Engineering doesn't stop at code.

Policy

Decisions and edge rules, written down before anything runs.

• PRDs, RFCs and ADRs are versioned in Decisions and accepted by the space's review rules.
• Every host and route is gated at the edge by a named JWT requirement; services read the verified claims and never verify a token.
• A decision or a correction becomes a typed policy: a JSON rule, an effect (deny, ask or warn) and its source.

Guardrails

guardrails_check runs before an agent's action and answers allow, deny or ask, with the policy and its source. It only restricts.

• Input is the action's shape: tool, command with secrets scrubbed, path, host label. File content is never sent.
• A merge, a roll or a migration waits for a person's approval, signed by a device key after Face ID or Touch ID.
• The approval is bound to the payload hash and the exact commit; a moved head makes it stale.

Memory

Entries an account keeps between runs: facts, preferences and session summaries. No transcripts.

• Recall returns the caller's nearest entries above a similarity threshold, capped in count and bytes.
• An agent recalls its brief before it plans; a correction becomes a rule briefed to every later agent.
• Every call reads and writes only the verified caller's entries; Forget deletes the row.

Evidence

Proof attached to a change and read by code; a job moves only when a gate finds it.

• Checked means a signed gate report, exit 0, on the PR head merged with current main.
• Revert, release and cancel are transitions a gate judges, stored with their evidence.
• Attestations are in-toto statements signed with Ed25519, stored only after the signature verifies.

• Check · signed report, exit 0, on the merged headon record
• Approval · device key, payload frozenon record
• Attestation · signature verified, then storedon record

Agents

Coordinator, planner and workers. Each AI step is a turn on a runner the user owns, on their own subscription.

• The coordinator runs no model and holds no model credential.
• A job runs in a fresh worktree with a scrubbed environment and build caps; the Running gate checks all three.
• Each agent acts as its own subject; services see only the scopes and role the edge verified.

• coordinatorgates the job
• plannerplans the items
• workerfresh worktree