Saphan Studio governs fleets of AI coding agents on your infrastructure, connecting their work to evidence and recorded decisions under human authority.
For engineering leads who sign off on agent output, platform teams running Claude Code, Codex, Qwen Code or local models on their own machines, and security or audit owners who must reconstruct a change afterwards.
Start alone — Solo preview, free →Bring a team — design partner →See one change, end to end →
Your fleet works in your team’s language — the record answers the auditor in English. ไทย العربية Polski
Solo · private preview
Saphan Studio for one developer, one workstation, free. Register for access to the private preview.
Core controls are implemented and used daily to build Saphan. Solo is entering private preview: registration is open now and we contact you when access is available. Roadmap work is marked wherever it appears.
Evaluating for a team? Solo is one workstation. The team path starts as a design partnership — what that involves →
What Saphan Studio holds for the enterprise
Governance → Human authority — including every bounded delegation — is signed and on the record. Silence is never consent, and refusals are data.
Security → Agents are treated as untrusted even when they are not malicious: sandboxed runs, and outbound access by named policy for every run that declares one.
Cost → Every run is quoted before it starts and booked next to the decision that approved it.
Enterprise → Control plane, record and identity stay on your infrastructure, with audit export from day one.
Controls → What is in place today, control by control — one row each: what it does, what it refuses, what the record holds.
Compliance → The evidence your existing ISMS requires — designed to map onto ISO 27001, ISO/IEC 42001, SOC 2, NIST AI RMF and the EU AI Act.
Product features
Supported runtimes → Claude Code, OpenAI Codex, Qwen Code, Factory Droid and Saphan Agent-Loop — under one control plane.
Bench → What your own hardware can actually serve — measured on your machine, not assumed from a model card.
MCP server → The record answers questions where you already chat: fleet state, gates awaiting you, spend by any axis — read-only, behind standard OAuth, with every access logged.
Discovery → A legacy system nobody fully understands, returned as an evidence-cited, signed understanding — knowing, not changing. Proven in engagements; now being re-seated on Saphan Protocol.
Docs & reports → Process documentation and delivery reports generated from the record itself — every figure traces to a signed row or a committed document.
What you get — by the job you have
Saphan does not replace your agents, your models or your Git. It puts their work behind a gate that a person decides, and keeps the evidence next to the decision.
The problem. Pull requests from agents arrive faster than anyone can read transcripts, and review turns into theatre.
In Saphan. Agents come back with claims and the proof attached — diff, test results, migration checks. A gate refuses an approval that lacks the proof the order demanded.
What you see. One screen per decision: what is claimed, what is proven, what is still owed — and one command to decide.
The problem. Every runtime brings its own sandbox habits, and nobody can say afterwards what was reachable from where.
In Saphan. Machines join by an explicit owner act. Each run is sandboxed by the operating system or refused. Claude Code, Codex, Qwen Code and local models work under the same orders, gates and record.
What you see. Per run: which sandbox held it, which directories stayed writable, what it cost, which binary ran.
The problem. “A senior looked at it” is not evidence, and a chat transcript is not a decision.
In Saphan. Every decision is a signed row: who decided, what, when, on which evidence, under which authority. A third party verifies it with the root public key alone.
What you see. The gate log and the run record, exportable as Markdown, CSV, PDF or HTML for the person who was not in the room.
Governed runtimes · working today
Saphan governs the work around the runtime: admission, isolated identity, dispatch, confinement, cost, evidence, review and the human act. Changing the model or CLI does not create a second operating system.
Tags name the platforms on which each runtime is exercised under Saphan’s confinement. The canonical table, with what is therefore not proven, is in the docs ↗
Claude Code, OpenAI Codex, Qwen Code and Factory Droid run as named, seat-isolated backends under the same streams, gates and ledger.
The built-in tool-calling loop drives local models behind OpenAI-compatible endpoints, including Ollama and vLLM, without putting a vendor CLI on the critical path.
Compilers, test runners, linters and formatters are first-class recorded actors at zero model cost — governed work, not an unobserved shell escape.
Agents and toolchains can run in digest-pinned OCI images with a read-only root, non-root user, bounded mounts and runtime limits. The exact image is probed on the exact machine before dispatch; unsupported confinement refuses before spawn.
Human approval reaches the Git forge in implementation
Saphan binds the human merge decision to the exact pull-request head, carries that authority to the forge, and learns that the merge happened by observing the repository — never by trusting a successful API response.
