How we work
More completed tickets, and the cost of each one.
Agents do the volume. A person signs four of the seven stages, because agent output nobody accepted is work your team does twice.
The pipeline
Seven stages. One line each.
- 01IntakeAgent
- 02TriageHuman gate
- 03SpecHuman gate
- 04BuildAgent
- 05ReviewHuman gate
- 06UATHuman gate
- 07ShipAgent
Intake
Requests arrive in one queue, in one shape, deduplicated.
Triage
A person orders the list, and writes down what was declined.
Spec
An agent drafts what “done” means; a person approves it, non-goals included.
Build
Agents write the code, in your repository, under your branch protection.
Review
A person decides what merges. Permanently, not as a courtesy.
UAT
Whoever asked for it signs that it is what they asked for.
Ship
Release runs itself, because four people already decided.
The gates
Your people decide what counts as done, and what never gets built.
Each one turns on context your team never wrote down: which customer is leaving, which regulator visits in March.
- Triage
- An agent with an unordered backlog does a great deal of competent work on the wrong things.
- Spec
- Agents resolve ambiguity confidently and silently. You find out at review.
- Review
- An agent writes code that passes the tests and is still wrong for this codebase. Catching that is a judgement, and it is the one a person is here for.
- UAT
- Engineering accepting its own work is how a team gets faster at shipping the wrong thing.
What we will not do
- Auto-merge agent output on a branch that matters.
- Let engineering sign its own acceptance.
- Run the pipeline in our account, on our keys.
- Report volume without quality beside it.
The build loop
Each turn resends your tools. We cache them first.
An agent reads a file, writes a patch, runs the tests, reads the error and tries again, and each turn carries your tool definitions with it.
Cache the tool block.
Your provider bills cached reads at a fraction of the input price: 5% of it on Claude Sonnet 5.5, at list prices retrieved 2026-10-13.
Measure every merge.
We count tokens and dollars per merged pull request from week one, so you see what each change cost.
Move the tools into the weights.
If a model trained on your tools beats the cached API at your volume, your tool definitions leave the prompt. The audit decides, fee and hardware counted.
What gets reported
Volume on its own is churn with good commit messages.
Merged pull requests is the number that sells, and the number that misleads. We report it weekly, beside what each one cost and how many came back.
Volume
- Merged pull requests
- Merged to the default branch, per week, excluding reverts.
Cost
- Tokens per merged pull request
- Input and output tokens across the harness, per merge, with cached reads counted apart.
- Cost per completed task
- Dollars per merged pull request or resolved ticket, at your provider's prices or your hardware's running cost.
Precision
- Review pass rate
- Share merged without a correctness change requested.
- Tool-call accuracy
- Share of tool calls that ran without a repaired argument or a retry.
Stability
- Revert rate
- Share reverted or hotfixed within fourteen days.
- Defect escape rate
- Defects found after acceptance, per merged pull request.
We take the baseline in week one and fix these definitions in writing before the first report.
Data handling
Data residency is the question that kills the project.
Your risk owner has to sign something. These are the six answers they ask for.
I build systems that pass audit, in environments that have to. I am not your auditor. I am the engineer who knows what your auditor is going to ask.
- Where the inference runs
- On a hosted API under your own contract, or on a model in your cloud account or on your hardware. The data-flow map names which, call by call.
- Whose accounts things live in
- Your cloud account, your repositories, your CI. We do not hold your keys, and at close there is nothing of ours in the critical path.
- Who owns the weights
- You do. Weights, training pipeline and eval harness go into your storage. We filter PII and PHI out of your traces before training, and the model card records each set's source.
- What we see, and for how long
- Scoped, time-boxed, granted and revocable by you, listed in the engagement letter, and removed at close.
- Subprocessors
- Named before work starts, in writing, with what each one processes and why. A list you cannot check is not a disclosure.
- What an audit gets
- Evidence as a deliverable: the data-flow map, the control mapping, the model card, access and change records, the decisions log. Your next assessment reads documents instead of reconstructing a conversation.
Environments we have worked inside
- SOC 2
- Built and operated services inside the control environment.
- HIPAA
- Medical settings. Risk analysis, BAAs, minimum-necessary design.
- ISO 27001
- Worked inside an ISMS and the evidence it demands.
- PCI DSS
- Built and operated systems inside a cardholder data environment.
- GDPR
- Including the transfer question: a self-hosted model removes the AI vendor's transfer.
These are environments Dualis Logic has built and operated inside. They are not certifications held by this firm. Dualis Logic is not SOC 2, ISO 27001 or PCI DSS certified, is not an auditor or assessor, and cannot certify anyone: certification requires an accredited third party. HIPAA has no certification to hold.
Terms
The number is agreed before the work starts.
On a fixed fee, every hour we save is ours.
- Fee
- Fixed fee, priced on the outcome. Published, not quoted on request.
- Schedule
- 50% up front, 50% on acceptance.
- Scope
- Fixed per milestone, non-goals written down.
- Hourly
- We never quote an hourly rate.
- Subscriptions
- Cloud, GPU and model API accounts are yours, in your name, outside our fee.
- Not working
- We say so at the weekly review, not at the end.
Start with the diagnosis.
Either assessment can end with us telling you not to proceed. That costs you a week instead of a year.