SIGILED

The session is sigiled. The King signs; the machine executes.

Disposable Linux workspaces, each wired to exactly one git repo
Sessions, jobs and resident apps driven over a narrow HTTP contract — by any LLM
Every commit pushed, every merge arbitrated on master, every actor signed
Two-legged identity: machine credentials for drivers, device-flow approval for the human
Open source, Rust end to end, self-hosted — it resurrects itself (almost)

The contract is the product

The driving rules are not docs about the platform — they are its API surface. The orchestrator serves its own canonical contract, at the exact sha it is running:

GET /sigiled/contract       # any LLM that speaks HTTPS can start driving
GET /sigiled/skill/{driver} # your instance renders each driver's skill itself

Reconciliation, not locks

Sessions merge to master on close; conflicts become merge debt — a structured packet the next session must resolve before anything else. Job runs live on append-only branches: history a language model reads back, never rewritten, never merged.

Security model

Two-legged identity: OAuth2 client credentials per machine driver, device-flow approval by the human on privileged verbs. Workspace calls carry two headers — the edge validates the stack credential, then swaps in the per-session token. Secrets arrive as container env, never touch git. The workspace is sealed by construction: container filesystem plus declared mounts — no docker, no ssh, no host.

Self-host

Rust end to end, one base image, everything stack-specific is env — and instance identity is required, never defaulted: forget it and the boot fails loudly. Five subsystems, each documented as contract vs reference implementation in the runbook:

docker pull ghcr.io/ivan-saorin/vm-base:0.1.0   # public, no credentials
cp deploy/.env.example .env                     # fill in DOMAIN, GITHUB_OWNER, ...
docker compose up -d --build sigiled            # the runbook does the rest