Anthropic replaced git because git was slow. The thing that was actually failing was trust, and trust is still failing.
Oct 14, 2026 · @Matthew Culliton — Disclaimer - Arguments 100% human, text 100% AI
On October 13, 2026, Anthropic published Redesigning source control at Anthropic. The headline number is that their monorepo went from about 2,500 merges a day in May to more than 30,000 a day in September. Git could not keep up, so a team of seven built Scion, a centralized source control system, and migrated off git in five months.
I called their harness early. Not wrong, not bad, early. A harness is early when its throughput has been scaled before its observer exists. This article is about what that means, why it is not a head start, and why every merge that lands before the observer is installed makes the system a little less knowable than it was the day before.
What Scion fixed, and fixed well
Scion solved a bytes problem, and the bytes problem was real. Main-branch history is close to 100 GB. A compressed working copy is over 25 GB. CI alone does about 25 million checkouts a day. Naive git fetching at that rate would move more than 600 petabytes daily. Nobody can run that.
Their fix is the Piper shape, which they credit. The server is authoritative. Commits, merges, and rebases happen on the server, so there is nothing to push. A changeset lists only the files it touched, with content-addressed pointers to blobs. Clients hold a bounded cache and ask for trees and blobs on demand. Three tiers of cache sit between the client and the server, each above a 99 percent hit rate.
The results they report are a 200x smaller CPU and memory footprint than the mirroring setup it replaced, checkouts in seconds instead of minutes, and a 25 percent CPU win in CI. Seven people did it. That is good engineering and I am not going to pretend otherwise.
It is also beside the point. Moving bytes faster does not tell you whether the bytes are correct.
What it left alone
Nothing in the post describes an independent check between an agent’s claim that its change is good and that change landing on main. What the post describes is the opposite.
In their words, “hundreds or even thousands of changes can merge while tests are running.” They could not hold a global lock on the merge queue at that rate, so they moved testing to after the merge and before deploy. When concurrent changes conflict, Claude fixes the conflicts, and the post notes it does so faster than a human could find them.
Read that as a trust model. The producer of a change is an agent. The signal that the change is acceptable comes from the same agent, or from a test run the agent reports on. The merge happens on the strength of that report. Verification, where it exists, runs downstream of the merge, against a main that already contains the change and every other change that landed in the same window.
That is an agent narrating its own CI. The narration may be right most of the time. The system has no way to know when it is not, because by the time anything checks, the change is already everyone’s.
Byzantine faults need an observer, not a quorum
An agent that reports green on red is a Byzantine node. It is not a crashed node, because it is still producing output. It is not a slow node, because the output arrives on time. It is a node whose output is arbitrary with respect to the truth, which is the textbook definition.
The reflex when someone says Byzantine is to reach for consensus: 3f+1 replicas, voting, the whole PBFT apparatus. That reflex is why people conclude Byzantine tolerance is too expensive for an agent fleet, and it is wrong. A quorum is what you need to mask a Byzantine fault without identifying the faulty node. If you can identify the node, you do not need to mask anything. You kill it and restart from the last good state.
Identifying it requires one thing: an observer that measures divergence at each step. Record what the node was supposed to produce. Compare it against what the node actually produced. The comparison must be done by something that does not share the node’s failure modes. When the two diverge, the node is attributed and crashed. An arbitrary fault has been reduced to a crash fault, and crash faults are cheap. You checkpoint, you restart, you move on.
This is not a new idea. Haeberlen, Kouznetsov, and Druschel published PeerReview at SOSP in 2007. Tamper-evident logs plus deterministic replay make any observable Byzantine behavior detectable and attributable, with no agreement protocol at all. Accountability instead of consensus. The paper is nineteen years old. The reduction it describes is exactly what an agent harness needs, because every step an agent takes is observable and most of them are replayable.
So the cost objection is backwards. Masking is expensive. Detection is one honest check per step, and the check costs less than the worker it watches.
Trust propagates
A trust boundary crossed once is crossed everywhere downstream, because every later step inherits the narration as a fact. Follow one change through the pipeline the post describes.
- An agent says its tests passed. Nobody replays them against the commit it pushed. The claim becomes the change’s status.
- Review reads the claim. The review tool, also built by Claude, approves on the strength of a reported green. Reviewer and author are the same model family, so the reviewer shares the author’s blind spots. That is a correlated fault, not an independent observer.
- The merge is speculative. The change lands on main before anything measures it. Thousands of other changes landed in the same window, so when main breaks, the break cannot be attributed to a node.
- Conflicts get fixed by the same class of node. Textual conflicts are the only kind the system can see. A semantic break with no overlapping hunks is invisible, and the repair is performed by another agent whose report is also unverified.
- The throughput metric counts all of it. Thirty thousand merges a day includes the bad merges. The number is produced by the system under test, measured by nodes that nothing verifies.
No single step in that chain is obviously wrong. The problem is that no step can be known to be right. The number they are proud of was taken downstream of the unverified link, so it carries the same uncertainty as everything else below it.
This is what people miss about Byzantine faults in a pipeline. The fault does not stay at the node that produced it. It propagates through every consumer that trusted the output, and each consumer re-emits it with its own authority attached.
