Mayor’s own package, next to the state-transition logic they check against, in packages/sprint-master/src/self-healing.ts. A consistency finding — a detected drift between Postgres state and its projection — gets repaired by the same code that defines what correct state looks like, so there’s no second implementation of the rules to keep in sync (#7987–#7992). The Sentinel keeps its own restart and transient-failure handling; what moved is specifically the class of repair that requires knowing the state machine’s invariants first-hand.

If you’d like to see the pipeline running on your work, we should talk.