The Self-Driving Startup

The Self-Driving Startup

Stop babysitting what you built. One queue, agents that find, agents that finish, and you answering questions on your own time.

Nobody Was
Looking

From the very beginning I saw errors in the Vercel runtime logs. Not even the errors an agent fixes when you point at them – the warnings that should not have been there at all. Forty-four pages I had forgotten to redirect, still being served to people and to Google. A race condition where somebody tried to buy a hackathon ticket before their account existed, and the checkout made a bad evening of it.

All of this happened. Nine out of ten of these things I simply did not do. And it was never only product: how were the conversion rates on Vibe Coding Cologne and the Pirate Lab pages doing? Was an A/B test still running? Had an update quietly slowed a page down? All of it tracked in Vercel and PostHog, and none of it acted on.

01eight weeks

Six Meta Ads data pipelines dead on an expired token

A health check, one call. No error was ever raised – a source that silently stops is not an error.

02since the day the feature shipped

Paid hackathon tickets that never got their seat rows

The database refused every write and the code swallowed the refusal. Nine paid orders, no seats. Found by walking the money path by hand.

03six days before the hackathon

The “Secure Your Spot” button on the page our ads pay to fill

Dead to every click until the page finished loading its login system. Filed as a P1 – then it sat three days while the loop polished its own tooling.

04twelve days

A redirect rule that existed, was tested, and never ran

A catch-all eleven lines above it caught the path first. Every test checked the rule was written; none checked it was reached.

The four cards above are what a loop found once one existed. None of them threw an error. The pipelines stopped without failing, the seats were refused and the refusal swallowed, the button was dead only until the page finished loading, the redirect rule was correct and simply never reached. Monitoring built on errors is structurally blind to all four, and errors were the only thing I had ever watched.

Then the maintenance nobody warns you about. Supabase kept sending me notifications from its security and performance advisors, and I was the one who had to act on them. Every package this product is built on needs updating, and updating to the latest version on day one exposes you to the supply-chain attack you will hear about tomorrow. You have to be nuanced: wait a little, but not a month.

Every one of these was a moment where I thought: damn, we can automate this.

Here is the honest map of that today. It is rendered from the loop’s own manifest, so the page cannot claim to watch something the loop does not actually read.

What the loop reads, and what it does not yet

31 of 39 signals read every pass · manifest 2026-09-06

Supabase

The money path

  • The money path, walked by hand

read every passexists, not wired yetDotted labels open the vendor’s own documentation in a new tab.

The money path is the one source nothing pushes to us: the six steps a customer’s money takes through the site – the short link in an ad, the checkout, what they get after paying, the rows we write, which campaign gets the credit, and the page and social card people actually see. One step is walked by hand every pass, because a broken step there rarely throws an error anywhere.

Rendered from the loop’s own manifest, not typed into this page.

The dashed pills are the point. On 1 September I said to the loop session, more or less out loud: there are so many things in the system we are not looking at yet, and that is weird to me. Not embarrassing because a bug slipped through – embarrassing because the information had been there the whole time, paid for, and nobody was reading it.

The fix for that is not a smarter agent. A smarter agent that nobody pokes is exactly as blind as I was. The fix is a shape, and the rest of this article is the shape.

One honest boundary before we get to it. What follows keeps a startup running as it is – the product it already has, the campaigns it already runs. It does not build new features, and I would not let it yet. Fully hands-off is the dream of the self-driving startup and the direction this is heading; today it is maintenance done properly, with the scope widening one area at a time, and with me written into the loop for the calls I would want to make myself.

130
passes
24 Aug to 5 Sep
30
fixes proven
11 more waiting on a number
39
signals watched
31 read every pass
0
humans required
one answers questions

One Queue,
Many Eyes

The loop started life reading PostHog’s inbox, because PostHog shipped an inbox. That was never a decision; it was an inheritance. And the first three things worth fixing – the dead ad pipelines, three vulnerable dependencies, the seats – were all invisible to it. Not PostHog’s failure. They were outside its remit, and the loop had no other tray to look in.