The gate records the human actor, decision and PR head SHA. A new push makes that authority stale instead of silently extending it to different code.
A required saphan/gate status and branch protection stop an ungated merge on the forge itself; Saphan does not rely on the UI behaving politely.
The forge creates the merge commit with Saphan’s attribution trailers. The record advances to merged only after that commit is fetched and verified.
The forge contract and its negative controls are exercised against GitHub and Gitea 1.26.4 repositories. Further forge adapters follow in the order design partners need them.
Start alone. Keep the same control plane as the fleet grows.
Solo
Local engine, web console, CLI and editor workflow without a central server. The open door into disciplined agent work, not a trial that expires.
Team
Saphan-managed identity and data-free mobile notification signalling; your fleet, code and operational record stay on your infrastructure.
saphan-oauth and identity lifecycleEnterprise
Self-hosted organizational control, machine identity, policy, confinement and evidence export for regulated delivery.
saphan-oauth or any admitted local IdPTwo ways to start
Solo · private preview
Team · design partner
Documentation · implemented state only
Saphan Docs is written against existing code and verified product behavior. It covers deployment, configuration, security, governance, audit, and operations. No roadmap claims. No promises.
Open Saphan Docs ↗Saphan Studio is where you run AI agent fleets: briefs out, evidence-bearing returns in, gate decisions from your editor. You read results, not transcripts.
Work passes only with evidence attached and an authorized decision recorded. Human approval is the default; bounded automation exists only through an explicit, human-signed delegation.
Everything above lands as plain files in your git — the operating memory of the work, built to flow into the audit tooling your organization already runs.
Not a feature list. The floor an enterprise gets today, one row per control — what it does, and what it leaves in the record for the person who was not there.
| Control | What is in place | What the record holds |
|---|---|---|
| Signed governance record | Actors, delegations, machines, seats and capabilities in one Ed25519-signed, append-only log. Every human-readable registry is a projection of it — regenerable, never a source. | The whole governance history, verifiable by a third party holding only the root public key — without trusting the machine that produced it. |
| No implicit approval | No timeout-as-consent and no ambient auto-accept. A gate requires a human decision or an explicit, bounded delegation from a human-signed policy; it has no default value and is refused out of order. The engine never grants itself authority and never performs the merge. | One gate row per decision: actor, closed-vocabulary decision, time, and the authority chain. “Merged” is never declared — only observed from a real merge commit. |
| Tamper-evident decisions | Each acceptance is a keyed, verified tuple, re-checked at merge. Edit any field afterwards and the verification breaks. | The tuple and the result of its check at merge. |
| Suggestion ≠ decision | A consultation — AI or human — is recorded as judgment; the decision is a separate act by an authorized actor. Automated authority must trace to a bounded, human-signed delegation; an override is itself recorded. | Distinct recommendation and decision rows per gate — not only what was decided, but what was recommended and by whom. |
| Machine identity by certificate | No registration endpoint, no join token. A machine is admitted by an explicit owner act with certificate binding; the control plane connects outward only, and runners hold no credential to it. | The admission act in the signed log; the certificate chain. |
| Delegated, bounded authority | Root-signed delegations with scope, work streams and a validity window. Expiry is a ceiling, never a trigger; retiring an actor takes effect immediately, regardless of any unexpired grant. | The delegation, signature over every field — who granted what to whom, until when. |
| Ratified standing law | The documents that govern how work is done are root-signed into a serial-numbered manifest. Any document verifies back to the root; an agent works under law it can be shown to have received. | The manifest, and each run’s record of which law was injected — with its hash. |
| OS-level run confinement, local | Deny-by-default write policy from the operating system’s own sandbox — Seatbelt on macOS, Bubblewrap on Linux — composed for each run before the agent starts. A missing sandbox facility refuses the run instead of degrading it. | The run record names the tool that confined it and the directories that stayed writable — a claim your team can reproduce. |
| OS-level run confinement, remote | Kernel-enforced (Landlock) confinement for SSH-dispatched runs. A machine’s confinement capability is measured before work is routed there; a machine not measured, or measured incapable, refuses the run. | The measured capability on the machine’s signed row; the run record naming what enforced. |
| Outbound access is a list | A run that declares an egress policy reaches the network only through a door that policy governs: a destination is admitted only if the policy admits both host and port, and the default admits nothing. A host that cannot be cut refuses the run rather than starting it open. Opt-in per dispatch in this release — there is no fleet-wide default yet, and we say so. | The compiled policy’s digest on the run’s row — which list governed this run. Per-connection judgements are not yet recorded; that is a stated limit of this release, not of the design. |
