I was building Milkman, a local-model benchmarking tool for Windows/NVIDIA machines. The tool installs and manages llama.cpp's server in router mode, keeps a verified registry of models, derives hardware-fit settings for each one, and runs a battery of golden tasks to compare candidates against an incumbent under a statistical promotion policy. The project saw 15 commits across roughly 31.4 hours spanning two calendar days in August 2026 — 485 files, 40,155 insertions from the initial commit. Every commit but the first two is agent-co-authored.
The repo is explicitly agent-operated by design: a fixed entry-point file, a session handoff file rewritten at the end of every session, and a structured memory of learnings, experiments and decisions carrying an epistemic-status ladder — assertion, observation, experimental evidence, validated learning, policy — that may only move up with linked evidence. 19 golden coding and doc-chat tasks, each with hidden tests, back every model-promotion decision; 254 golden runs were recorded.
Then a subagent-written test undid its own sandbox and deleted a real model file from my machine.
What happened
A unit test for the "evict a model" command called a cleanup function mid-test — monkeypatch.undo() — that reverted every patch on that test's fixture instance, including the one redirecting the test to a fake install root. The rest of the test then ran against the real machine. It deleted a real 4.69 GB model file and overwrote a real registry record's checksum with a fabricated one, which then caused the next integrity check to quarantine an intact file.
The test itself passed. It was checking that the code correctly deleted what it was told to delete and updated the checksum registry afterward, and the code did exactly that — just not in the sandbox.
Why recovery worked
Milkman's own eviction policy writes an inventory record, including provenance, before any deletion. The file could be re-verified and re-downloaded because the tool knew where it had come from. The failure log caught the problem and explained both what had broken and why recovery was possible.
The fix
An autouse hermetic-sandbox fixture that a test's own monkeypatch.undo() cannot strip, plus a new rule that no test may call monkeypatch.undo() at all. The sandbox applies underneath every test regardless of what that test does. The subagent had written clean, idiomatic pytest code — cleanup in the right place, the right call — but the test framework's own semantics let it punch through the wall.
What it changed
Tests check that code does what it says. They don't check that what it says is what the product actually needs. A green suite tells you the code agrees with itself, not that it does the right thing to the right target. This one passed because deleting a file and updating a checksum was exactly what the test specified, and the code did it correctly — just not where the test thought it was running.
The last recorded full run showed 294 test functions across 26 files: 290 passed, 1 failed. Milkman is in development; the project's own handoff record lists unresolved risks, including that a real GPU candidate sweep from the UI had not yet been run.