Two human gates
Intent approval, then PR approval. The machine pauses; you decide.
governance · the buyer page → →
Two human gates. Everything audited.
Nothing is pushed, merged, or written to your tracker without an explicit human approval — and every action is recorded in an append-only log you can replay.
watch a run flow — it pauses at each gate until you approve
Requirementsthe ask
→ Intentsplanned changes
→ 🔒
GATE 1human approvalGrounded codegen+ tests
→ Reviewdiff you read
→ 🔒
GATE 2human approvalPRpushed on approval
The two gates are the only places the machine writes to the outside world — and both need you.
Policy-as-code
Rules live in version control, reviewed like any other code.
Append-only audit
Every action recorded. Nothing rewritten after the fact.
Replayable runs
Durable execution on Temporal — re-run a workflow deterministically.
Budget caps
Hard spend and step limits on any autonomous run.
Safe by default
--safe writes nothing external. Opt in to every side effect.