---
title: Time to Make the Donuts
description: "Why the Bakery now writes our commits — the reasoning behind the change."
created: 2026-09-18
updated: 2026-09-21
authors: ThinkingCap R&D
topics: [CapCom]
status: published
canonical: https://console.thinkingcap.com/rd/CapCom/Time-to-Make-the-Donuts
date: 2026-09-18
---

# Time to Make the Donuts

*Why the Bakery now writes our commits — the reasoning behind the change.*

---

Every morning, before anyone else is awake, somebody makes the donuts. It's
not glamorous. It's not inventive. It's the same quiet rounds, every day, and
everything else the shop does that day stands on it. That's the job we just
gave build-baker: from now on, the Bakery writes the commits.

This note is the why — three ground reasons and a few that fell out along
the way.

## 1. We left GitHub because rent was going to kill the shop

This started a while ago, with two words: **sovereignty and cost.**

We run a fleet of microservices that gets built **constantly** — dozens of
repos, images baking around the clock, a monitor watching every one of them.
GitHub's pay-to-play model prices exactly that shape of work: Actions minutes
per build, REST calls per check, and a per-user API quota that the whole
estate drank from. We weren't a customer using CI; we were a faucet they
metered. The week we pinned the 5,000-call hourly quota, sixty-three build
targets went blind at once and *nothing* baked for days — not because
anything was broken, but because we'd spent the rent money on asking
"anything new?" too often.

So we moved git home. Our bares live on `/srv/git`; build-baker reads them
for free and builds on its own Docker daemon with credentials it already
has. A `git rev-parse` costs nothing and answers instantly, in both senses of
both words. The GitHub org is frozen. The authority is ours, not rented.

That was the right first step — but it left a hole, and the hole is where
the donuts come in.

## 2. Agents kept checking into the wrong place, so we removed the places

Once there were two gits, every agent had to learn the map: which repos live
on srv, which three still live on GitHub, which branch is authoritative,
which CI is a live trap. They kept getting it wrong — because a map with two
authorities is not a map, it's a trivia question, and the price of a wrong
answer was orphaned work and gate-less images.

The answer is not better teaching. The answer is **no map at all.**

Agents no longer push. Anywhere. An agent works in its own space; when the
work is done it hands the files to the Bakery as a **change drop** — the
files, the base they were written against, and the scope it was allowed to
touch. The Bakery takes it from there:

1. **Merge** — a real per-file three-way against current main. Two agents
   editing the same file in different spots merge silently; the same spot
   bounces back to its owner with the conflict named. Nobody's work is ever
   silently clobbered — the merge that can't be clean is a conversation,
   not a casualty.
2. **Check** — the pre-commit checkpoint. One function every agent-written
   line passes through. Today it scans for secret-shaped content; the Book
   of Doug plugs in here, and every future scan we invent lands in one place
   instead of in ninety pipelines.
3. **Commit** — one uniform message per drop, author = the human who handed
   it off, committer = the Bakery. One commit per drop means one revert per
   drop, and `git blame` starts reading like a ledger instead of a rumor.
4. **Build** — for anything with an image, the build runs *before* the push.
   **Main is green by construction** — a commit that doesn't bake never
   touches it. The red build goes back to its owner; main never hears
   about it.
5. **Push** — the only writer of main for those repos, fast-forward only.

One door, with a bouncer, a ledger, and an oven. Every drop is a row — who
handed it in, what it touched, what happened to it — visible on the Bakery
page in capcom. The pile is finally *manageable*, because everything that
enters it passes one gate where we can check the work, add routines, and
generally keep house.

## 3. Continuous everywhere except the one place that matters

The dev operation is now genuinely continuous: looms work, drops merge,
commits land, images bake — around the clock, no human in the loop.

And **none of it reaches the real world unless a human says so.**

Builds are automated; releases are decisions. The operator gate on the
Releases card is untouched and stays untouched: the Bakery produces
candidates, a person ships them. We get the velocity of full automation and
the judgment of a human hand on the one lever that matters — not by slowing
the machine down, but by making the last inch of it manual on purpose.

## 4. What fell out along the way

**Page-level locks.** The shared UI repo used to be a single lock — one
loom worked in capcom, everyone else waited. But capcom work is almost
always *one page*. Locks are now page claims: several looms work in capcom
at once, in disjoint pages, and the shared plumbing (the route registry,
the nav) is merged by the Bakery instead of locked by anyone. The turn
shrank from a work session to a bake.

**Agents read-only on git.** Once nobody pushes, git write access can
shrink to the Bakery alone. Agents keep full read — clone, fetch, diff,
log — and lose nothing but the ability to make a mess. The mechanism is
already true; the permission follows.

**The end of "did you push?"** A loom's working area is scratch. There is
no commit button, no push button, no branch to leave behind, no "it worked
on my clone." Work either became a drop or it didn't happen. The Weaver's
one act is the hand-off; the Bakery's ledger is the answer.

---

## What it looks like now

```
agent works in its own space
        │
        ▼
   change drop ──► THE BAKERY ── merge · check · commit · build · push
        │                                                        │
        ▼                                                        ▼
  bounce with a reason                                    main, always green
  (fix and re-hand)                              operator Deploy = the only
                                                         road to production
```

## Where it goes next

The Book of Doug moves into the checkpoint — rules become named checks with
named findings, evaluated at the single gate, once, for everything. More
repos' build shapes move pre-push. And the git identity narrows until the
Bakery holds the only write key there is.

The donuts get made every morning, whether or not anyone's watching.
That's the point.

— Douglas