| No lateral agent channels | Agents coordinate only through recorded surfaces — orders, channel files in the stream’s own worktree ingested into the record, gates, an insert-only mailbox for the owner’s directives. No agent-to-agent messaging exists in the product. | “Who told whom what, when” is a query, not an interview — the coordination history of a stream, replayable from the record. |
| Refusals as data | Every refusal — engine, authorization, schema, policy — is a recorded, zero-cost row with a named class. Denial causes are logged, never returned over the wire. | The refusal ledger: the controls firing, not merely existing. |
| Monitoring — a Prometheus target | The serving daemon exposes GET /metrics in the standard Prometheus text format: runs by status and backend, refusals by class, gate decisions by gate and decision, store schema version. Label values are class names only — never stream names, paths or actor names. |
Refusals as a first-class metric — on this architecture a refusal is a security signal, not noise. Scraped by the Prometheus you already run; nothing to install. |
| Secret values stay out of records | Configuration and dispatch types carry names and references, not secret values. Key files are custody-checked before use; remote execution disables environment forwarding. Credential-owning processes may use values for authentication without copying them into the work record. | Configuration by name. No secret value in any operational record, evidence bundle, log, cost row or export. |
| OAuth 2.1 on the management surface | Bearer-gated. Team authenticates through the Saphan-operated saphan-oauth SaaS. Enterprise runs saphan-oauth locally or admits any customer IdP through a human-gated issuer trust list. Scope classes, tenant row-level slices, fail-closed by default. |
An audit-grade access log on every transport — honest status codes for wrapped refusals, no values or query strings ever logged. |
| Cost governance | Per-run quote and hard cap set before dispatch; capacity checked before the run starts; billing classes on seats. Actuals and drift land next to the evidence, not on a separate invoice. | The cost ledger, per stream and per gate — “what did this change cost” gets the same one-line answer as “who approved it”. |
| Supply-chain pinning | Agent binaries are delivered with a digest computed on the receiving machine, and identity is re-resolved where they execute. | Per run: binary digest, version, configuration hash, the standing law injected and its hash. |
| Your record store | A PostgreSQL record store on infrastructure you control, configured by name, credentials by variable name only. Code, run evidence and the operational record do not transit Saphan infrastructure. Team sends identity to Saphan-operated OAuth; Enterprise keeps identity local. Both can use mobile notification signalling carrying only an opaque gate id and badge count. | Your database, plus plain files in your git. Readable without our tooling. |
| Conformance, not assertion | End-to-end scenarios run against the real binary: gate discipline, dispatch locking, injection resistance, misrouted instructions, the OAuth flow, bearer gating, projection parity. | The conformance results, reproducible on your deployment. |
Fail-closed is the house style: an unrecognized configuration value, a missing sandbox, an ambiguous bind address — each refuses with a named class rather than falling back to a weaker posture. Where a control does not yet enforce, the documentation says so in as many words, and the roadmap names it.
How these rows map onto ISO 27001, ISO/IEC 42001, SOC 2, NIST AI RMF and the EU AI Act →
Governance is the guarantee. This is the daily work.
Work starts as an order: a self-contained brief with scope, constraints, and a proof standard. The engine dispatches it to your agents — no context lost in a chat window.
Agents come back with evidence-bearing returns — claims with proof attached. You read results and analyze diffs, not transcripts. The difference is a workday.
The fleet projection lives in VS Code: what is running, what awaits you, one command per decision. Gate a merge without leaving the file you were reading.
Every project carries its bridge: orders, decisions, findings — the operating memory of the work, as plain files in your git. Studio ships it, and your codebase gets one on day one. The method has a home before the first agent runs.
One stream, one identifier, the same figures at every step. The material below is an illustrative example, not a production record; nothing here is a screenshot of a customer system.
Work starts as a self-contained brief: what is in, what is out, and what counts as proof. If the agent has to guess, the brief was the defect.
# ORDER — payments-refactor · wave 1 Stream: payments-refactor · Base: main @ 4f21c09 · Protocol: saphan-protocol v1.0 ## Scope (IN) PaymentProvider interface per ADR-0007 · three adapters · retries with idempotency keys — migration 0042, up AND down ## Proof standard build green · full suite as passed-of-total, skipped named · migration 0042 proven up + down on a schema copy · adapter parity: fixture diff empty · goldens untouched ## Stops STOP-2: full return before merge. Merge is human-only, from the gate.
