MVP in active development

Underswell doesn't generate code. It builds software.

A local governance and evidence layer that turns your repository into a team of AI agents — governed by contracts, verified by evidence, and recoverable after any failure. Bring the coding agents you already use; Underswell decides what counts as delivered.

Get in touch See how it works
  • Runs on your infrastructure
  • Works with the agents you already use
  • Source-available
dossier · session-expiry Awaiting acceptance
Goal
Reject expired session tokens
Path
Critical · 6 roles
  • Prospective TDDRed observed before implementation · structural verified
  • Pinned observerauth/session_test.go · sha256:9c41…e07a verified
  • Mutation · Fortifierchanged code · 31 of 34 mutants killed verified
  • Independent verificationVerifier · public interface only verified
  • Dependency licensesgate not configured for this project unavailable
Candidate
a3f9c2e
Policy
rev 14
Spend
$4.18 est.

Illustrative dossier. “Unavailable” is never displayed as “passed”.

Inspectability over intelligence Vendor agents propose changes. Underswell governs acceptance. Your infrastructure. Your data.
The problem

Coding agents are powerful. Coordinating them is the hard part.

Teams adopting AI agents end up as permanent dispatchers — re-explaining context, re-running checks, and trusting an agent's prose instead of proof.

Context lost between sessions

Decisions vanish on restart, approved policies are forgotten, and pending work is lost when infrastructure fails.

Evidence you can't verify

“Tests passed” without baseline, observer, or execution provenance. Weakened or skipped tests look exactly like green ones.

Coordination by hand

Multiple agents, overlapping files, and no one owning the flow — except you, around the clock.

The answer

Development with agents you can inspect, recover, and govern.

Underswell is a governance and evidence layer over the coding agents your team already uses — not another coding agent. It turns a repository into a development team governed by contracts.

  1. 01
    Every task has an intent, an owner, and a version.Work is never anonymous and never ambiguous.
  2. 02
    Every transition requires verifiable evidence.Work advances on receipts, not on claims.
  3. 03
    Every wait has a cause and an exit condition.Blocked work explains itself and what unblocks it.
  4. 04
    Every decision keeps who authorized it.You or Helm under delegated authority — always bound to the exact candidate revision.
  5. 05
    Every restart recovers pending work.Durable handoffs and a complete event log survive crashes.
How it works

From approved intent to accepted change.

Every step is recorded, bounded, and recoverable. Decisions happen at explicit gates — taken by you, or by Helm under the authority you delegate.

  1. Connect a provider

    Use an API key through the coordinator's model proxy, or sign in with a supported coding CLI.

  2. Verify the model

    A real, bounded request proves the account can run the chosen model before it is activated for a role.

  3. Diagnose the repo

    Tools, Git state, baseline failures, and isolation are checked without modifying your checkout.

  4. Authorize scope

    Pick observe, propose, execute, or integrate, set limits, and choose which risk tiers to delegate.

  5. Define criteria

    The Analyst turns intent into falsifiable acceptance criteria.

  6. Agents execute

    Roles work in isolated workspace clones along the path the change's risk requires.

  7. Verify the candidate

    An independent Verifier checks the exact candidate through its public interface.

  8. Review the dossier

    Goal, exact diff, rationale, evidence, risks, and cost in one place — after the Verifier's verdict.

  9. Land the change

    Authorized PR or quarantined local landing, verified against the exact composed tree.

  10. Accept delivery

    Candidate approval and delivery acceptance stay separate decisions, whoever takes them.

Automated, recorded step Decision gate — you, or Helm when the tier is delegated
Helm autopilot

Delegate the decisions. Keep the authority.

You shouldn't have to be a permanent dispatcher — or a permanent approver. Helm runs the delivery loop for you and steps aside only where your judgment is required.

