SIGILED
The session is sigiled. The King signs; the machine executes.
- Disposable Linux workspaces, each wired to exactly one git repo
- Sessions, jobs and resident apps driven over a narrow HTTP contract — by any LLM
- Every commit pushed, every merge arbitrated on master, every actor signed
- Two-legged identity: machine credentials for drivers, device-flow approval for the human
- Open source, Rust end to end, self-hosted — it resurrects itself (almost)
The contract is the product
The driving rules are not docs about the platform — they are its API surface. The orchestrator serves its own canonical contract, at the exact sha it is running:
GET /sigiled/contract # any LLM that speaks HTTPS can start driving
Reconciliation, not locks
Sessions merge to master on close; conflicts become merge debt — a structured packet the next session must resolve before anything else. Job runs live on append-only branches: history a language model reads back, never rewritten, never merged.
Security model
Two-legged identity: OAuth2 client credentials per machine driver, device-flow approval by the human on privileged verbs. Workspace calls carry two headers — the edge validates the stack credential, then swaps in the per-session token. Secrets arrive as container env, never touch git. The workspace is sealed by construction: container filesystem plus declared mounts — no docker, no ssh, no host.
Self-host
Rust end to end, one base image, everything stack-specific is env with documented defaults:
docker pull ghcr.io/ivan-saorin/vm-base:0.1.0 # public, no credentials PUSH=1 images/build-vm-base.sh # or build your own