codecain
Get started

Connected-computer execution is live · hosted sandbox is planned

Fat lines of the cleanest code…
Bring proof.

codecain_ executes bounded engineering work in disposable, policy-gated workspaces, runs the required checks itself, and seals the evidence. You get a branch, the receipts, and the final say.

Get started See how it works →
Live run theatre SIMULATION — scripted demo data, nothing executes

Watch custody happen.

A deterministic replay of a real private-MVP run shape: the contract lands, the gate narrows it, the workspace isolates it, the harness proves it. Proof drops surface as they are earned. You control the pace — pause, skip, or stop at any time, or press Esc.

  1. 01Contract
  2. 02Gate
  3. 03Isolate
  4. 04Execute
  5. 05Prove

Idle — no simulated run in progress.

ACTIVITYEvent stream
SIMULATED
    Clean product boundary

    You set the intent.
    codecain_ builds.

    APPAMATIK

    Manage the whole operation

    You choose the repository, scope, checks, limits, and final approval. The work begins only after the contract is clear.

    codecain_

    Execute the engineering

    Validates the contract, narrows permissions, edits in a disposable clone, runs the checks itself, and returns sealed evidence with a gated handoff.

    Chain of custody

    Every run has receipts.

    01

    Contract

    Repository, scope, acceptance criteria, permissions, checks, and limits arrive explicitly and versioned.

    02

    Gate

    Deny by default. Effective capability is an intersection — repository content can never grant itself more authority.

    03

    Isolate

    One task, one disposable workspace, one codecain/* branch, credentials torn down on every exit path.

    04

    Execute

    A replaceable provider adapter does the coding work inside the disposable workspace on your connected computer. No vendor defines the product.

    05

    Prove

    The harness runs the checks and captures output verbatim. Evidence is sealed, hashes and all. Blocked runs return proof of why.

    Honest current state

    What is real today.

    LIVE — CONNECTED COMPUTER

    Production execution with credentials kept on your machine

    • Durable owner-scoped control plane, jobs, events, leases, and approvals
    • GitHub App installation-token authentication
    • Disposable clones and codecain/* branches
    • Claude and Codex subscription-backed local adapters
    • Harness-executed checks, secret redaction, and sealed evidence
    • Human-approved isolated branches and draft pull requests
    PLANNED — HOSTED SANDBOX

    Managed execution without a connected computer

    • Container/VM isolation with egress controls
    • Managed sandbox workers and ephemeral credentials
    • Hosted provider execution independent of a user machine
    • Additional independently verified provider adapters

    executionMode: connected-computer · hostedSandboxLive: false