  • Runs the loop. Reads the approved plan, picks dependency-ready tasks, dispatches them, and keeps the critical path moving.
  • Approves on evidence. Approves candidates and accepts deliveries once the gates pass — following the Verifier's and reviewers' verdicts, never replacing them.
  • Learns your rulings. Answers agent clarifications from a versioned standing-rulings registry, and adds a ruling when the same question comes up twice.
  • Explicit, scoped, revocable. Delegation is granted per risk tier and audited; revoking it stops new Helm decisions immediately.
Delegation policy
  • Critical Escalates to you
  • Important Helm decides
  • Minor Helm decides
  • Trivial Helm decides
Always escalated, whatever the tier
migrationsauthenticationsecrets & isolation destructive host actionsunexplained failures model or runtime changesraising limitsplan or spec edits

Example policy. Tiers and the escalation list are yours to configure; Helm's parameters change only by an operator policy revision.

The Six-Pack

Six specialized roles. Separation by design.

Agents are the coding runtimes you already use, assigned to roles through adapters. Underswell governs them; it doesn't replace them — and the implementer is never the only proof.

01 · defines

Analyst

Defines behavior and falsifiable acceptance criteria.

02 · implements

Developer

Implements the minimum to pass observed red tests — or preserves the passing baseline for pure refactors.

03 · improves

Refactorer

Improves clarity while preserving behavior.

04 · reviews

Designer

Reviews dependencies and architectural properties.

05 · reinforces

Fortifier

Strengthens tests through mutation testing and technical sealing.

06 · verifies

Verifier

Independently verifies the candidate through its public interface.

Coordination agents

  • HelmPriorities, wave composition, and flow decisions.
  • BosunThe quartermaster: infrastructure, backups, and recovery.
  • SurveyorAnalyzes waits, capacity, and the critical path.
  • ChallengerHunts for defects before sealing.
  • PathfinderInvestigates problems and prepares reproductions and designs.
  • ToolwrightImproves helpers, gates, and tools outside product work.

Adaptive paths — verification depth follows risk

Critical6 roles
AnalystDeveloperRefactorerDesignerFortifierVerifier

Protected surfaces, recurring failures, or large changes.

Important4 roles
AnalystDeveloperRefactorerDesignerFortifierVerifier

Internal logic and defined contracts.

Minor3 roles
AnalystDeveloperRefactorerDesignerFortifierVerifier

Small changes on confirmed non-critical surfaces.

Trivial2 roles
AnalystDeveloperRefactorerDesignerFortifierVerifier

Editorial corrections or narrowly scoped non-critical fixes.

The highest matched risk always wins: a five-line authentication change is still critical.

Evidence

Proof is a system entity — not a sentence in a pull request.

Every claim is bound from criterion to observer to receipt to the exact code tree. When an input changes, the evidence that depended on it falls automatically.

  • Pinned observers in any language. Weakened, skipped, deleted, or tampered tests can't count as proof.
  • Honest chronology. Prospective TDD, reconstructed Red/Green, behavior preservation, and editorial evidence are labeled — never blended.
  • Report integrity. Tamper probes and flaky-result classification on identical inputs.
  • Quality gates you tune. Coverage, mutation, complexity (CRAP), and duplication (DRY) thresholds stay under your control.
CriterionA falsifiable statement of the expected behavior.
Pinned observerThe exact test, digest-pinned and canary-qualified.
Execution receiptProduced by a trusted runner — not by the agent.
Exact treeBound to the candidate revision that will land.
Integrity labelEvery gate states plainly what it proved.
verified unverified unavailable
Bring your own agents

Your agents. Your credentials. Your infrastructure.

Use the model surface you prefer and switch whenever you like. Your process state, obligations, and history stay with Underswell — not with any single vendor.

Claude Code Codex CLI GitHub Copilot CLI API keys via model proxy

Credentials outside the sandbox

API keys stay in the coordinator; signed-in CLIs live in protected identity domains. Repository tools never see them.

Isolated workspaces

Agents work in workspace clones and sandboxes. They can't touch your Git configuration, hooks, or branches.

Local data plane

Events, dossiers, and secrets live on your infrastructure. A vendor sees only what the chosen route admits.

Bounded by default

Retries, runtime, tokens, host resources, and provider exposure all have limits — with spend visible before and after dispatch.

Recovery built in

Pause, resume, cancel, and recover. PostgreSQL and a complete event log mean no lost obligations and no duplicate landings.