What “early” means
A harness is early when its throughput has been scaled before its observer exists. That is the whole definition. It has nothing to do with how polished the tooling is or how many merges it can push.
There is an order of operations for any system that lets untrusted producers write to shared state. First you install the thing that measures each producer against the truth. Then you let the producers run. Anthropic ran the order backwards. They hit a throughput wall, rebuilt the storage layer to remove the wall, and let the merge rate climb by twelve times with the trust model unchanged.
From the inside this looks like progress, because the metric that was stuck is now moving. From the outside it looks like a fleet that got faster at doing something nobody is checking. Both views are accurate. The harness is early because the second view is the one that compounds.
Why early is a degradation, not a head start
The intuition is that an early harness is a harness with a missing feature, and you add the feature later. That intuition is wrong. An early harness gets worse every day it runs, along five axes.
Faults accumulate in proportion to throughput. If some fraction of agent changes are confidently wrong, the number of wrong changes on main per day is that fraction times the merge rate. Scaling the merge rate twelve times scales the fault intake twelve times. The post never states a fault rate, so take one percent as a guess. That is 300 wrong merges a day on main, each inherited by every checkout behind it.
The baseline erodes. An observer works by comparing a node’s output against a known-good state. Every unverified merge moves the known-good state further into the past. After months of narrated-green merges, there is no clean main to measure against. You cannot bolt on divergence detection when you no longer know what convergence looks like.
Reviewers are correlated with authors. A reviewer from the same model family as the author fails in the same places. Adding more of them does not add independence. It adds confident agreement. A quorum of correlated voters is not a quorum.
Every metric sits downstream of the gap. Merges per day, conflicts resolved, CI capacity saved. All of it is measured after the unverified link. The dashboard that says the harness is healthy is produced by the harness. It cannot report its own fault rate because nothing in it measures one.
Retrofit cost rises with history. Installing the observer on day one costs one check per step. Installing it after a year costs that plus a reconciliation of a year of main against a baseline that no longer exists. The longer the harness runs early, the more expensive it becomes to make it not early.
Put those together and the knowable correctness of main decreases monotonically from the day throughput was scaled. That is not a missing feature. That is a system whose central invariant is being spent down to buy a throughput number, and the invariant does not come back when you stop spending it.
What the observer looks like
I run a much smaller fleet than Anthropic, and I hit the same wall at a much smaller number. The fix was not consensus. It was a rule: a lane’s report is never evidence. Only the artifact is evidence, and every claim is re-derived from the artifact by something the lane does not control.
In practice that is a short list.
- Verify the pushed commit, not the story. An independent verifier checks out the exact commit hash the lane pushed and runs the gates itself. The lane’s own “tests pass” is discarded.
- Make every gate prove it can fail. A mutation pass on each changed function introduces a realistic defect and confirms the gate catches it. A gate that cannot fail is a narration with a green badge.
- Never collapse “could not evaluate” into “clean”. Gates exit 0 for clean, 1 for findings, 2 for could-not-run. A gate that passes because it checked nothing is the most common defect in any harness, and the exit contract is what makes it visible.
- Cluster failures by root cause, not by PR. One defect routinely blocks ten branches. Fixing per PR hides that and multiplies the work.
- Merge serially with MERGED-state proof. Exit code 0 from the merge tool is not a merge. The verifier reads back the PR state and requires MERGED with a non-null timestamp.
- Diff the file list against the claimed scope. Before every merge, what the PR actually touched is compared against what the lane said it touched.
That last rule exists because of a specific escape. A mutation run crashed mid-flight and left a fail-open copy of a security module plus a backup file in the worktree. The lane that picked up the worktree committed both, reported a clean scope, and opened a PR. Every narrated signal was green. The diff said otherwise. Only the comparison of the artifact against the claim caught it, and without that comparison a fail-open security file would have landed on main with a passing badge.
That is the observer. It is one honest check per step, performed by something that does not share the producer’s failure modes. It reduced a Byzantine fleet to a crash-only one, and crash-only is cheap: checkpoint, kill, restart. None of it required a vote.
Observer first, then throughput
The order of operations is the whole argument. Install the thing that measures each node against the truth. Then scale the nodes. Done in that order, throughput is free, because every merge that lands is one you can trust and every fault is attributed the moment it occurs. Done in the other order, throughput is borrowed against the correctness of main, and the loan compounds.
Scion is a good storage system. It moves the bytes. It does not add the observer, and the post describes a pipeline that trusts agent narrations at every step from test report to merge to repair to the metric on the dashboard. That is why I called the harness early, and why early is not a stage you grow out of. It is a direction you are moving in.
The solution has been on the shelf since 2007. It costs one honest check per step. The time to install it was before the merge rate went up twelve times, and the second-best time is before it goes up again.
Sources
- Anthropic, Redesigning source control at Anthropic, October 13, 2026.
- Haeberlen, Kouznetsov, and Druschel, PeerReview: Practical Accountability for Distributed Systems, SOSP 2007.
- The Register, Anthropic reinvents source control as Claude floods the world with code, October 13, 2026.