So the queue moved to Linear, and PostHog became one source among many. That is the first piece of the shape: many things watch, one place holds the findings, and every finding carries a fingerprint so the same problem seen by two sources becomes one issue instead of two. The last source in the picture is the odd one out. Nothing pushes the money path to us, so one of its six steps – from the link in an ad to the page a buyer sees afterwards – is walked by hand every pass.

  • PostHog
  • Vercel
  • Supabase
  • Stripe
  • GitHub
  • Meta
  • Resend
  • the money path, by hand

One tray, in Linear

Source: vercel-runtime
Fingerprint: vercel-runtime:seats-failed-to-create
First seen: 2026-08-03 · Last seen: 2026-08-25
Volume: every call

Every finding opens with a block like this, written so a machine can read it as well as a person. The fingerprint is the finding’s ID: before filing anything, the scout looks it up. A miss is cheap, the next pass finds it again; a duplicate splits one record in two forever.

People ask why Linear and not a dashboard, or something I built. I think it matters much less than it seems. I just have a strong preference for starting with a tool whose makers already have the cutting-edge vision of what the process will look like, and to me the people behind Linear have exactly that for project management with agents. It is free, or ten dollars a month. I start there and see what it looks like. If I am happy, I stay. If not, I can still build it myself.

What I get for it is every finding as an issue, with the commits that fixed it attached and links back to where it was found. That makes it easy for me to review what has been done – and it gives the agents the same thing. The queue is their working memory. A cloud session that starts with no memory of yesterday reads Linear and knows exactly where the last one stopped.

To be clear about PostHog: they are leading this idea, and the way they think about the inbox and the scouts that go looking in regular places is beautiful. They have the product scope. They do not yet see the whole business, and they cannot see every system. So the inbox slips one layer down and becomes a source rather than the operating system. And I cannot yet afford fifteen dollars a pull request to run their whole cycle the way they imagine it.

When a monitor is persistently quiet, verify the monitor before you believe the quiet.

That rule came from the loop’s worst early week. Six passes in a row found an empty inbox and reported a quiet product. Every pass was individually correct. The conclusion they added up to was wrong, because zero scouts existed and the sources that were on only fire on problems created after they were switched on. The loop had been congratulating itself on a silence it had helped produce. I did not notice at the time. My take now is simple: an empty inbox is not a result, it is a prompt to go and find another source.

One Finds.
One Finishes.

For its first sixty passes the loop was one agent doing both jobs: sweep the sources, then fix what it found. It fixed a lot. It also spent two full cloud passes improving its own tooling while the signup button on the hackathon page – a P1, six days before the event, on the page we were paying Meta to send people to – sat untouched for three days.

Not laziness. The pass only read untriaged items, and accepting an issue was the act that removed it from view. The most interesting failure is always the one in front of you, and the sweep always runs first. So on 29 August the loop split into two roles with opposite success conditions.

The scout

Reads every source, judges what is real, files it, dedupes it, ranks it.

Succeeds when
It read everything, cheaply, and left the queue clean.
Fails when
It looked complete while a source went unread.
Never
Fixes a product defect, however easy it looks.

The fixer

Takes the top of that queue and finishes one thing properly.

Succeeds when
It finished one hard thing, proven, on main.
Fails when
It went reading instead of fixing.
Never
Sweeps a source or hunts for new problems.

Two roles, not two agents. Today one session plays each; nothing in the shape stops it being three scouts and two fixers next month, each with a narrower beat, and that is where it goes. What must not change is that a finder never fixes and a finisher never goes looking.

The first fixer pass took that button. The issue blamed the login library; the fixer read around the reported lines and found the real cause: five buttons rendered inert until the page finished loading, so every click in that window did nothing. It also caught a number that had fooled everyone – dead clicks had halved, which read as a fix, and was the ad campaign going off air. Per hundred visitors nothing had moved. The fix was plain HTML links that work before any script runs, a test that failed without it, and the issue went into review with a condition to re-measure rather than a claim of victory.

Two sessions need rules for not colliding. A claim is a comment with an expiry, because a state cannot expire and a lock must: a session that dies mid-fix releases its issue in ninety minutes instead of blocking it forever. And the two run on different clocks.

