# Three agents shipped our paid launch in one evening

> On 25 October, three agents worked side by side on one desk: billing, the legal pages, and email confirmation with password reset. By 21:15 all three were merged and live.

27 Oct 2026 · Engineering

To open Maindesk as paid early access we needed three things we did not have: billing, the legal pages a paid service must show, and email confirmation with a password reset. Each is a few hours of careful work. We gave all three to agents on the same evening, on one desk.

All times below are Stockholm time, on Sunday 25 October 2026.

## The setup

At 16:38 three agents started, side by side, on one Maindesk desk. Each got a task with a written brief and its own copy of the code, a folder of its own on the desk, so none of them could step on another's work.

| Task | What it built | Time worked |
| --- | --- | --- |
| Billing | Plans, checkout and the billing pages, built and switched off | 4 h 19 min |
| Legal pages | Terms, Privacy, and Cancellation and refunds, and who runs Maindesk | 2 h 35 min |
| Email | Confirm your email, and Forgot password | 3 h 8 min |

```bars
Billing: 259 minutes
Email: 188 minutes
Legal pages: 155 minutes
```

We did not sit and watch. That is the point of a desk: the work keeps going while you do something else.

## Pull requests, not surprises

Each agent ended its task the same way: tests first, then the change, then a pull request with what it did, how it was tested, the risk and how to revert it.

- The legal pages opened their pull request at 17:35.
- Email followed at 17:42.
- Billing opened at 18:04.

Then our reviews read each one. A review here reads the intent of the change and the rules of the codebase. A finding is either a must-fix (something broken) or a nit. The agent fixes a must-fix and answers each thread with the commit that fixed it.

## The security issue, fixed in 11 minutes

At 18:29 a review of the email pull request found a real hole.

A signed-in person could change their account's email to someone else's address, one that had no account yet, and the account stayed confirmed. If the owner of that address later signed in with Google or GitHub, their sign-in would have been joined to the first person's account. That person would keep the password and anything they had set up, and could read whatever the owner then put there.

At 18:40 the fix was in, with a test that failed before it. A confirmed account now keeps its address until a link mailed to the new address is opened. Until then the new address is not taken, so its owner can still sign up with it.

Eleven minutes, from finding to fix. The next rounds of review found smaller things in the same area: a rate limit that could be spent by failed attempts, a change that could leave a person with no login if a later step failed. Each was fixed and answered in its thread.

## The merge queue lands them in order

Three changes to one codebase, made at the same time, touch some of the same files. Billing and the legal pages both added links to the public pages, and email changed the sign-in screens they share.

Our merge queue takes one pull request at a time. It puts the change on top of the latest code, runs the checks there, and merges only when they are green.

```flow
Pull request → Review → Merge queue → Checks green on the latest code → Merged
```

- **19:22**: the legal pages landed first. The checks ran the affected tests in 488 seconds.
- **19:46**: billing landed next, on top of them. It touched more, so the queue ran the whole suite: 651 seconds.
- **20:59**: email landed last. Before that, its agent brought it up to date with both: the legal links, the billing pages and its own Forgot password screens, all kept. It also gated checkout on a confirmed email, now that billing was in. The checks took 515 seconds.

By 21:15 everything was live. Billing was built and switched off, ready to turn on for the launch.

## What we took from it

**Write the brief like you mean it.** Each agent worked from a written brief: what to build, what must stay true, and how to prove it. The clearer the brief, the less the review had to catch.

**Reviews still matter.** The security hole was subtle. It came from an earlier round that removed one step: the mail to the new address. A review that reads the change with fresh eyes caught it, and a test now keeps it closed.

**One desk is enough.** Three agents, three folders, one Linux computer in the cloud. Nobody's laptop had to stay open, and nobody waited for one task to finish before starting the next.

This is the way we build Maindesk every day. If you have three things to ship, your desk can run three agents too. The [Quickstart](/docs/getting-started) shows how to start your first task.