---
title: "Run several AI coding agents on one repo — CommitCycle"
description: "Give each agent one task, on one branch, with access that expires. The paths that would hurt get an owner, and moving a wall takes one approval."
url: https://commitcycle.com/
language: en
---

# Several AI coding agents on one repo. One quietly reverts the other.

> Give each agent one task, on one branch, with access that expires. The paths that would hurt get an owner, and moving a wall takes one approval.

[Install The plugin, with the hook, installs without an invite](https://commitcycle.com/docs/start/install/)

CommitCycle gives that work somewhere to live. The paths that would hurt get an owner and a risk level; each agent, in its own checkout, gets access for one task on one branch, and it expires on its own. Moving a wall takes one approval — with a reason, on the record.

[Ask for an invite](https://commitcycle.com/#start) [See how it works](https://commitcycle.com/zones/)

CommitCycle is built under CommitCycle, and it runs today — boards, the agent connector, repository setup, and the plugin that denies a write before it lands, which anyone can install. A board is what needs an invitation while this is new, and that is a queue rather than a coming-soon page.

**Claude:** Add the board’s connector URL and Claude files and scopes the task from the chat — nothing to install. It cannot approve access: the gate and the zone’s owner decide.

**Cursor:** The same connector in Cursor: start the task, read why a file last changed, hand the work in. With the connector alone, nothing on the machine blocks a write.

**Console:** In the console a task crosses the gate into In Progress, and a zone’s owner answers an access request — for one hour, four, or until the task closes.

**Claude Code:** The hook refuses the write before it lands, names the zone and its owner, and the agent asks for access instead of looking for another way in. Claude Code is where this block has been seen working.

**Terminal:** From a terminal, cycle does each step in one command: start brings the grant onto the machine, submit hands it back.

## What CommitCycle does

Four things, in the order you meet them: it **captures** the work, hands the agent the **context** this repo runs on, holds it to the **limits** the task declared, and leaves a **record** of what actually happened.

- ### [A five-state board](https://commitcycle.com/docs/concepts/the-board/)
  [One line reached Triage 4.0 s after the click, with the typing scripted — measured once, on 2026-08-04. Triage to Done, with two gated transitions: into In Progress and into Done.](https://commitcycle.com/docs/concepts/the-board/)
- ### [An MCP server](https://commitcycle.com/docs/reference/mcp/)
  [File and scope work without leaving your session. It approves nothing — starting work is still the gate’s call.](https://commitcycle.com/docs/reference/mcp/)
- ### [Context every agent reads](https://commitcycle.com/docs/concepts/agents-md/)
  [The AGENTS.md block is generated from the same zone map — one file, current, not retyped per session.](https://commitcycle.com/docs/concepts/agents-md/)
- ### [Zones with owners](https://commitcycle.com/zones/)
  [Path patterns, a risk level and a default policy, in a file you review like code. A repository starts with none, in memory mode, until you choose governance.](https://commitcycle.com/zones/)
- ### [Just-in-time grants](https://commitcycle.com/zones/)
  [Bound to a task and a branch. They expire on their own, so nobody has to remember to close them.](https://commitcycle.com/zones/)
- ### [One approval to move a wall](https://commitcycle.com/zones/)
  [A protected zone opens for the task once, with a reason, and closes when the grant expires. The hook only narrows — your harness’s own permission prompts still apply. A decision cost 68–83 ms at p95 on one idle machine, measured on 2026-08-03; CC-1377 re-timed it in October 2026 on two cloud VMs and found it depends on the host: 211–228 ms at p95 on the slower one.](https://commitcycle.com/zones/)
- ### [Bash contained, not guessed](https://commitcycle.com/zones/)
  [Shell writes run against a git snapshot, and changes to protected paths the task does not hold are reverted, byte-for-byte — gitignored files excepted, and what a command leaves running (a background run the hook asks about first, a timeout, a cmd &) is checked only at the close.](https://commitcycle.com/zones/)
- ### [One governance record per task](https://commitcycle.com/docs/operations/audit-record/)
  [Not per-line authorship — declared versus touched, who approved, what was overridden and why. It outlives the tool.](https://commitcycle.com/docs/operations/audit-record/)

## Every number here has its limits printed next to it

From audit records in this repository, not from a benchmark designed to win.

CC-3

25 / 25

Bash escape vectors contained

`sed -i`, `python -c`, `tee`, redirects, `git checkout --`, and an `npm run` whose build script writes into a protected path. Executed against a fixture repo and verified byte-for-byte, not simulated.

**What it doesn't prove** Measured 2026-08-03. Gitignored paths inside a zone are not covered — and `.env` is both gitignored and the archetypal secret.

CC-3

0 / 20

false positives on ordinary commands

The conservative allowlist stopped 24 of 24 attacks and blocked 8 of 20 legitimate commands, `mkdir` and `cp` among them. A 40% false-positive rate is the week-two uninstall arriving with a perfect scoreboard, so the design was inverted.

**What it doesn't prove** Twenty commands we chose ourselves, measured 2026-08-03 — not twenty real tasks. On its first day over this repository it refused three legitimate commands in five minutes. Phase 6 is the real test and it has not run.

CC-1

68–83 ms

added to a tool call, p95

Over 120 cold process spawns — the hook is a new process on every call, and warm timings would have flattered it.

**What it doesn't prove** One machine, idle, on 2026-08-03, with the first hook build. p99 reached 102 ms against a 100 ms budget. CC-1377 re-timed it in October 2026 on two cloud VMs: on the slower one wrapper and core reached 211–228 ms at p95 (load 0.74–1.04), and the hook’s cost over a shell-launched node process was 84–111 ms there against 44–48 ms on the faster one, for the same code. Two hosts, not a survey.