You read results, not transcripts. Every number carries its definition; a bare count is not evidence.
# RETURN — payments-refactor · STOP-2 Executor: agent-7 · Commits: 6 (head a3f9e12) · Base: main @ 4f21c09 1. PaymentProvider extracted; 3 providers behind one interface. → diff: 14 files (+612 −208) · goldens untouched 2. Retries are idempotent under duplicate delivery. → TestRetryIdempotency: 200 duplicate deliveries, 1 charge 3. Migration 0042 applied on a copy of the production schema. → up 1.2s · down: not run — see Open questions tests: 124 of 124 passed, 0 skipped · build: green
The order demanded the migration proven both ways. The return proves one. The gate cannot be talked past that.
$ saphan gate payments-refactor --gate stop-2 --actor marcin [refused] proof-standard-unmet — migration 0042: down path not proven owed: migration 0042 down · nothing advanced · the gate holds · nothing was merged
The agent supplies the missing proof on the same head. The decision is a separate act by a named human. A bounded delegation could decide a low-risk class here only under a policy a human signed; this stream has none, so the gate waited for a person.
# RETURN — payments-refactor · STOP-2 (amended, head a3f9e12) 3. Migration 0042 proven both ways on a copy of the production schema. → up 1.2s / down 0.9s · row counts identical pre and post $ saphan gate payments-refactor --gate stop-2 --actor marcin [recorded] stop-2 approved · actor: marcin · 2026-07-14 09:12 +07 evidence: build green · 124/124 tests, 0 skipped · diff 14 files (+612 −208) · migration 0042 up+down · bundle sha256:9f2c… authority: human owner · delegation: none in scope
The refusal and the approval are both rows. The signature protects the row’s integrity — these fields were not altered afterwards. It does not certify that the tests were good or the code is correct; that is what the evidence is for, and what the human read before deciding.
$ saphan gates payments-refactor refused stop-2 · actor: marcin · 09:04 +07 · proof-standard-unmet (migration 0042 down) approved stop-2 · actor: marcin · 09:12 +07 · evidence sha256:9f2c… · head a3f9e12 · authority: root merged observed on main @ 7b0e4d1 · 10:03 +07 · a human act in your Git, observed by the engine
Merging stays a human act in your own Git tooling. The record advances to merged only after the merge commit is observed on the base branch — never because an API call returned success.
The full files behind this example — the brief, the return, the ADR it cites, a finding, the sandbox and the editor view:
# ORDER — payments-refactor · wave 1 From: master · To: one executor · Stream: payments-refactor Worktree: worktrees/payments-refactor · Base: main @ 4f21c09 Protocol: saphan-protocol v1.0 · pinned in PROTOCOL_BASELINE.md ## Context — read first The payments module calls three providers (stripe, adyen, in-house ledger) directly from checkout code. Retries are ad hoc; a network blip on 06-24 double-charged three orders (postmortem PM-12). ADR-0007 (attached below) ratified one provider interface at STOP-1. This stream implements it. Nothing here asks you to design — the design decisions are made and recorded; your job is the build. ## Scope IN: a. PaymentProvider interface exactly per ADR-0007 §Decision — the Charge/Refund signatures are frozen there; do not redesign them. b. Three adapters: stripe, adyen, ledger. Existing behavior is preserved; parity proven call-for-call against recorded fixtures in tests/fixtures/providers/. c. Retries with idempotency keys (key = order_id + attempt window), stored in pending_payments — migration 0042, up AND down. d. Wire pin W-2: the public /payments API is FROZEN. Golden tests in tests/golden/payments_test.go must pass untouched — if a golden blocks you, STOP and report; never edit a golden. OUT (recorded — do not touch): checkout UI · refund flows (wave 2) · provider timeout policy (carry-forward on ADR-0007). ## Proof standard build green · full suite, counts as passed-of-total with skipped named · migration 0042 proven up+down on a schema copy, row counts pre/post · adapter parity: fixture diff empty · goldens untouched (git diff --stat on tests/golden = empty) · diff summary per file ## Stops STOP-1 already passed (ADR-0007). STOP-2: full return per template before merge. Merge is human-only, from the gate. ## If blocked Write the blocker under "Open questions" in the return, flag the stream, stop. Guessing past ambiguity is a protocol violation, not initiative.