One day, Berlin time

00040812162024
  • Scout reads every source, files, ranks · daily
  • Fixer takes the top row, finishes one · every 4 h
  • Ads loop reviews every live campaign, never spends · daily
Nine fires a day, all in cloud sandboxes that start with no memory of yesterday. The queue and the journal are the memory.

The fixer used to fire every two hours. By 1 September it was draining the queue three times faster than the scout could fill it, and four passes in a row went on internal tidying – correct, untidy, nobody waiting. So it moved to four hours, and a pass that finds only low-priority work now walks the money path instead of taking a task to justify the run. A loop that always finds something to do eventually finds something that should not have been done.

I will be honest about the cadence: I am not sure I have figured out the right one at all. I am also not sure I want to let the loop set its own. I probably will.

The Bar Is
the Review

By default, nothing in this system waits for a human to approve a change. The fixer merges its own work into the live code and ships it. That is not the same as no review. Three things send a change to me instead: when the loop is unsure, when the change touches what the product is or does, and when it is risky – money, customer data, anything hard to undo. Those exceptions are written into its instructions, and everything else has to clear five proofs, all five, every time.

The rule came from the first fixer run. It built a perfect fix, left it on a side branch “for merging”, and the defect stayed live while the branch waited. Nobody merges. So: a fix that is not in the live code did not ship, and the bar is the review.

  1. 1

    The failure reproduces before the fix

    Actually make it happen. A fix for a bug you never saw is a guess wearing a changelog.

  2. 2

    A test fails without the fix and passes with it

    Demonstrated, not asserted – the fix is reverted into a scratch copy and the test is watched failing.

  3. 3

    Every automated check passes, read by its result code

    Type check, code style and the whole test suite. The loop reads the exit code, not the last line of text – a tool that prints “done” after failing has fooled it before.

  4. 4

    If the fix exists to change a number, re-measure the number

    Not that the mechanism fired. A correct measurement of the wrong quantity is the hardest kind to catch.

  5. 5

    Verified by running it, not by deploying it

    The dev server and a request reach almost everything. Push to ship, not to find out whether the code works.

Point four is the one I keep coming back to, because every failure it catches looks like success. A cleanup step logged that it had pruned eighty-four files, and two feet below in the same log the warning count it existed to reduce had not moved. The redirect rule from the first section passed twenty assertions for twelve days; every one of them checked the rule was written, and production was checking whether it was reached. The right line existing and the right line running are different claims, and only one of them is what your customers get.

The bar also settled a question I had on day one: should PostHog’s own agent write the fixes? Each side opened a pull request – a proposed change, packaged so it can be checked before it goes live – and it was a fair fight.

One report, two pull requests, 44 seconds apart

24 August, the first real pass

PostHog’s agent

Cleaner code – one date helper instead of our two. Worth adopting, and we did.

It saw the adjacent bug, a link built from the wrong day, and declined it in writing: the wrong URL is not this error code, so it is out of scope for this symptom.

Ours, in the repo

Read the file around the reported lines, not the reported lines. Fixed the reported error and the link that sent a New York visitor to the previous day and a 404.

Scoped to the person’s problem, not to the signal. That is the whole case for keeping the fixing where the context lives.

Their agent is kept on, three free pull requests a month, as a benchmark. The billing limit is set to zero. Detection there is free; the fixing stays here.

One number tells you whether a bar like this is real or ceremony. The test suite was at 335 when the loop split. Ten days later it was at 719, and every one of the new ones was written to fail before a fix and pass after it. The loop did not get a test suite. It grew one, one proven defect at a time.

335

tests, 29 Aug

719

tests, 5 Sep

What Stays
Mine

The system page says “humans required: 0”, and I want to be precise about what that means, because it is not “no human” and it is not “no review”. It means nothing waits on me. The loop is told when to come to me – unsure, product direction, risky – and an issue that needs me drops below every piece of real work, carries a marker, and gets asked as one question at the end of a pass. Meanwhile the loop keeps going. There are two kinds.

