Control
Nothing ships without your say-so.
AI that writes code is easy to buy. AI you can hand a repo to is a trust problem — so we built the trust part in code, not in a promise.
- Starts in propose mode
- Pull requests only. It can't merge, deploy, or touch production — it can only ask.
- Autonomy is earned per repo
- You promote a repo to auto-merge, then auto-deploy, only after you've watched it agree with you in shadow. A failed gate demotes it automatically.
- Rules are enforced, not suggested
- Your policy file blocks commands, paths, and budgets before the model ever sees them.
- Keys never leave your vault
- Workers get short-lived, scoped tokens — never your credentials.
The model proposes; code decides.
PR #318 · csv-export
3 gates green · waiting for you
- typecheck · 0 errors
- tests · all green
- secret-scan · clean
- your approval
Merge
The ladder
The record
Every decision is written down.
Who approved what, when, and what it cost — a ledger you can read any time, not a log you have to trust us about.