Effective-model attribution

Detects silent reroutes and non-activated models, and quarantines output when your policy requires it.

Clear boundaries

What Underswell is not.

Honesty about limits builds more trust than a magic demo.

  • Not a coding agent or a model. It orchestrates the agent runtimes you already use.
  • Not an IDE, CI/CD, or project tracker. It integrates with them; it doesn't replace them.
  • Not a compliance certification. Evidence supports audits; it certifies nothing.
  • Not a correctness guarantee. Evidence demonstrates the declared criteria — not every intent behind them.
Roadmap

Built in the open, one verified release at a time.

From V1.0, Underswell's own development runs on Underswell.

In development

MVP

The governed core

  • Go coordinator, Angular operator UI, and CLI on PostgreSQL
  • Six-role chain with API-key and signed-in CLI adapters
  • Repository diagnosis and observe / propose / execute / integrate modes
  • Pinned evidence, candidate verification, and delivery dossiers
Next

V1.0

Self-hosting

  • Helm autopilot and the Bosun operational agent
  • Multiple build lanes with peer reviewers
  • Per-role models with a model deny-list
  • Test-integrity, secrets, and change-size gates
Later

V1.1

Broader gates

  • Multi-project browser management
  • Wave integration and PR-linked dossiers
  • Dynamic observers: fuzzing and property tests
  • SAST, dependency and license, and architecture-rule gates
Future

V2.0

Distributed

  • Registered remote servers and isolated sessions
  • Verification workers with reconciliation
  • Operational replay without external effects
  • MCP under the same authority contracts

No dates on purpose: each release ships when its acceptance gates pass.

Source-available

Self-hosted. Yours to run.

Underswell will be published on GitHub under the Functional Source License (FSL-1.1-ALv2). Run it on your own infrastructure, read every line, and help shape it.

github.com/Underswell
  • Use, modify, and self-host it for your team.
  • Contribute — external contributions are accepted under a CLA.
  • Offer it to others as a hosted or competing commercial service.
  • Each release becomes Apache 2.0 two years after it is published.
FAQ

Questions, answered plainly.

Is Underswell another coding agent?

No. Underswell doesn't compete on model quality or IDE reach. It orchestrates the agents you already use and defines what counts as delivered software: pinned observers, an auditable dossier, independent verification roles, and durable obligations that survive vendor or session changes.

Which agents and models does it work with?

The MVP supports API keys through the coordinator's model proxy, plus signed-in Claude Code, Codex CLI, and GitHub Copilot CLI. Each model is verified with a real request before it is activated for a role. More adapters are planned, and an adapter that can't prove its isolation boundary stays unavailable.

Which programming languages are supported?

Any language, or combination of languages, that can be described with a qualified adapter declaration. The acceptance project mixes Go, TypeScript, Python, and Java to prove observer integrity is language-independent.

Where does it run, and where does my data go?

Underswell runs locally on your own Linux host, with PostgreSQL (managed by Underswell or one you already run). Events, dossiers, and secrets stay on your infrastructure; a model vendor only sees what the route you choose admits.

Do I have to approve every change myself?

No. With Helm autopilot you delegate approval and acceptance per risk tier. Helm decides once the gates and the Verifier's verdict are in, answers repeated agent questions from a standing-rulings registry, and escalates critical work and reserved decisions to you. Delegation is explicit, audited, and can be revoked at any moment.

Does it guarantee the code is correct?

No — and it says so. Evidence demonstrates the criteria you declared, and every gate is labeled verified, unverified, or unavailable. “Unavailable” is never shown as “passed”.

How is model usage paid for?

Model, API, and CLI subscriptions stay on your own provider accounts. Underswell tracks observable spend and limits per task, and shows unknown CLI spend as a best-effort estimate rather than a guaranteed ceiling.

Can I use it today?

Underswell is in active development and the MVP has not been released yet. If you'd like to follow along, pilot it, or contribute, write to hi@underswell.ai.

Building with coding agents? Let's talk.

Interested in piloting Underswell, following the MVP, or contributing? We'd like to hear how your team works with agents today.

Email us