Waiting on my decision

A call no session may make: anything that changes what the product is or does – the wording a person reads, what a button does, pricing, removing a feature, sending data somewhere – and anything it is unsure about or that is risky.

“Send IP and user agent to Meta for visitors who declined consent – yes or no?”

I answer in a word, and any fixer can do the work.

Waiting on my hands

Something no agent will ever have: a dashboard only I am signed into, a change to the live database the cloud sandbox is not allowed to make, an account I have to grant.

“Resubmit the sitemap in Google Search Console.”

I do the one thing, where it says, and the queue moves on.

Getting the ask right took a few weeks. Early on I was handed lists of commands, and I wrote back: tell me what is changing and allow me to just tell you to do it. So every ask now carries three things – what changes, in consequences not mechanism; why it needs me, genuinely my hands or genuinely my judgment; and whether I can hand it straight back. Most of the time I can, and the answer is one word.

The other thing I asked for was titles I could read. I triage this queue and I am not a developer, and on 1 September I told the loop plainly that I often could not tell what the issues were about. Since then every issue is titled for the person who notices it – the page, the buyer, what is wrong – and opens with a two-line summary before the detail. The detail stays. It just stopped being the first thing I saw.

What changes

“Removes two duplicate database indexes; the rule that keeps emails unique stays.” Not: “runs a migration.”

Why it needs me

My hands (a password, a dashboard, a billing limit) or my judgment (a product or commercial call). Neither? Then it does it.

Can I hand it back

Usually yes, and it says so. “You have to do this yourself” is reserved for the cloud sandbox being refused, or a key only I hold.

And there is a short list the loop may never touch on its own, however obvious a report makes it sound: the wording of anything a person reads, what a button does, prices, removing a feature, and spending money. Those are mine by design, not by accident, and the design is what lets me trust everything else.

What changed for me day to day is where all of this runs. My first loops lived on my laptop, where I have the most power and flexibility. The catch with a normal coding agent is that you still have to poke it. In OpenClaw or Hermes it is completely normal to put everything on a schedule – a heartbeat first, then jobs that run once a week, once a day, once an hour – and to let the agent improve its own job a little every time it does it. I wanted that for these.

Moving them into cloud routines meant giving up some convenience. The simple connections that work when I am at the keyboard cannot sign in when nobody is there, so each system got a token instead. It took about two hours, and since then every process has its own running cloud environment with the right access. I can shut my laptop, install the update that arrives almost daily, and nothing I have scheduled dies. Life got a little more relaxed. None of it is specific to Claude; the same shape runs in Codex or most other coding harnesses you would pick.

The Same Shape
for Marketing

For the first week I was, again, trapped in the developer fallacy of only looking at product. Then the scope started expanding. I let the loop observe my campaigns, my landing pages, my conversion funnels and my emails, and I would take it into sales. Because the pieces are the same. Here they are in the order they have to exist.

The shape, in the order it has to exist

  1. 01

    Many sources

    Everything that already watches your business, read on a schedule.

  2. 02

    One queue

    Every finding lands in the same tray, with an ID so it lands once.

  3. 03

    Finders

    Read everything, judge what is real, file it. Never fix.

  4. 04

    Finishers

    Take the top of the queue, finish one thing properly, ship it.

  5. 05

    The bar, then you

    Five proofs before anything ships. You, when it is unsure, when the product changes, when it is risky.

What ships changes the numbers, and the next pass reads its own consequences. That return is the difference between a loop and a to-do list. The human sits at the end, not in the middle – and is called in by rule, not by accident.

The ads loop was the first business area to get the treatment, and it is the one I wrote about when it still lived on my laptop. It now runs every morning as a review: every live campaign, four sources reconciled – what Meta says, who actually signed up, what they did on the page, what Stripe actually moved. It never spends and never publishes. Every decision comes to me as a coded question I answer with a letter.

The one difference from product is the test. There is no unit test for an ad; there is only whether the number moved. So re-measurement is not a nice-to-have on the marketing side, it is the verification bar. A campaign fix is not done when it ships. It is done when the cost per result was re-read a few days later and went the right way.

