When system limits the flow,one need to transform the system.
See it to believe what designed software delivery looks like.
A person and a model get the same thing: a session scoped to intents. An agent that may promote cannot delete, cannot read a key, and cannot reach a cloud it was not declared into.
Cloud tokens, registry keys and repo access are held once, by the platform, and lent to an act. A re-org transfers custody. Nobody re-enters a secret, and nothing moves out of your cloud.
A failed build is build.witness · refused with a reason the system can act on, never a stack trace a person has to read. Convergence is repeatable: the same declaration, the same result.
System branches
A code branch holds files. A system branch holds the whole declared world, and every environment is one: preview, production, a re-org's new home. Diverge by declaration, converge by the platform, never by hand.
System branches are derived by transformers and materialized across generations. The intent catalogue is the compatibility contract, so a branch evolves by adding and retiring intents, never by a version prefix in a path.
The console
One conversation opens a workspace, runs the preview, lands the change and promotes it. GitHub, the cloud, the runners and the toolchain sit behind the console, declared once by the designer and never in the developer's hands.
One view
There is one ledger, written by the platform, and every role reads it in its own terms. No weekly slide rebuilt from five tools, and no number that disagrees with another number.
CEO
Releases per week, time from edit to production, what is stuck and why.
CTO
Branches, convergence state, refusals named, nothing drifting by hand.
CFO
Principals and components under convergence, compute on your own bill, no platform-team line.
Platform engineer
Topology, custody and intents, every change judged whole before admission.
DevOps engineer
Runs, witnesses, artifacts, releases and rollbacks, with provider evidence attached.
Same data, five readings. The ledger is the only source.
Security
Nobody holds a credential, so nobody can leak one. Security writes the policy once, as intent filters, and the system enforces it on every act, human or agent.
Developers get a session scoped to intents. Cloud keys, repo tokens and registry secrets live in custody and are lent to acts, never to people.
Same session, same scope. An agent that may promote cannot reach a cloud console, because it was never given anything to reach with.
There is nothing on the laptop to paste into a brief. A real session shipped to production with no git, no cloud CLI and no key.
Tools sit behind the console, declared by the designer. Security never audits who has GitHub, who has AWS, who has the deploy bot.
Define who may do what, per branch, per intent. Convergence refuses anything outside it, with a named reason, and every act lands in the ledger.
Zero credentials in circulation. One policy. Every act witnessed.
Developers
We took it to give you back the part you enjoy and get paid for: building the feature. Any IDE, any harness, any agent, any language. Total freedom in how the code gets written. None in how it gets to production.
Your editor, your terminal, your coding agent, your branch. The workspace brings the declared toolchain and a live preview to your Mac and gets out of the way.
Which runner, which cloud, which token, which pipeline file. There is one road to production, it is declared, and you cannot drive off it.
No firewall ticket. No database ticket. No new-service ticket. Your system branch is yours: declare the service, the database, the route, and build against them today. When it works, hand over the whole branch as one pull request, infra and all.
Why it is a relief
We took away everything you hated. We gave you everything you wanted but never had. This is a builder's world. Build with zero friction.
Non-developers with ideas
Product managers, designers, founders, analysts. You want to build the feature and demo it. Between you and that demo sits git, npm, nix, push and pull, a change across a dozen repositories, integration tests, a build, and a queue of developers from three teams who have to agree before anything moves. Not any more.
Open a workspace, tell the console what you want, and an agent implements it inside a declared toolchain with a live preview. No installs, no credentials, nothing to learn first.
Your work lives on its own system branch. It cannot reach production, another team's branch or a shared database until it is promoted, and promotion refuses anything that does not converge.
Add oversight on a branch with one filter. An engineer can take over, fix the architecture or redesign the approach, and the branch keeps your work and theirs in one ledger.
Build it. Show it. Hand it over. The plumbing was never yours.
Who ships here
Authority is an intent filter attached to a session, never a key on a machine. The designer declares the tools. The agents, natural and artificial, work tool-free.
Natural · developer
Opens a workspace, gets a declared toolchain through Nix and a live preview on their own machine. Edits files. Promotes. Never installs a runtime, never signs in to a cloud.
Artificial · coding agent
Same workspace, same intents, same refusals. It can read the ledger and land a change. It cannot reach GitHub, a cloud console or a secret, because it was never given one to reach with.
Natural · designer
Declares branches, infra, integrations and custody. Brings GitHub, the clouds and the runners once, so no agent ever has to. Holds no more than the next person: the credentials live in the platform, and withdrawal is one act with a witness.
Claude Code, Codex, Devin, a Cursor background agent, your own harness. Give it a workspace brief and nothing else. If it needs a credential to do its job, the brief is wrong, not the platform.
Integrations held in custody, declared once
Infra catalogue
Each is a typed component with a schema, a provider list and a lifecycle. Those marked anchored hold state: the platform may redraw everything around them, and may never delete them to satisfy a diff.
The contract
No version prefix will ever appear in a path. Evolution happens by adding and retiring intents inside a branch, and by materializing a new system branch across generations.
Roles are intent filters. Held identities are minted and revoked as acts.
System branches derived by transformers, materialized across generations.
Topology, named values and registries, judged whole before admission.
Regions, seeds, snapshots and the managed workspace lifecycle.
Runs carry provider evidence. Logs are read through the platform, never a console.
Build outputs are witnessed. Releases are pointers. Rollback is one act.
Agents are residents of a branch with turns, consoles and conduct conditions.
The inventory and guide are intents too. Nothing in the registry is invisible.
Pricing
Two counters: principals who can act, and components with an active infra target. Never build minutes, never sandbox hours. That is your cloud bill, and it stays yours.
Free
$0
forever, for small worlds
Team
$30/ developer / month
$10 per agent · $15 per component
Enterprise
Custom
from $45,000 / year platform fee
Volume breaks on components above 50. No exit fee: a branch declaration re-declares anywhere, and nothing you own moves out of your cloud when you leave.
The wizard creates a project, declares a branch with an edge target, DNS and an artifact store, and promotes a first release. The one credential involved is yours, entered once, into custody.
Where it runs
Runs on
