· Security & governance

Worst case is a rejected pull request.

Governance isn't a slide here. It is the first thing that was built, and every other subsystem runs inside it. Built for the question a CISO actually asks: what's the worst that can happen?

gates per change
14
human signatures
3
direct to main
0
kill switch
1 click

01The controls

Six controls. Each one either exists or it doesn’t.

enforced controls6 active
  • vault

    Secrets can't leak

    The vault is the only writer of secret values: 0600 files outside the checkout, shredded on rotation. Tokens never touch Jira, logs, or commits. The secret scan gate blocks committed credentials; it has refused a reviewer's request to hardcode an API key, live.

  • ingress

    Prompt injection, neutralized

    An ingress firewall screens every inbound human or web reply. Pasted secrets are quarantined and injection patterns neutralized before any model sees them. Gate verdicts are deterministic code an injected prompt cannot vote on.

  • blast radius

    Blast radius = a rejected PR

    No direct to main, ever. Everything ships through PRs behind branch protection, peer review, and the gate chain. Per bot least privilege tokens scope each bot to its repos. One click on the kill switch stops the fleet.

  • migrations

    Database safe fail

    Deep verify blocks irreversible migrations before they ship; risky changes must carry a reversibility plan or they don't merge. In a live run, a seed script containing DROP TABLE was held for human sign off.

  • audit

    Attributable & replayable

    Every action is hash chained with the actor's identity: which bot, which gate, which approval. Alter one record and every hash after it breaks. Incident forensics and SOC 2 evidence are the same artifact.

  • tenancy

    Isolation & escalation

    Per tenant state, policy, keys, and kill switch. Control plane API keys are stored hash only. Money moving, irreversible, or cross team actions hit a hard escalation contract: a human signs, or it doesn't happen.

02The chain

What every change passes before it can merge.

Every ticket carries its own chain: pass, waiting, or skip, each with evidence a non expert can read. Nothing merges around it.

verification chain14 gates
  1. 01Right repository: automatic
  2. 02Requirements understood: automatic
  3. 03Dependencies built first: automatic
  4. 04Plan approved: human decision
  5. 05Novelty calibration: automatic
  6. 06Rework until shippable: automatic
  7. 07Tests green: automatic
  8. 08Code quality: automatic
  9. 09Every change is tested: automatic
  10. 10No secrets in the code: automatic
  11. 11Risk & confidence: automatic
  12. 12Independent review: human decision
  13. 13Merged: human decision
  14. 14Watched after merge: automatic
11 automatic3 human decisions0 skippable
  1. 01

    Right repository

    resolves the target repo from the ticket, using a curated registry or semantic match

  2. 02

    Requirements understood

    no material ambiguity. Clarifies with a human before building and never guesses

  3. 03

    Dependencies built first

    nothing this change depends on is missing; parks and resumes if it is

  4. 04

    Plan approvedhuman

    the plan is posted to Jira and waits. It never writes code before a human sees it

  5. 05

    Novelty calibration

    routine work ships; unfamiliar territory forces extra deliberation and a human merge

  6. 06

    Rework until shippable

    when a gate pushes back, it improves the change and runs again. It does not give up

  7. 07

    Tests green

    the change's own suite passes; for a bug, a red to green reproduction proves the fix

  8. 08

    Code quality

    0 findings: no leaks, deadlocks, bug patterns, or injections

  9. 09

    Every change is tested

    each changed file has covering tests; missing ones are written before the PR

  10. 10

    No secrets in the code

    scanned for live credential values and secret patterns: clean

  11. 11

    Risk & confidence

    scores risk and confidence; anything past the cap escalates to a human

  12. 12

    Independent reviewhuman

    a second agent reviews a 7 point checklist; a human reviewer signs the PR

  13. 13

    Mergedhuman

    merges only on verified green tests, CI, no conflicts, and review approval

  14. 14

    Watched after merge

    watches CI and production after merge; raises a revert alert if it regresses

03The record

Every action, hash chained.

Each record commits to the one before it. Change any past decision and every subsequent hash breaks, so the log is either intact or provably altered. Optionally HMAC signed, and exportable for SOC 2.

audit trailappend only
  • 03:05:12toorunt sam plan_approved#9f3a1c
  • 03:05:04founder approve_prd#1b77e0
  • 03:04:51toorunt sam tests_green#c40d92
  • 03:04:39toorunt tyler peer_review:approve#77a5f1
  • 03:04:22toorunt sam secret_scan:clean#2e9b04
  • 03:04:08toorunt sam merge:verified green#b81c6d
  • 03:03:55toorunt sam watchdog:armed#5d2af8
  • 03:03:40founder kill_switch:off#0ac913
  • 03:05:12toorunt sam plan_approved#9f3a1c
  • 03:05:04founder approve_prd#1b77e0
  • 03:04:51toorunt sam tests_green#c40d92
  • 03:04:39toorunt tyler peer_review:approve#77a5f1
  • 03:04:22toorunt sam secret_scan:clean#2e9b04
  • 03:04:08toorunt sam merge:verified green#b81c6d
  • 03:03:55toorunt sam watchdog:armed#5d2af8
  • 03:03:40founder kill_switch:off#0ac913

For security teams

Bring the questions. We built for them.

SOC 2 Type I on the roadmap, pen test scheduled, zero retention model terms. Book a security review.

Book a demoSee how it ships →