It also taught me that the loop’s judgment is bounded on purpose. In late August I paused the loop’s creative generation. Not because the creatives were bad: seven runs had produced fifteen images into one ad set, Meta concentrated delivery on three, and the honest reason was our inability to properly use them the way the campaigns were set up. Making more of something the structure cannot test is manufacturing, not marketing. The loop still pitches ideas as text every morning. It builds one when I say so.

AreaHow oftenWhat counts as proofState
Productscout daily, fixer every 4 ha test that fails without the fixlive
Meta adsdailydid the cost per result movelive
Emaildailybounces, complaints, a stuck sendlive
Website contentdailyevery page we claim exists still doeslive
Salesdailythe next conversation happenednext
Conversion funnelsdailylanding page → journey → conversion rate held, per offernext
Reportingweeklythe numbers I read were written without menext
Google adsdailysame as Metalater

Two decisions made this a startup loop rather than a product loop with extras. First, one queue for everything, not a loop per area. The best findings keep landing on the seams – a renamed article found in the edge logs, bot traffic that is a product finding and an ads finding at once – and a loop per area cuts exactly those seams. Split the gathering, keep the deciding together. Second, cadence follows how fast the area changes. Spend moves daily; a newsletter does not.

Sales is next, and it is the one I care about most. The daily process I run for it in Claude – who to talk to today, what to say, what happened last time – grew into a real product, which now lives at customermagic.ai. It becomes a sweeper the day it can sign in without my browser. I still send every message myself. That is a decision, not a limitation.

Two more are queued right behind it. The conversion funnels – the landing pages, the journeys behind them and their conversion rates, mostly out of PostHog, where a first watcher for our own offers already runs in dry-run – so a page that stops converting is a finding, not a feeling. And reporting: the weekly numbers I pull by hand today, written and sent without me, which is the point where the loop starts telling me what it did rather than me asking.

These are the processes we have started teaching in the Pirate Forge, one loop at a time, on your own product and your own ad account. And if none of this feels reachable yet, that is fine – the monthly AI Compass session walks one ordinary task from chat to a loop like this, and most people find their own floor somewhere before the end.

Build the
Queue First

If you take one thing from this: do not start with the agent. Start with one source you already pay for and one place its findings land. The agent that reads the source is the easy part, and it becomes interchangeable the moment the queue exists.

Seven days, one source, one queue, and by the end one finding that went from a signal to a shipped fix with you in the loop exactly once. That is the smallest self-driving startup there is, and it is the same shape as the big one.

The loop that produced every number in this article will keep running while you read it. Somewhere around five in the morning the scout will read every source on the map again, and one of them will be this page.

Cheers,
Ben

Ready to Go Deeper?

