The proof under the App — you can show the board.
An App is the business unit. Underneath, a distributed runtime is the trust engine: every action is policy-gated, every run is exactly-once, and every step is a durable fact you can read back.
Watch it crash — and replay to the same result.
A run streams durable facts to a journal. Kill it mid-flight and replay: committed work is re-read, not re-run, so the result digest is identical.
- +0.000sruntime.boot::journal opened
- +0.012ssandbox.create::isolated workspace
- +0.041sdeps.resolve::pinned + content-addressed
- +0.088stask.run::executing
- +0.220sdelivery.commit::exactly-once
- ✓ committed before crash: t1, t2 — skipped on replay
- ▸ re-executed: t3, t4 — only the owed work
- digest 7d22d4bd… — identical to the first run
Three guarantees under every App.
A request, never authority
An App carries a request — what you asked for — not the authority to do more. The runtime enforces your policy; the App proposes, the runtime decides.
Policy-gated by default
Every action passes a policy gate before it runs. Nothing overrides it. In-scope requests pass; anything else is refused — visibly.
Exactly once, fully traced
Each step is a durable fact in an append-only journal. Work commits exactly once; after a crash, replay re-reads committed work instead of re-running it.
What's the status of order #4172?
Order #4172 — shipped, arrives Friday.
Honest about the limits.
- Turning natural language into a finished App is an active direction we're building — today you start from a working draft you shape, not a finished product.
- v0.1.0 is an early release with known limitations; single-node by default.
- We don't overclaim: it isn't “production-ready” or “zero-failures.” It's exactly-once delivery with transparent recovery — and every run is auditable.
See it for yourself.
Read the docs, or pick the use case closest to yours.