Master 22 Solutions Blog

I Was My Own First Customer. Here Is What Broke.

2026-09-14 · Paul Rodney Turner

I finally used Agent Bob like a real customer. The signed package contradicted itself, the hash did not match, and the fixes made the product stronger.

For weeks I have been telling people about Agent Bob, the wizard that turns a plain description into a governed AI agent with a signed policy package. Nobody had used it yet except me, and I had only ever used it to check that the pages loaded.

On Saturday I needed an actual agent. OM Guarantee needed outbound prospecting, and I was not going to hand that to a stranger's Upwork bot. So I opened my own product, described the job, and walked the seven steps like a customer would.

Three days later the product is better than it has ever been, and I have a list of things I would rather not admit. I am going to admit them anyway, because the whole point of a governance product is that you can trust what it hands you.

What I found

The signed package contradicted itself. The wizard produced a policy.json with the limits I chose. The trust manifest, the file that carries the signature, contained a different policy from a default profile. Two rules in one box, and the signed one was wrong. A runtime that trusted the signature would have run a different agent than the one I built.

The signature did not match the file. The manifest declared a hash for policy.json. The file in the ZIP hashed to something else. Our own verifier passed, because it checked its own convention rather than the bytes. An independent runtime hashed the actual file and refused it. That is exactly what an independent runtime should do, and it caught what our tests did not.

Compliance overlays vanished. The industry card promised GDPR and CAN-SPAM. The package shipped an empty list. The wizard read one catalog, the package builder read a stale copy that did not know the industry existed.

My custom tone never left the wizard. I wrote the agent's voice by hand. The package dropped it.

The download page said the files would enforce themselves. They do not. They are a specification. Somebody has to implement them.

There were smaller ones. A number field that turned 30 into 030. A score that rendered zero instead of the real 67. A late AI response that overwrote what I had typed. None of them would have shown up in a demo. All of them showed up the moment a real agent needed to exist.

What changed

Every one of those is fixed and verified against a live package. The signature now covers the exact bytes in the file. The manifest carries one policy, the user's. Overlays and highlights come from the live catalog. The download includes a HANDOFF.md that tells your runtime, in plain language, what to enforce and how to verify the package with one terminal command.

And because I got confused on almost every panel, Bob now drafts the whole wizard from your description. Pattern, tools, autonomy, budget, memory, approval rules, each with one line explaining why, in terms of what you actually wrote. You confirm or change. Nobody should need an advisor to finish a seven-step form.

The part I did not expect

The first thing my new outreach agent needed was a second agent to feed it. It will only write to brands on an approved list, which is the point, and the list did not exist. Building one is research, not judgment, so that went to another agent too. I approve the rows. That is the whole job left for me.

The agent that came out the other end, OMG Scout, is now provisioned on my own runtime, verified from file bytes, idle at zero spend, waiting for me to say go. The runtime built more enforcement around the package than I expected: one-time send tokens, drafts bound to a hash, a ledger. It treated the governance files as a contract. That is what they are for.

Why publish this

Because I have been saying Agent Bob produces governed agents you can trust, and for three days I could not have proven it. Now I can, and the proof is a package anyone can verify with sha256sum.

If you have been putting off building an agent because the governance felt like paperwork you would get wrong, describe the job and let Bob draft it. Then verify what it hands you. That is the part I got wrong first, and it is the part that matters.

Build one at agent.ceobob.com. If you would rather have it built and verified for you, book a consultation at calendly.com/foodyoga/master-22-consultation.