## Four things break when a team points agents at one repo.

How do you share context between AI coding agents across a team?

### Context that lives on one laptop

A private Obsidian vault, a CLAUDE.md that drifted three sprints ago, an AGENTS.md nobody trusts. Per-person upkeep, per-person answers.

`cycle sync` writes the zone map between markers in `AGENTS.md`, touching nothing outside them — the same file for every person and every agent, reviewed like code. The active task, its open zones and its non-goals go to a gitignored `CLAUDE.local.md`, which Claude Code loads.

[The context block](https://commitcycle.com/docs/concepts/agents-md/)

How do you run several AI coding agents on the same repository without them overwriting each other?

### Two agents, one repo, no referee

Both convinced they own the same module. One quietly reverts the other, and the honest fix is going back to one agent at a time.

A grant is bound to a task **and** a branch, opens only the zones that task declared, and **expires on its own** — so reaching outside it is refused while it happens, not discovered at review. Worktrees isolate; they do not decide. CC confines each checkout — two agents in one directory share its task and its grant — and it does not arbitrate between them.

[Grants and access requests](https://commitcycle.com/docs/concepts/grants/)

How do you stop an AI coding agent from editing files it should not touch?

### A prompt is not a permission

AGENTS.md asks the agent to stay out of migrations/. Asking works right up until it doesn’t, and no line in any log shows that it didn’t.

Mark the irreversible paths as zones with an **owner** and a risk level — writing into any zone takes a grant, whatever its policy (`deny` closes reading too), and a grant opens only what the task declared, and only until it expires. The zone model is agent-agnostic; the enforcement point needs one small adapter per harness, and **today only the Claude Code one has been seen to deny on a real install**. 25 of 25 escape vectors contained on 2026-08-03, on a corpus we chose ourselves.

[Zones, and what not to declare](https://commitcycle.com/docs/concepts/zones/)

Can you create and scope tasks for a coding agent without leaving the session you are in?

### Describing the work costs more than doing it

The task lives in a browser tab you are not in, so work starts undescribed and the first record of its scope is the diff.

An MCP server files and scopes the task from inside the session you are already in — zone map, four fields, saved. No tool there approves access or gets around the gate: the hosted connector’s `cc_start` asks it, and moving a task is the gate’s call, made by the same rules whichever client asks.

[The MCP server](https://commitcycle.com/docs/reference/mcp/)

## Three layers: one advises, one denies, one re-checks

Layer 1

### Context

AGENTS.md

Tells the agent the rules in language it reads, and enforces nothing whatsoever. This layer is documentation, and we would rather call it that.

advisory

Layer 2

### Policy enforcement

Pre-tool-call hook

Checks every tool call against the grant on disk and denies what it does not cover. It never answers allow, so your harness’s own permission prompts still apply. Never touches the network, so an outage cannot open a zone. The zone model is agent-agnostic — this layer needs one small adapter per harness, and only the Claude Code one has been seen to deny on a real install.

blocking

Layer 3

### Pull request check

GitHub Action

Re-runs the same zone matching against the pull request, from the same implementation. It checks what the task declared, not the grant; it passes when the board does not answer; and it stops a merge only where branch protection requires it. It runs in this repository only and is not published.

checking

We measured, on 2026-08-03, what Claude Code does when the hook fails — hung past its timeout, crashed, returned malformed output, or was never installed. **In all four cases the write went through.**

A hook is fail-open unless you build the thing that closes it, so we built it: a wrapper that always answers, and answers _deny_ when the core doesn’t — if the repository’s failure policy is set to closed. That covers three of the four. The default policy is open: calls continue under your own permission settings and the session is told. The fourth — a session that ran with no hook installed — is invisible to Layer 2 by construction, which is why Layer 3 re-checks the diff on the pull request — and that stops a merge only where the check is required.

## What CommitCycle won’t do

Decisions from the spec, not a roadmap in disguise.

### ~~Run your code~~

Not your tests, not your migrations, not your deploy. CC asks for evidence and checks it. Anything executing on your behalf is blast radius we would be adding — the one exception is the spike\_cleanup and spike\_verify commands you configure yourself, which cycle discard runs.

### ~~Host preview environments~~

Visual evidence is a URL you already have, or a capture you attach. Preview hosting is a product, not a side effect of a checklist item.

### ~~Replace your tracker~~

The first version ships its own board — five fixed states are what let the gate mean anything. Intake is an API — one POST with a title — so a small bridge you write can feed it from whatever you use today.

### ~~Gate anything through MCP~~

The MCP server files, drafts and reports, and the hosted connector can ask the gate to start, hand in or close a task. No tool approves access, and none enforces anything. An agent chooses whether to call a tool, and a boundary you can decline to call is not one.

### ~~Support Windows, yet~~

macOS and Linux only, and the one refusal here that is not for good: D-25 leaves Windows for after the MVP, and no task on the board is building it. Saying so now is cheaper for both of us than a support matrix that quietly does not include you.

## Ask for an invite

Signup is closed while this is small. Not because there is nothing to use — there is, and the steps in the [quickstart](https://commitcycle.com/docs/start/quickstart/) are the real ones — but because the people using it early get answered personally, and that stops being true past a certain number.

Tell us what you would be gating. Two questions, and they decide what gets built next as much as they decide the queue. If your setup is one we can support properly today, you will hear back quickly; if it is not, we would rather say so than have you find out.

- Your address goes in our own database and nowhere else.
- Free for everyone let in at this stage, and you will hear it from us before that changes.

Already have an account? [Sign in](https://dash.commitcycle.com/).