The system

Two drawings the kit’s own generator makes from its configuration, and the label sewn into every box. Your copy draws yours.

Drawn from the config

A card's journey from spec to live A spec card written by Claude and reviewed by Codex is claimed by the tick, built in a box with one key and an egress proxy, re-tested in a box with neither, and reviewed by another engine on the exact diff; then either your go sends it through Claude's session, which runs acceptance in two offline boxes and fast-forwards the exact merge, or your pre-approval sends it to the merge pass, which checks the bound reviews and receipt, has Opus read the diff in a box, and hands the prepared merge back to your session until you enable installs for a sub-system; after an install the pass watches the next tick and health check and rolls back or reverts. YOUyour keys ON THE HOSTas your user IN BOXESrootless podman LIVEthe checkout CLAIM VERDICTS GO PRE-APPROVED FAST-FORWARD JUDGE INSTALL PREPARED HEALTH ROLL BACK Today the pass only prepares. Installs turn on per sub-system with merge_pass: true, outside the trust root only. Two rollbacks or reverts in 7 days turn installs off until kill-ack. CARDSpec cardClaude, then Codex BOXBuild + verifybuild, then re-test BOXReviewother engine family KEYYour gatego, or pre-approve MINDClaude sessionaccept, fast-forward HANDSMerge passpre-approved cards BOXJudge + acceptOpus read, 2 boxes LIVELive checkoutexact merge, ff only HANDSWatchnext tick + health KEYRuns in a podman boxYour keyLive today, colored by who actsBuilt, switched off
A card's journey from spec to live, as the kit's own generator draws it from the running configuration, in this page's inks: ochre for you and your keys, olive for Hermes, slate for the workshop, black for the mind, crimson for a sealed box. The same generator draws your copy.

The whole workshop

The dev loop: system map You decide and hold the keys; Claude Code writes spec cards onto the shared board; devvm-box and the merge pass, woken by Hermes cron, claim cards and run every model inside podman boxes that reach only their own API through a per-box proxy; a reviewed merge reaches a live checkout only by fast-forward, into any part on your go through Claude's session, and only into docs and tests through the merge pass once you enable it; health comes back through Hermes cron and reaches your phone through Telegram, which also carries the scheduled updates, and the checkouts are pushed to GitLab and backed up to a second machine. ON THE VM · AS YOUR USER · THE CONTROL PLANE PODMAN BOXES LIVE CHECKOUTS · FAST-FORWARD ONLY OFF THE VM YOUYou MINDClaude Code BODYHermes The record HANDSWorkshopCRON BOXModel box BOXOffline box REPOfedora-devvmthis loop · criticality low your repoREPOyour repocriticality high second repoREPOsecond repocriticality low Outside the loop 1DECIDE PHONE 7BRIEF RELAY 2SPEC 3CLAIM 4RUN API ONLY HOST · LAN 5INSTALL YOUR GO DOCS + TESTS PRE-APPROVED 6HEALTH PUSH BACKUP terminal the keys phone Opusspec, review, merge Codex2nd view on specs gatewayTelegram topics cronwakes tick + pass Luna · Flashrun as your user boardkanban cards ledgerattempts/reviewsreceipts, merges git refsbuild/merge refs loop board127.0.0.1:8790 evidencelogs, off-files devvm-boxtick: 1 card / 15 min merge-passeach hour, pre-approved enginebuild, review, judge credentialone per box egress proxy443 to its allowlist verify · acceptexit status only no networkno credential model APIsallowlist only Telegrambrief, alerts second machineRestic repo GitLabprivate remote docs · testspass may install trust roota person installs you mergethe pass stays out you merge other crons alerts personal tools KEYYou · your keysClaude · mindHermes · bodyWorkshop · handsThe recordLive checkoutOff the VMBox boundaryA person installs hereYour keyWoken by Hermes cron1Reading orderLive today, colored by who actsBuilt, switched off · plannedRefused at the boundary
The workshop built itself: all 12 of the last 12 receipts are cards the loop built for its own kit.The system map: zones say where a thing runs, the ink says who acts, ochre for you, olive for Hermes, slate for the workshop, black for the mind and the record, grey for the outside, crimson for a sealed box, and a hatched compartment is one only a person installs into. Template names stand where your repositories go; the generator fills in yours.
  • HermesThe agent runtime: the board, the cron, the Telegram gateway and the profiles.Wired in. Telegram is its only gateway.
  • SurplusThe model marketplace behind Hermes and the workshop’s marketplace builds.Your choice of models; the marketplace itself is wired in.
  • Claude CodeRuns Claude and Surplus builds, the Claude reviews, and the host.Wired in.
  • CodexRuns Codex builds and the Codex reviews.Per card: any card can go to another engine.
  • podmanThe sealed boxes and the workshop secrets.Wired in. Docker is not supported.

What the box refuses

Every card is built inside a podman box with this label sewn in. The flags are the runner’s own.

What a merge must pass

  • Admission: every new commit is scanned, its files, file names and message, for credential shapes and for the keys loaded on the host; a hit blocks the card.
  • Review: M, L and secure cards get a second family’s review of the exact diff; the merge pass installs only on that verdict, and a changed diff voids it. A Size S card waits for your own read.
  • Acceptance: base and merge each run the suite in a box with no network.
  • Install: fast-forward only, and the receipt is numbered.
  • Dependencies: a sub-system’s box image carries its locked dependencies; a card that changes a lockfile stops until you rebuild that image.

What watches the loop

  • Spend: a governor every five minutes; a budget failure blocks the lane until midnight UTC.
  • Limits: when a provider says its usage limit is reached, that engine pauses for 30 minutes and the card goes back in the queue, uncounted.
  • Pulse: a deadman timer alerts your chat if the cron stops.
  • Privacy: your names, hosts and chats live in a private overlay, never in the kit.

The box

Network
None. The build reaches one proxy socket that admits only its engine’s API host, and a box without its proxy does not start. Acceptance runs with no network at all.
Root
Read-only.--read-only
Capabilities
All dropped.--cap-drop=ALL
Privileges
None gained.--security-opt=no-new-privileges
Processes
512 at most.--pids-limit=512
Memory
6 GB.--memory=6g
CPUs
Two.--cpus=2
Secrets
One, the engine’s own: a podman secret for Claude and Surplus, the Codex login passed in beside the bundle. Nothing else from the host.
Repository
Arrives as a git bundle on stdin, with no repository mount.
Scratch
2 GB in memory, gone when the box exits.--tmpfs /work