Both agents signed off on a byte-identity test inside a folder tagged THROWAWAY

A reviewer agent grades the artifact it was handed against the rules it was handed. Claude checked the new test against the author's own security rules and passed it, and by his account neither agent asked why a folder marked for deletion needed a test at all ^[6]. The test was a correct match for the security rules it was graded against, but the THROWAWAY tag was never part of that input. It lived in the task list, an annotation the author invented so he would stop polishing code he was about to delete ^[5]. Nothing in the review path converts it into a budget, so a well-built test on doomed code clears review on quality and is never asked about cost ^[19]. A byte-identity test is a strong guarantee to buy for a file with a scheduled execution date.

Set that against what did stop the build. On Spike B, Kiro reported each discrepancy between the AgentCore product and the architecture document instead of quietly adapting ^[12], and the author notes he approved every line of that document, so the five wrong calls were his ^[11]. The gap here comes down to where the constraint sat: the architecture document was an input to the task, so conflicts with it surfaced inside the task, while the scope tag only described the task's lifetime, a fact about the plan that neither agent was grading against.

The overrun is worth doing arithmetic on. Assume an eight-hour build day against a two-hour estimate and the block ran over by at least a factor of four ^[17]. Mid-block, the author typed the question of whether they had over-gated ^[7]. His reason for spiking at all is that he does not type the code and never developed the friction instinct that stops a hand-coder mid-shape, and the agent does not have it either: it will build confidently on a wrong assumption for hours because it reasons locally and is not holding the deadline ^[8]. So the stop gets manufactured as a short experiment with pass and fail written down before it starts ^[20]. The justification is that assumption cost is not flat; finding out at Block 5 that AgentCore does not behave as designed means rewriting everything stacked on it ^[13].

The logging finding is the part I would take to a review. Twenty-eight tests were green over the redaction processor, including property tests over generated inputs plus case-insensitive key matching and recursion into nested dicts and lists ^[15]. The rule they enforce comes from the steering files: logs never contain document text ^[14]. The deployed spike imported the framework's built-in logger rather than the designed module, so the suite verified a code path the deployed process never ran ^[18]. Coverage tracks what the code actually imports, and the imports here did not match what the tests assumed was running. The published account breaks off mid-sentence at that exact point, so what CloudWatch actually held is not something I can tell you ^[21].

For any of this to transfer, a few things have to hold in your setup: no hand-written code in the repo, a builder and a reviewer that see the diff and the rules but not the plan, and scope metadata parked outside both. The sample here is one operator on one hackathon block, directing Kiro and Claude over Strands and Bedrock AgentCore ^[1][2]. If your reviewer reads the task file, the tag is enforceable and this failure does not reach you.