Skip to main content

The coding agent

Every agent platform can make a model write code. The difference here is what surrounds the edit: a change carries a cryptographic receipt naming who and what produced it, the run is refusable at the decision boundary, and the identical plan → edit → search → test → commit loop runs inside a disconnected device with zero egress.

This page is the engine: what a run actually does, coding crews, the governance that has no rival counterpart, and the disconnected edge surface. For the consoles a developer actually touches, start at Software engineering.

What a run actually does​

Six phases, and the interesting property is that the model is never asked whether its own edit worked.

  1. Provision. Clone the bound repository into a fresh per-run workspace. A clone that fails fails the run with the real error, no repair is attempted over a tree that was never checked out.
  2. Bootstrap the environment. Dependencies are installed once, before the first verify, so a repair loop does not burn its budget chasing phantom import failures. Language and package manager are detected across seven language families, with a monorepo walk that reports each sub-project separately. The install runs inside one bounded egress window whose registry host is authorised by the egress broker; after it, the network is sealed and the run is offline.
  3. Navigate. Three layered retrieval surfaces: a repo map (a symbol table of contents, cached on file content hash so an edit cannot serve stale symbols), code search (regex grep, root-confined), and code context (semantic retrieval over a compartment-scoped vector space, so retrieval cannot reach another workspace's code). A language outside the supported set is omitted, never faked.
  4. Edit. Two surgical primitives instead of whole-file overwrite: str_replace, which refuses a target that is absent or ambiguous, and a unified-diff applier that verifies every context and removed line and refuses a patch against drifted content. Multi-file work that only makes sense together runs as an atomic changeset, snapshot, apply, and on any failure restore every snapshot. Every path is confined to the workspace root.
  5. Verify, deterministically. The loop reads the compiler and the test suite, not the model's opinion. Eight test frameworks are auto-detected and parsed into a structured verdict; seven diagnostics tools run in machine-readable mode. A framework outside the matrix is an explicit unsupported error, never faked as passed.
  6. Repair. Each iteration edits, then verifies. Clean diagnostics and a green suite is success, both required. A run ends in exactly one of three states: succeeded, failed (a clean give-up carrying the last real failures, never a fabricated success), or halted by the net-potential-gain gate before the next iteration's budget is spent.

Throughout, the run keeps a durable plan rather than holding it in the conversation, so a run that restarts, or is picked up by a peer cell, reconstructs its plan. Runs can be cancelled and resumed.

Coding crews​

A task can be run by one agent or by a crew. A formation compiles to seats, each equipped with exactly its role's tool ceiling, so a Scout or Verifier seat without write authority cannot apply a patch and produces no changeset; it can only read, review, and verify.

The whole fan-out is authorised once: a hard depth cap first, then the net-potential-gain gate, a runaway fan-out is refused as net-negative rather than allowed to look productive at system cost. Each seat's credential is minted as the intersection of what was requested and what the parent holds. Seats coordinate over a durable blackboard with exactly-once task claiming and compare-and-set locks on edits, and a consequential merge is gated on signature-verified quorum.

The governance with no rival counterpart​

Every applied diff produces a signed, chained receipt. The receipt records who, what, why, and as-of-when, with the diff's SHA-256, a link to the previous receipt's hash, and a real Ed25519 detached signature over the canonical receipt bytes. Verification is stateless and offline: a third party needs only the receipt, the diff text, and the signer's raw public key, no database, no service, no account. A changed diff or any changed metadata field is rejected, and receipts are chained per run so removing one is detectable.

Nothing commits until it is scanned. A fail-closed pre-commit assurance gate runs in-sandbox over the pending changeset and composes existing security primitives:

  • Secrets: credential detectors plus a Shannon-entropy detector for high-entropy tokens;
  • Static analysis: a real Python-AST checker over a covered rule set; an uncovered language is reported unsupported, never faked clean;
  • Licence and SBOM: touched dependency manifests are parsed, each declared licence is checked against policy, and an SPDX SBOM fragment is emitted.

Any secret, any medium or high static-analysis finding, or any disallowed licence blocks the commit.

A run is governed as a unit. A run-level net-potential-gain governor evaluates the aggregate, value delivered against tokens, wall-clock, sub-agent fan-out, and churn, and a net-negative run is halted and marked requeue-recommended.

Git write authority is graded. Status, diff, log, and branches are read-safe; create-branch, checkout, commit, and open-pull-request are consequential and gated. The two genuinely destructive operations, hard reset and branch delete, require both an operator capability set at construction and an explicit per-call flag. Force-push, rebase, commit --amend, and filter-branch are not exposed as tools at all, the strongest guard against an agent rewriting an audit trail is non-exposure.

Project memory is workspace-isolated and bitemporal. Conventions, decisions, gotchas, and architecture notes persist across runs with citations and as-of / valid time; updating a fact supersedes it rather than overwriting, so the full history stays readable.

The same coding agent, disconnected​

This is the part with no commodity equivalent. The Edge Agent carries a sovereign coding surface, apply_patch, code.search, test.run, and the git.* family, dispatched first in the on-device tool set. Both agent entry points compose the same shared dispatcher, so the conversational and single-shot paths cannot drift apart.

A local model reasons on-device; the coding tools plan, edit, search, test, and commit; not a byte leaves the device. It is a behavioural mirror of the core, not a reduced sibling: the same unique-match str_replace and hunk-verified diff applier, the same root confinement, the same ripgrep-preferred search with an in-process fallback, and the same eight test frameworks parsed into a structured verdict.

Its confinement is tighter than a shell, never looser. Every process runs through one runaway-guarded primitive (argv, never a shell) with an inherited timeout, an output cap, and a scrubbed environment; every tool passes the same four-layer permission gate; the destructive git operations carry the same dual gate; and any caller-supplied value beginning with - is refused, so a model cannot smuggle --force through a branch-name field.

See also​