Esta página también está disponible en español.
Leer en españolEsta página também está disponível em português.
Ler em portuguêsCommitCycle gives that work somewhere to live. The paths that would hurt get an owner and a risk level; each agent gets access to one task on one branch, and it expires on its own. Moving a wall takes one approval — with a reason, on the record.
CommitCycle is built under CommitCycle, and it runs today — boards, the agent connector, repository setup, and the plugin that denies a write before it lands, which anyone can install. A board is what needs an invitation while this is new, and that is a queue rather than a coming-soon page.
$ cycle start "add an org index" --goal "index org lookups" --non-goals "no data backfill" --criteria "the query plan uses it" board https://dash.commitcycle.com · pow/commitcycleCC-42 is In Progress on task/CC-42-add-an-org-index open no protected zones — everything unprotected is yours already record .zones/tasks/CC-42.md● Edit apps/api/migrations/0007_add_org_index.sql✗ Denied by CC zone schema · risk high owner paulo@commitcycle.com task CC-42 declared no protected zones reason path is in a zone the task never asked for$ cycle request-access --zone schema --mode write --reason "the index needs a migration" --alternative "hand the DDL to the owner"REQ-7 sent to paulo@commitcycle.com Approving opens schema for this task only, for as long as you say. Answer it in the console, or with cycle requests.Four things, in the order you meet them: it captures the work, hands the agent the context this repo runs on, holds it to the limits the task declared, and leaves a record of what actually happened.
One line lands in Triage in about four seconds. Triage to Done, with exactly two transitions that check anything.
File and scope work without leaving your session. It cannot start anything — that stays at the gate.
The AGENTS.md block is generated from the same zone map — one file, current, not retyped per session.
Path patterns, a risk level and a default policy, in a file you review like code.
Bound to a task and a branch. They expire on their own, so nobody has to remember to close them.
Per-call consent is safety by fatigue. The task is the consent, it expires, and the decision costs 68–83 ms.
Shell writes run against a git snapshot and anything outside your zones is reverted, byte-for-byte.
Not per-line authorship — declared versus touched, who approved, what was overridden and why. It outlives the tool.
From audit records in this repository, not from a benchmark designed to win. A gate that oversells itself gets uninstalled in week two.
CC-3
25 / 25
Bash escape vectors contained
sed -i, python -c, tee, redirects, git checkout --, and an npm run whose build script writes into a protected path. Executed against a fixture repo and verified byte-for-byte, not simulated.
What it doesn't proveGitignored paths inside a zone are not covered — and .env is both gitignored and the archetypal secret.
CC-3
0 / 20
false positives on ordinary commands
The conservative allowlist stopped 24 of 24 attacks and blocked 8 of 20 legitimate commands, mkdir and cp among them. A 40% false-positive rate is the week-two uninstall arriving with a perfect scoreboard, so the design was inverted.
What it doesn't proveTwenty commands we chose ourselves, not twenty real tasks. Phase 6 is the real test and it has not run.
CC-1
68–83 ms
added to a tool call, p95
Over 120 cold process spawns — the hook is a new process on every call, and warm timings would have flattered it.
What it doesn't proveOne machine, idle. p99 reached 102 ms against a 100 ms budget.
A private Obsidian vault, a CLAUDE.md that drifted three sprints ago, an AGENTS.md nobody trusts. Per-person upkeep, per-person answers.
cycle sync generates the agent’s context from zones.yml — active task, open zones, non-goals — between markers in AGENTS.md, touching nothing outside them. The same file for every person and every agent, reviewed like code.
Both convinced they own the same module. One quietly reverts the other, and the honest fix is going back to one agent at a time.
A grant is bound to a task and a branch, opens only the zones that task declared, and expires on its own — so reaching outside it is refused while it happens, not discovered at review. Worktrees isolate; they do not decide. CC confines each agent; it does not arbitrate between them.
Grants and access requestsAGENTS.md asks the agent to stay out of migrations/. Asking works right up until it doesn’t, and no line in any log shows that it didn’t.
Mark the irreversible paths as zones with an owner, a risk level and a deny policy — then a grant opens only what the task declared, and only until it expires. The zone model is agent-agnostic; the enforcement point needs one small adapter per harness, and today exactly one ships. 25 of 25 escape vectors contained, on a corpus we chose ourselves.
The task lives in a browser tab you are not in, so work starts undescribed and the first record of its scope is the diff.
An MCP server files and scopes the task from inside the session you are already in — zone map, four fields, saved. No tool there issues a grant, approves access or decides a transition: moving a task is the gate’s call, made by the same rules whichever client asks.
The MCP serverLayer 1
AGENTS.md
Tells the agent the rules in language it reads, and enforces nothing whatsoever. This layer is documentation, and we would rather call it that.
advisoryLayer 2
Pre-tool-call hook
Decides every tool call against the grant on disk: allow, ask, deny. Never touches the network, so an outage cannot open a zone. The zone model is agent-agnostic — this layer needs one small adapter per harness, and one ships today.
blockingLayer 3
GitHub Action
Re-runs the same zone matching against the pull request, from the same implementation. The deterministic net under whatever the laptop missed.
blockingPermanent decisions from the spec, not a roadmap in disguise. The fastest way to lose a developer’s trust is to be vague here and specific later.
Not your tests, not your migrations, not your deploy. CC asks for evidence and checks it. Anything executing on your behalf is blast radius we would be adding.
Visual evidence is a URL you already have, or a capture you attach. Preview hosting is a product, not a side effect of a checklist item.
The first version ships its own board — five fixed states are what let the gate mean anything. Intake is an API, so a webhook bridges whatever you use today.
The MCP server ships, and files, drafts and reports. It issues no grant. An agent chooses whether to call a tool, and a boundary you can decline to call is not one.
macOS and Linux only. Saying so now is cheaper for both of us than a support matrix that quietly does not include you.
Signup is closed while this is small. Not because there is nothing to use — there is, and the four steps in the quickstart are the real ones — but because the people using it early get answered personally, and that stops being true past a certain number.
Tell us what you would be gating. Two questions, and they decide what gets built next as much as they decide the queue. If your setup is one we can support properly today, you will hear back quickly; if it is not, we would rather say so than have you find out.
Already have an account? Sign in.