How it works

Two agents, two refusals, and a policy file you can read

Written for whoever has to sign off on letting this near a repository. If that is you, the parts worth your scepticism are below.

The ruleset

Policy is a file in your repository

Not a settings page, not a model’s judgement. A rule is a name, a grade, and the paths it applies to. Editing it is a pull request like any other: reviewable, diffable, revertible.

The highest matching rule wins, so adding a rule can only ever make something stricter unless you deliberately delete one.

The file itself is graded G4, and an agent is refused write access to it outright. Nothing that decides how an agent is judged can be edited by one.

# Grade precedence: G4 > G3 > G2 > G1.

# Unmatched changes default to G2.

 

## rule: dependency-bumps

grade: G1

paths_only: package.json, pnpm-lock.yaml, go.sum

 

## rule: database-migrations

grade: G4

paths: **/migrations/**, **/sql/**

description: Schema migrations against production data.

After the diff, before the merge

Two checks that run on the change an agent actually made

The grade a card was dispatched under describes what it said it would do. These run against what it did.

Grade drift

The diff is re-graded by the same ruleset. If it comes back riskier than the card was dispatched as, the decision to run it unattended was made on information that turned out to be wrong, so auto-merge is blocked and a person is asked.

This is what stops a styling card that quietly refactored auth.

Path lock

A card declares the paths an agent may touch. Anything outside them is a violation whatever it grades: a clean, well-reviewed, entirely correct change in the wrong file is still refused.

The file list comes out of git, not out of the agent’s account of itself.

Where the code goes

Nowhere. Runners pull; nothing is pushed to them

A runner is a process you start on hardware you own. It asks for work over outbound HTTPS and holds the connection open. No inbound ports, no VPN, no static IP.

Which means a Mac mini under a desk, an EC2 box and a Kubernetes pod all work the same way, behind NAT, and your source never has to leave your network.

The clone token is minted per job

Short-lived, scoped to the one repository, issued when a runner takes the work and expired long before it asks for more.

The model key can be yours

Configured on the runner, where it never reaches us. A key on the machine always beats one the server sends.

Any tool, not just ours

Claude Code and Codex ship as harnesses. Anything that reads a work order and answers with JSON can take their place.

The gate

What has to be true before anything merges itself

gradeThe post-graded diff is within the grade your policy permits to run unattended. Out of the box that is G1 and nothing else.
no driftIt did not grade riskier than it was dispatched as.
pathsEvery changed file is inside the card's declared scope, and none of them is a governance file.
reviewA review agent that is not the one that wrote it has passed the diff.
ciYour own checks have reported green against that commit.

Any one of them missing and the card is waiting for you in the morning instead, with the reason it stopped. The gate is the only thing that can merge. A review agent’s approval is an input to it, not a decision.