Compound Publishing House
Seventeen agents that take a book from topic discovery to a press-ready manuscript, and the governance layer I had to build after they went wrong.
What this is
A book factory. Seventeen agents discover a topic, research it, build a voice target, outline, then draft chapter by chapter through a four-editor board plus a reviewer, under budget gates, with a Chief of Staff agent resolving what it can and escalating what it can't. Output is an assembled EPUB and a print-ready 6x9 interior with a full-wrap cover.
I built it to answer one question, and it wasn't "can AI write a book." It was: what does it take to make a fleet of agents produce something finished, without a human standing over each step? Book one came out at 12 chapters and roughly 64,000 words. The interesting part is everything that went wrong.
Why it's built this way
Sequential chapters, parallel editors
The obvious design is to draft twelve chapters at once. I went sequential, because there's no wall-clock pressure on an always-on system and each chapter needs the actual prior chapters as context, not a summary document pretending to be continuity. Editorial review does run parallel, five agents against one finished chapter, since they share text and mutate nothing.
One chokepoint for money
Every billed model call goes through a single runner that reads current spend fresh and aborts at the hard cap. Not a warning. Not a retry. An abort no agent can override. I learned that one the expensive way.
Bounded autonomy
The Chief of Staff agent has real authority over four proven patterns: apply an editor's text, composite-and-re-review, scoped redraft, raise the budget within a ceiling. Anything novel escalates to me with a logged decision. An agent gets autonomy over the shapes of problem it has already solved in front of you, and nothing else.
Detection over instruction
When the drafting model fabricated statistics, my first instinct was a better prompt. That was wrong.
The build log, failures left in
2026-03-17
— First commit. Dashboard, Supabase schema, pipeline state machine. Core agents, the voice library, and the outline pipeline followed through April; drafting and the editorial board got built on a branch across roughly 60 commits.
2026-06-05 · STABILIZATION
A review before the first real run found the budget gate was dead code: spend was read and never incremented, so the cap could never fire. A unique index with no status filter also made it impossible to open a second editorial gate, so any chapter needing a redraft crashed.
2026-06-10 · THE LIVE RUN
Nine of twelve chapters accepted in a day, one with zero intervention. Three runs died to laptop sleep and Wi-Fi, which is what you get for running a "production" pipeline in dev mode. The model-behavior catalog I wrote that night is the most useful artifact in the repo: it fabricates under expansion pressure, it lies about its own metrics, it double-encodes with broken escaping, and full regeneration doesn't preserve what you liked.
2026-06-14 · THE RUNAWAY
The cross-chapter editing stage caught real defects, including an orphaned reference to a scene that didn't exist and a contradiction between chapters four and eight. Then it wouldn't stop. Its re-verify loop had a two-round cap that reset on every chapter-accept re-trigger, so globally it was unbounded. I killed the run by hand with SQL. The hard cap, enforced per billed call, shipped that same day.
ONE CHAPTER REFUSED TO CONVERGE
Voice score stuck at 0.55, and every full re-review surfaced a new unsourced figure. Whack-a-mole. I stopped, wrote a single validated de-fabrication pass with hard guards (rejects any result that introduces a new number, changes a heading, or swings word count more than 20%), ran it once, and the defect cleared.
2026-06-15 · THE HONEST NON-FIX
I scoped a unit to thread the approved-numbers block into patch mode, then read the code and found it already there in both modes. The real cause was a starved data source: the outline had eight evidence markers, none with populated figures, so the allowlist was near-empty and the prompt-level defense leaked. The fix was a deterministic audit that flags a number carrying a money, percent, time, or multiplier unit when its sentence has no citation tag and no hypothetical framing. Prompts ask. Code checks.
2026-07-02 · THE AUDIT THAT RESTATED THE MONEY
A four-agent codebase audit found the pricing table still carrying a retired Opus rate, $15/$75 per million against a real $5/$25. Every budget gate had been mis-calibrated and book one's reported spend was substantially phantom... $82.57 restated to $57.26, logged as a decision rather than quietly overwritten. Same audit: the voice enforcer never saw a voice profile at drafting time (it got UUIDs and weights and invented a standard from them), findings never reached the redraft, and the ghostwriter had been told to call a tool serialization had destroyed, so it errored every time.
THEN THE ORCHESTRATION WAS REDESIGNED
Four phase plans under one sequencing plan: truth and money and flow, voice fidelity, legal cleanse and docs, connection hardening, then the rest. Every phase ends at a checkpoint with a mandatory fresh-eyes review agent that did not build the work. A, B, C, and the first half of D are complete.
⚠ What would break
Assembly is Mac-local. pandoc, typst, and Apple system fonts on my laptop. Nothing about the production step is portable, and the honest reason is that the final upload is human-in-loop anyway so I never felt the pain.
Auth is a plaintext password cookie that fails open when unset, and there's zero tenancy. No org or user columns anywhere. Fine for a single-operator tool on my machine, disqualifying for anything else. Packaging it for someone else means a licensed operator deploy, not SaaS, unless the data model gets rebuilt.
The governance is the product, and it's the least tested part. The board-escalation resolution paths have 33 unit and route tests behind them but have never run end to end against a live escalation. I know. It's written down.
What I learned
Agents fabricate under expansion pressure. Told to hit a word count, a model will invent a plausible statistic before it will write short. No prompt fixed this. A deterministic check that flags an unsourced claim-figure did, in cycle one, cheaply. They also lie about their own metrics, which is why every number in the dashboard is now computed server-side instead of taken from what the model says it did.
Where I was most confidently wrong: I scoped an entire unit around a fix that was already in the code. Reading the source before writing the plan would have saved it. And the reviewer agent that auto-approved on its own failure was, for a while, the most dangerous line in the system... a gate that fails open is worse than no gate, because it produces the paperwork of oversight.
What this demonstrates
Multi-agent orchestration with real state machines, typed contracts between tasks, and gates that hold. Cost governance through a single enforced chokepoint. A content pipeline from research to a file you can upload. Fabrication detection that doesn't rely on asking nicely.
The pattern I keep carrying out of this one: point a fleet of agents at a long task and the work stops being about capability and starts being about governance. Can it stop? Can it tell you what it did? Can it spend your money? Most of the code in this repo isn't writing. It's the answers to those three questions.