codecain Run the simulation

Private MVP verified · public production execution is not live

Fat lines of the cleanest code…
Bring proof.

CodeCain executes bounded engineering work in disposable, policy-gated workspaces, runs the required checks itself, and seals the evidence. You get a branch, the receipts, and the final say. Appamatik manages the business. CodeCain handles the code.

Watch a simulated run Understand the custody chain →
Live run theatre SIMULATION — scripted demo data, nothing executes

Watch custody happen.

A deterministic replay of a real private-MVP run shape: the contract lands, the gate narrows it, the workspace isolates it, the harness proves it. Proof drops surface as they are earned. You control the pace — pause, skip, or stop at any time, or press Esc.

  1. 01Contract
  2. 02Gate
  3. 03Isolate
  4. 04Execute
  5. 05Prove

Idle — no simulated run in progress.

ACTIVITYEvent stream
SIMULATED
    Clean product boundary

    Appamatik commands.
    CodeCain builds.

    APPAMATIK

    Manage the whole operation

    Understands apps, businesses, priorities, incidents, approvals, and outcomes. Sends CodeCain signed, bounded task contracts like any other client.

    CODECAIN

    Execute the engineering

    Validates the contract, narrows permissions, edits in a disposable clone, runs the checks itself, and returns sealed evidence with a gated handoff.

    Chain of custody

    Every run has receipts.

    01

    Contract

    Repository, scope, acceptance criteria, permissions, checks, and limits arrive explicitly and versioned.

    02

    Gate

    Deny by default. Effective capability is an intersection — repository content can never grant itself more authority.

    03

    Isolate

    One task, one disposable workspace, one codecain/* branch, credentials torn down on every exit path.

    04

    Execute

    A replaceable provider adapter does the coding work inside the sandbox. No vendor defines the product.

    05

    Prove

    The harness runs the checks and captures output verbatim. Evidence is sealed, hashes and all. Blocked runs return proof of why.

    Honest current state

    What is real today.

    VERIFIED — PRIVATE MVP

    Running on operator-controlled repositories

    • Signed, replay-protected task contracts
    • Per-key repository allowlists and committed check policies
    • Disposable clones and codecain/* branches
    • Harness-executed checks and secret redaction
    • SHA-256-sealed, independently verifiable evidence
    • Cancellation and structured honest blockers
    GATED — NOT LIVE

    Public production execution is not live

    • Container/VM isolation with egress controls
    • GitHub App installation-token authentication
    • Distributed queue, workers, and durable storage
    • Remote push and draft-PR handoff
    • A second verified live provider adapter

    productionExecutionLive: false — and it stays false until every promotion gate is proven.