Esta página también está disponible en español.
Leer en españolEsta página também está disponível em português.
Ler em portuguêsCommitCycle gives that work somewhere to live. The paths that would hurt get an owner and a risk level; each agent, in its own checkout, gets access for one task on one branch, and it expires on its own. Moving a wall takes one approval — with a reason, on the record.
CommitCycle is built under CommitCycle, and it runs today — boards, the agent connector, repository setup, and the plugin that denies a write before it lands, which anyone can install. A board is what needs an invitation while this is new, and that is a queue rather than a coming-soon page.
File a task: the board export times out on large boards.
commitcycle · cc_intake
Filed CC-58 in Triage: Export times out on large boards
A draft of the four answers — correct anything before I save it:
Looks right. Save it.
commitcycle · cc_scope
Saved CC-58, and moved it to Todo — all four answered.
CC-58 is ready. Whoever picks it up starts it in the repository: cycle start CC-58.
Add the board’s connector URL and Claude files and scopes the task from the chat — nothing to install. It cannot approve access: the gate and the zone’s owner decide.
Pick up CC-58.
commitcycle · cc_start
CC-58 is In Progress.
task/CC-58-export-times-out-on-large-boards
No protected zone is open — everything this task declared is unprotected.
commitcycle · cc_why
apps/web/src/export.ts — 1 task(s), newest first:
CC-41 · Done · Stream the export instead of building it in memory
CC-41 already streams the export, so the timeout is the query. Paging it.
Edited export.ts +2 −2
commitcycle · cc_submit
CC-58 is In Review. The zones it had open are closed again.
The same connector in Cursor: start the task, read why a file last changed, hand the work in. With the connector alone, nothing on the machine blocks a write.
✓ gate: four fields answered, no high-risk zone to approve
REQ-7 · schema · write · CC-42
Reason: the board query needs an index
Instead: hand the DDL to the owner
1 hour4 hoursUntil the task closes
✓ Approved — schema is open to CC-42 for 4 hours
In the console a task crosses the gate into In Progress, and a zone’s owner answers an access request — for one hour, four, or until the task closes.
> add an index on tasks.updated_at — the board query is slow
● Write(apps/api/migrations/0042_tasks_updated_at.sql)
⎿ PreToolUse:Write — ✗ Denied by CC
zone schema · risk high
owner ana@acme.dev
task CC-42 declared no protected zones
reason path is in a zone the task never asked for
● The schema zone is closed to CC-42. Asking its owner rather than looking for another way in.
● Bash(cycle request-access --zone schema --mode write --reason "the board query needs an index" --alternative "hand the DDL to the owner")
⎿ REQ-7 is with the zone owner
approve or deny: https://dash.commitcycle.com/requests
The hook refuses the write before it lands, names the zone and its owner, and the agent asks for access instead of looking for another way in. Claude Code is where this block has been seen working.
$ cycle start "Export times out on large boards" \ --goal "a large board exports in one request" \ --non-goals "no format change" \ --criteria "2,000 tasks export without a timeout"
board https://dash.commitcycle.com · acme/web
CC-58 is In Progress on task/CC-58-export-times-out-on-large-boards
open no protected zones — everything unprotected is yours already
record .zones/tasks/CC-58.md
$ cycle submit
CC-58 is now In Review
the grant is gone — protected zones are closed again
From a terminal, cycle does each step in one command: start brings the grant onto the machine, submit hands it back.
Four things, in the order you meet them: it captures the work, hands the agent the context this repo runs on, holds it to the limits the task declared, and leaves a record of what actually happened.
One line reached Triage 4.0 s after the click, with the typing scripted — measured once, on 2026-08-04. Triage to Done, with two gated transitions: into In Progress and into Done.
File and scope work without leaving your session. It approves nothing — starting work is still the gate’s call.
The AGENTS.md block is generated from the same zone map — one file, current, not retyped per session.
Path patterns, a risk level and a default policy, in a file you review like code. A repository starts with none, in memory mode, until you choose governance.
Bound to a task and a branch. They expire on their own, so nobody has to remember to close them.
A protected zone opens for the task once, with a reason, and closes when the grant expires. The hook only narrows — your harness’s own permission prompts still apply. A decision cost 68–83 ms at p95 on one idle machine, measured on 2026-08-03; CC-1377 re-timed it in October 2026 on two cloud VMs and found it depends on the host: 211–228 ms at p95 on the slower one.
Shell writes run against a git snapshot, and changes to protected paths the task does not hold are reverted, byte-for-byte — gitignored files excepted, and what a command leaves running (a background run the hook asks about first, a timeout, a cmd &) is checked only at the close.
Not per-line authorship — declared versus touched, who approved, what was overridden and why. It outlives the tool.
From audit records in this repository, not from a benchmark designed to win.
CC-3
25 / 25
Bash escape vectors contained
sed -i, python -c, tee, redirects, git checkout --, and an npm run whose build script writes into a protected path. Executed against a fixture repo and verified byte-for-byte, not simulated.
What it doesn't prove Measured 2026-08-03. Gitignored paths inside a zone are not covered — and .env is both gitignored and the archetypal secret.