Questions & Answers

What does this cost per month, honestly?
Less than the first developer hour it saves, but not nothing. A pass costs roughly 175 to 205 thousand tokens, and the product loop runs seven fixer passes and one scout pass a day, so the model usage is the real line item, and cutting the fixer from every two hours to every four was partly a spend decision. Linear is free or ten dollars. Vercel builds are rationed to a twenty-euro budget, which is why a docs-only push is skipped rather than built. PostHog's detection is free; its agent's pull requests are fifteen dollars each, and the billing limit is set to zero. The one cost people underestimate is their own: reading the queue for ten minutes a day.
Do I need a developer to set this up?
I am not one, and I set this up. What you need is a coding agent you already work with, the credentials to the systems you already pay for, and a week. The agent writes the scripts that read the sources; you decide what is real, what it may touch, and how it asks you. The parts that genuinely need experience – the verification bar, the split, the fingerprint rule – are written down in this article and you can hand them to the agent as instructions rather than learning them first.
Is it really safe to let an agent ship changes without a human review?
Two answers, and both matter. First, it is not without review – it is review by exception. The loop is instructed to come to me when it is unsure, when a change touches what the product is or does, and when a change is risky: money, customer data, anything hard to undo. Everything else clears five proofs, all five, every time: the failure reproduced first, a test that fails without the fix and passes with it, every automated check passing by its result code, the number re-measured if the fix exists to change one, and the whole thing verified by running it. That is more than most human code reviews check. Second, the scope is deliberately narrow: this keeps the product running as it is. It does not build new features, and I would not let it yet – that is the direction, not the current state. Within that scope it has shipped around fifty changes in two weeks, each carrying its evidence on the issue.
Which tools? Is this a Claude thing?
It runs on Claude Code cloud routines here because that is what I use, but nothing about the shape is specific to it. Codex, OpenClaw, Hermes and most coding harnesses can run a session on a schedule, read an API with a token, and open a pull request. The pieces that matter – one queue, the find/finish split, the bar, the question lane – live in text files the agent reads, not in any vendor's feature. If you switch agents you keep the shape.
My product is built on Lovable or Base44. Does this apply?
The marketing half applies immediately – your ad account, your email tool and your analytics do not care where the product is hosted. The product half depends on whether your platform exposes logs and lets an agent change the app. On those platforms the honest version is a scout that reads what the platform does expose and files it, and a fixer that is you, prompting the platform's own builder with the issue in hand. That is still a loop, and it still beats finding out from a customer.
Why not just use PostHog's self-driving mode?
Because PostHog is a source, not the operating system, and the difference showed up in the first week: dead ad pipelines, vulnerable dependencies and a database write that failed silently were all real problems and none of them could ever appear in PostHog's inbox. Their scouts and reports are excellent and free, and they stay on. What we keep in-house is the fixing, where the repo's full context lives – their agent consciously declined an adjacent bug as out of scope for the reported error, and ours fixed both. Three free pull requests a month remain switched on as a benchmark.
How do I stop it breaking something or spending money?
By naming what it may never do, in its instructions, before it runs once. Ours: never change the wording of anything a person reads, never change what a button does, never touch prices, never remove a feature, never spend or publish. The ads loop is the clearest case – it reviews every campaign, never spends, never publishes, and every recommendation arrives as a question I answer with a letter. The second guard is that a fix it cannot prove five ways becomes a question, not a merge. The third is that everything it does is journalled, so a wrong call is visible the next morning rather than the next quarter.
How many questions a day does it actually ask you?
One per pass at most, by rule, and most passes ask none. On 1 September four items were waiting on me and all four were cleared inside a few hours, which was the busiest day so far. A question arrives with what changes, why it needs me, and whether I can hand it straight back, phrased for a one-word answer. If more than one thing is open, the pass asks the one that unblocks the most and gives the rest a written trigger instead. The time I spend is mostly reading the queue, not answering it.
Can I run the marketing loop without the product loop?
Yes, and for many people that is the better first loop. Ad spend moves every day and the source is one API. The shape is identical: the ad account is the source, the queue is the same tray, the scout reads the account each morning and files what changed, and the fixer is a review that ends in a question rather than a merge, because spend decisions stay yours. The one thing you must build that a product loop gets for free is the re-measurement – a note on every change that says which number should move, which way, by when.
What about sales and customer work?
That is the next sweeper, and the one I care about most. The daily process I run for it – who to talk to today, what to say, what happened last time – grew into a product, Customer Magic, at customermagic.ai. It joins the loop the day it can sign in without my browser; today its connection needs me present, which is exactly the property a scheduled pass cannot have. When it does join, the queue is the same tray and the source of truth stays in the CRM. I still send every message myself, and I intend to keep it that way.
Which source should I pick first?
The one that already knew about your last surprise. If a link died, your host's logs. If a signup stopped, your analytics or your email tool. If a campaign burned money on the wrong number, your ad account. The mistake is picking the richest source rather than the one closest to money. And walk your own checkout by hand as a source in its own right, on a schedule – the two biggest product findings of this whole run came from that walk, and neither of them ever threw an error.
Ben Sufiani, The Captain

Ben Sufiani

The Captain

Founder from Cologne with 15 years of startup experience across 9 ventures. After helping thousands master growth marketing, Ben learned vibe coding from scratch and launched CaptAIn within three months. He leads the Vibe Coding Cologne community, blending real founder experience with teaching clarity.