An AI team for a company of one.
Say it. Approve the plan. Merge. Ten roles read your repo, split the work, build it, test it and review it — inside containers you never have to open.
You do three things. It does the rest.
Every step that is not a decision with evidence attached is delegated. Blockers reach you; noise does not.
- You say one sentence
- It reads the repo, splits the work, drafts a plan
- You approve — or send it back; it writes another
- It opens a group: writes code, self-checks, runs your tests, hands it to QA
- An auditor outside the group reads the branch, then opens the PR
- You merge
you · 1 sentence: Ship a billing page: Stripe checkout, invoices, a usage graph. Keep the design system. → PR #128 · you merge: Billing page: checkout, invoices, usage (3 slices · 3/3 gates · audited outside the group)
Ten roles with real boundaries.
Only one writes code. Two review it — neither is the author. Adding a role is a YAML file, not code.
- Chief of Staff — works for you · above every project
- Works for you, not for a project. Batches every open question into one message; blockers go straight through. talks to: you · PM. may: interrupt you. may not: touch code.
- Dispatcher — standing · above every group
- One sentence in, a plan out. Counts how many separate asks you actually typed and splits the work into slices you accept one at a time. talks to: you · Architect. may: draft the plan. may not: approve it.
- Architect — standing · above every group
- Standing, above every group. Assigns each group its own paths so two can never collide, then writes two lines on what is wrong with the plan — which you read before approving. talks to: Dispatcher · PM. may: assign file paths. may not: write code.
- PM — inside the group · one container
- The group's one conversational entrance. You say something, one agent answers. talks to: you · Engineer · QA · Chief of Staff. may: talk to you. may not: edit files.
- Engineer — inside the group · one container
- The only agent in a group that writes code. Serialised, so write conflicts do not exist. talks to: PM · QA. may: edit assigned paths. may not: push · see real tokens.
- QA — inside the group · one container
- Checks one slice against its acceptance criteria, from the diff and the test output — deliberately not from the whole repo. talks to: Engineer · PM. may: fail a slice. may not: read the whole repo.
- Auditor — outside the group
- Reviews the finished branch from outside the group, on a different model. Did it deliver what the card promised? Did it reinvent something the codebase already has? talks to: Scribe. may: block the PR. may not: share the group's context.
- Scribe — outside the group
- Writes the commit and the pull request from the finished diff — what was built, not what was planned. talks to: Auditor. may: open the PR. may not: change the diff.
- Librarian — inside the group · one container
- Keeps a project primer and a capped list of lessons learned, so a new agent starts already knowing the project. talks to: PM · Engineer. may: write notes. may not: edit code.
- Bootstrap — inside the group · one container
- Makes a fresh checkout buildable, working the install step out from the lockfile and CI config. talks to: Engineer. may: install dependencies. may not: change source.
How you know it isn't bluffing.
Five things everyone who has used a coding agent has hit — and what is enforced by code, not by a prompt.
- 01
"Done!" — and it isn't.
A slice counts once your own commands pass: test, typecheck, lint. Exit codes decide, not the agent's summary. No percentages — the panel shows which checks passed.
- 02
It reviewed its own work.
Two reviews, neither by the author. QA sees one slice's diff. The Auditor sits outside the group, on a different model, and reads the whole branch.
- 03
It said it changed A; it changed B.
At the end of every slice, what it claimed is compared against what git shows. Mismatches surface there, not while you read the PR.
- 04
It knew the rules at turn 1, forgot them by turn 20.
Anything a check can catch is never left to a prompt: which files a group may touch, how long a note may be, who pushes a stuck state. Prompts get forgotten. if doesn't.
- 05
It wants you to approve a wall of text.
The card that blocks you is capped at 12 lines; longer is sent back before it reaches you. You approve a direction and acceptance criteria, never an implementation.
What the sandbox stops — and what it doesn't.
Every group works in its own container with its own clone. If an agent runs rm -rf, it happens to a container.
Touching your computer.
A container holds one clone of one project. Your other projects, home directory and working copy are not in there.
Seeing your real tokens.
The container holds values that are the right shape and don't work. The real token is swapped in outside, the moment the request leaves.
Pushing to your repository.
A group's credential can only fetch. Pushing happens in a separate container with no agent in it.
Your data leaving.
The network is open by default because agents need docs and packages. Fill in sandbox.denyDomains before your first run if that matters.
Roles inside one group.
A group shares one container. The boundary is between groups.
sandbox · one container · one clone