Boreal

Most agent tooling asks for trust: a prompt goes in, files change, and the evidence arrives as a summary. Boreal treats every change as a transaction instead — the run, the check, the diff and the approval stay separate, visible states.

The workbench is built on the Ariadne engine, which runs scoped tasks and records what each one was allowed to touch.

That order is enforced structurally, not by convention. A task is a contract before it is a conversation: a profile, the scope it may write, the paths it may never touch, the checks it must satisfy, and the repair attempts it gets. A profile can demand more evidence or more review; it can never grant itself an approval or widen its own scope.

The agent also never works inside the project. A run receives a copy of the workspace, hashed as it was handed over, with symlinks and junction points refused before they can be followed. The worker gets its contract and the copy — no engine state, and no route to the approval path.

Approval is its own state, reachable only through the engine's trusted channel: the confirmation is assembled from engine records in the native host window, not from the page, so a forged payload cannot change what is being approved. The records are honest about what they are — the approval itself says the identity is asserted by the caller, not verified.

When a worker reports complete, that claim is used for one thing only: deciding there is something to check. Everything else is recomputed. The validator compares the staged workspace to its baseline, enumerates what actually changed, and evaluates the task's declared checks against the bytes on disk.

That produces states that are deliberately unflattering. A workspace that moved after execution is refused rather than checked, because validating a different revision would be theatre. A complete claim that changed nothing fails its checks. A required check with no way to inspect its input is recorded as not run — never as passed.

Review sits above validation and says what it is: a recorded verdict, asserted by the reviewer and labelled as asserted rather than as a second independent check. Acceptance is a separate decision again, and it is never inferred from a pass.

The transaction record is collected from the run workspace's own fingerprints, never from a file list the worker supplies. It lists every created, modified and deleted path with the before and after it was computed from, and approval binds to a hash of exactly that content — change the bytes and the approval is stale by construction.

Applying is journaled: the entry for a path is written before that path is mutated, and each file is replaced atomically. The engine is equally clear about what it does not do — a multi-file apply is not atomic — so an interruption lands in a partial state that recovery can resolve and rollback can undo. A rollback restores the previous bytes, removes directories the change created, and, if a file changed after the apply, refuses to overwrite it: both versions are preserved under the transaction and the conflict is reported rather than smoothed away.

Chat can carry a proposal. It cannot carry a diff, a scope, an approval bound to content, and a way back. That is the surface this layer exists to be.

Boreal's live preview is a real development server, and it starts only from a preview config the project declares and a person explicitly trusts. Trust is bound to the connector and to a fingerprint of the project's build files, and a changed config makes it stale. The frame never loads that server directly: it loads a tokenized loopback address, and a request without the session token is refused before anything is forwarded. The frame itself is sandboxed with scripts only — no same-origin access back into the workbench.

Inspection is read-only by design. Clicking an element reports what the frame is rendering and where the source claims the line lives; the coordinator validates that claim against the approved project root — extension, containment, third-party directories — and returns a project-relative path and a digest, never file content. Where no mapping can be verified, the panel says exactly that instead of guessing.

Direct text and style edits take their own explicit path: the change is checked against the parsed source and the language server before it is written to the real file, with an undo ledger beside it, and the preview reloads on the next build signal or by the panel's own hand. Structural edits are not free-form — they are proposed as scoped tasks and reviewed like any other change. The canvas works the same way: drafts are revisioned, a stale save is refused rather than merged, and a saved revision can be promoted into a scoped implementation task.

The store writes atomically and keeps an append-only event log, because the interesting failures happen between steps. If the engine restarts with a run still marked running, that run becomes interrupted with an evidence record and its task returns to an authorised state — it never silently becomes a failure, and it never counts against the repair budget.

The transaction side resolves the same way. An apply that stopped halfway is reclassified by comparing every destination to the hashes it was supposed to have, and a rollback then restores the baseline byte-for-byte. A rollback that meets edits made after the apply stops, preserves both versions and says so. Drafts refuse a save built on a stale revision and keep every revision rather than merging quietly.

What recovery is not: a resumed conversation. Each run still gets a fresh workspace and a fresh agent session, and continuity between attempts is a context package built from the project's own records rather than a replayed chat.

A packaged Windows build is produced by the project's own pipeline: a frozen sidecar, a protocol-parity check that fails the build if the app calls a method the sidecar does not serve, and a packaged-runtime gate that drives the agent runtime and the typed editor without a model or a network. The build installed and ran in a disposable state root as part of its acceptance record.

The counted evidence at the last verification: 541 Python engine tests, 155 frontend tests, 20 Rust tests, plus the packaged gates re-run against the build. One live model-backed run is recorded, and it is recorded honestly — the engine blocked it when the worker never returned a complete implementation claim. A completed live model edit is not yet proven, and neither is breadth: the preview and inspector work on projects Boreal scaffolds, or on fixtures carrying the same instrumentation, and the record says arbitrary real projects are not supported yet.