CC-3
0 / 20
false positives on ordinary commands
The conservative allowlist stopped 24 of 24 attacks and blocked 8 of 20 legitimate commands, mkdir and cp among them. A 40% false-positive rate is the week-two uninstall arriving with a perfect scoreboard, so the design was inverted.
What it doesn't prove Twenty commands we chose ourselves, measured 2026-08-03 — not twenty real tasks. On its first day over this repository it refused three legitimate commands in five minutes. Phase 6 is the real test and it has not run.
CC-1
68–83 ms
added to a tool call, p95
Over 120 cold process spawns — the hook is a new process on every call, and warm timings would have flattered it.
What it doesn't prove One machine, idle, on 2026-08-03, with the first hook build. p99 reached 102 ms against a 100 ms budget. CC-1377 re-timed it in October 2026 on two cloud VMs: on the slower one wrapper and core reached 211–228 ms at p95 (load 0.74–1.04), and the hook’s cost over a shell-launched node process was 84–111 ms there against 44–48 ms on the faster one, for the same code. Two hosts, not a survey.
How do you share context between AI coding agents across a team?
A private Obsidian vault, a CLAUDE.md that drifted three sprints ago, an AGENTS.md nobody trusts. Per-person upkeep, per-person answers.
cycle sync writes the zone map between markers in AGENTS.md, touching nothing outside them — the same file for every person and every agent, reviewed like code. The active task, its open zones and its non-goals go to a gitignored CLAUDE.local.md, which Claude Code loads.
How do you run several AI coding agents on the same repository without them overwriting each other?
Both convinced they own the same module. One quietly reverts the other, and the honest fix is going back to one agent at a time.
A grant is bound to a task and a branch, opens only the zones that task declared, and expires on its own — so reaching outside it is refused while it happens, not discovered at review. Worktrees isolate; they do not decide. CC confines each checkout — two agents in one directory share its task and its grant — and it does not arbitrate between them.
Grants and access requestsHow do you stop an AI coding agent from editing files it should not touch?
AGENTS.md asks the agent to stay out of migrations/. Asking works right up until it doesn’t, and no line in any log shows that it didn’t.
Mark the irreversible paths as zones with an owner and a risk level — writing into any zone takes a grant, whatever its policy (deny closes reading too), and a grant opens only what the task declared, and only until it expires. The zone model is agent-agnostic; the enforcement point needs one small adapter per harness, and today only the Claude Code one has been seen to deny on a real install. 25 of 25 escape vectors contained on 2026-08-03, on a corpus we chose ourselves.
Can you create and scope tasks for a coding agent without leaving the session you are in?
The task lives in a browser tab you are not in, so work starts undescribed and the first record of its scope is the diff.
An MCP server files and scopes the task from inside the session you are already in — zone map, four fields, saved. No tool there approves access or gets around the gate: the hosted connector’s cc_start asks it, and moving a task is the gate’s call, made by the same rules whichever client asks.
Layer 1
AGENTS.md
Tells the agent the rules in language it reads, and enforces nothing whatsoever. This layer is documentation, and we would rather call it that.
advisoryLayer 2
Pre-tool-call hook
Checks every tool call against the grant on disk and denies what it does not cover. It never answers allow, so your harness’s own permission prompts still apply. Never touches the network, so an outage cannot open a zone. The zone model is agent-agnostic — this layer needs one small adapter per harness, and only the Claude Code one has been seen to deny on a real install.
blockingLayer 3
GitHub Action
Re-runs the same zone matching against the pull request, from the same implementation. It checks what the task declared, not the grant; it passes when the board does not answer; and it stops a merge only where branch protection requires it. It runs in this repository only and is not published.
checkingDecisions from the spec, not a roadmap in disguise.
Not your tests, not your migrations, not your deploy. CC asks for evidence and checks it. Anything executing on your behalf is blast radius we would be adding — the one exception is the spike_cleanup and spike_verify commands you configure yourself, which cycle discard runs.
Visual evidence is a URL you already have, or a capture you attach. Preview hosting is a product, not a side effect of a checklist item.
The first version ships its own board — five fixed states are what let the gate mean anything. Intake is an API — one POST with a title — so a small bridge you write can feed it from whatever you use today.
The MCP server files, drafts and reports, and the hosted connector can ask the gate to start, hand in or close a task. No tool approves access, and none enforces anything. An agent chooses whether to call a tool, and a boundary you can decline to call is not one.
macOS and Linux only, and the one refusal here that is not for good: D-25 leaves Windows for after the MVP, and no task on the board is building it. Saying so now is cheaper for both of us than a support matrix that quietly does not include you.
Signup is closed while this is small. Not because there is nothing to use — there is, and the steps in the quickstart are the real ones — but because the people using it early get answered personally, and that stops being true past a certain number.
Tell us what you would be gating. Two questions, and they decide what gets built next as much as they decide the queue. If your setup is one we can support properly today, you will hear back quickly; if it is not, we would rather say so than have you find out.
Already have an account? Sign in.
