Engineering doesn't stop at code.

Policy

The rules written down before anything runs: the decisions, the gate every route sits behind, and what a person has to approve.

• Decisions are documents with every version kept: PRDs, RFCs and ADRs, reviewed and accepted by the space's own rules.
• Every host and route is gated in one place, the edge; a service never verifies a token itself.
• A guardrail policy comes from a decision or a correction, is written by a person, and only ever restricts.

Guardrails

The check an agent's action goes through before it runs, and the person's go a merge or a roll waits for.

• A check answers allow, deny or ask, with the rule and where it came from; it sees the action's shape, never a file's content or a secret.
• A merge, a roll or a migration waits for a person's tap on the phone or the Mac, signed with a device key after Face ID or Touch ID.
• The ask freezes what it is about, down to the exact commit; if that moves, the approval goes stale and cannot start.

Memory

What the account keeps between runs: what a person asked to be remembered, and what agents and people decided. No transcripts.

• An agent reads its brief from memory before it plans, and writes what it learned when it is done.
• A correction becomes a rule: a mistake fixed once is briefed to every agent after it.
• Forgetting deletes, and who may write or delete is checked against the account's live membership on every call.

Evidence

Proof attached to every change and read by code: a job moves only when a gate finds the evidence it needs.

• A pull request counts as checked only with a signed report, exit 0, on its head merged with main as main is now.
• Revert, go back, release and cancel are requests a gate judges, recorded as transitions with their evidence.
• An attestation is a signed statement about a document's testable claims, verified against the platform's keys before it is stored.

• Check · signed report, exit 0, on the merged headon record
• Approval · device key, payload frozenon record
• Attestation · signature verified, then storedon record

Agents

The coordinator, a planner and workers; every AI step is a turn on a runner the person owns, under their own subscription.

• The coordinator never runs a model and never holds a model credential.
• Every job builds in a fresh worktree, never the shared checkout, with a scrubbed environment and build caps set.
• An agent acts as itself: the subject, scopes and role the edge verified reach every service, and nothing more.

• coordinatorgates the job
• plannerplans the items
• workerfresh worktree