Self-contained down to the frozen signatures: context, contracts, wire pins, a blocked-path instruction. If the agent has to guess, the brief was the defect — so nothing is left to guess.
# RETURN — payments-refactor · STOP-2 Executor: agent-7 · Commits: 6 (head a3f9e12) · Base: main @ 4f21c09 ## Claims, with evidence 1. PaymentProvider extracted; 3 providers behind one interface. → diff: 14 files (+612 −208) · golden tests untouched, green 2. Retries are idempotent under duplicate delivery. → TestRetryIdempotency: 200 duplicate deliveries, 1 charge 3. Migration proven both ways on a copy of the production schema. → up 1.2s / down 0.9s · row counts identical pre and post ## Open questions for the gate Provider timeout is 30s, inherited. Keep or tighten? Out of scope — flagged, untouched. ## Not done Refund flows: out of scope per order (recorded — wave 2).
Every claim travels with its proof. You read this in minutes — not a two-hour transcript.
# ADR-0007 — one PaymentProvider interface; providers are adapters Status: accepted · Date: 2026-06-30 · Actor: marcin · Gate: STOP-1 ## Context Three providers are called directly from checkout code. Each has its own retry style and error mapping; the test surface triples; adding or swapping a provider means surgery on callers. Incident 06-24: a timeout retry double-charged three orders (postmortem PM-12). ## Decision One interface, signatures frozen: Charge(ctx, Order, IdempotencyKey) → (Receipt, error) Refund(ctx, ReceiptRef, Amount) → (Refund, error) Providers become adapters behind it. Error taxonomy unified as retryable / terminal / unknown — the mapping is owned by each adapter and may not leak provider-specific errors upward. ## Consequences + one contract to test; parity provable against recorded fixtures + retries live in one place, above the adapters — idempotency enforced at a single seam, not three − adapters gain a lint rule: no provider error types cross the seam − migration 0042 required for idempotency-key storage ## Considered and passed Per-provider services — triples the test surface, scatters retry logic. Feature flags per provider — hides the seam from the record. ## Carry-forward Timeout inherited at 30s. Decide at wave 2 — trigger: refund flows.
Context with the incident that forced it, frozen signatures, consequences with their minuses, roads not taken with reasons. The brief above cites it — decisions are load-bearing, not decorative.
# Finding 4.2 — a number without a definition is not evidence Seen: a return claimed "tests: 124 passed" while 9 were skipped. The count was true and the claim was false. Rule: every number in a return carries its definition — passed of total, skipped named and justified. Applied: same cycle. All return templates updated; the gate now asks for the definition when a bare number appears.
A failure becomes a rule in the same cycle it was found. The protocol is case law, not a manifesto.
# The sandbox — how the pieces talk you — the operator │ briefs out · gates · reads returns ▼ editor / CLI (VS Code panel · saphan) │ ▼ saphan engine — self-hosted │ dispatch · fleet projection · refusals ▼ worktrees — one isolated sandbox per stream ├─ agent-3 payments-refactor running, wave 1 ├─ agent-7 atrisk-push stop-2 — awaiting you └─ agent-12 notification-svc merged, observed │ ▼ the bridge — plain files in your git orders · returns · ADRs · findings · gate log │ ▼ main — merge is human-only The protocol is the language every arrow speaks. The record is what every arrow leaves behind.
Agents run isolated in worktrees; the engine speaks protocol in both directions; every hop leaves a file. Nothing meaningful happens off the record.
The fleet projection in your editor: pick a stream, read the evidence, gate it — without leaving the file you were in.
Every order, return, review verdict, gate decision, cost row and merge observation is already in the record. Process documentation and delivery reports are projections of that record — generated, not written. Every figure traces to a signed row or a committed document, and a reader verifies the digest before reading.
What the train delivers and what it refuses, quoted from the order — the generator does not paraphrase a mandate. The decisions it stood on. One section per wagon: premise, proof, what it must not do, and the numbers the leg returned. How it was checked — review class, rounds, what each rejection changed, quoted from the verdict. How it landed, as a timeline of signed gate rows down to the merge commit. What it left behind, the ledger with its billing class, and the exhibits: every source document with its digest. A disclosure profile decides what a public copy withholds — host and seat names replaced by class, cost omitted — and names what it withheld.
Delivery, gates, cost, trains, flow, capacity, tests, defects, laws, compliance audit and metrics, for a period you choose: wagons merged and by whose hand, first-pass rate and rounds per wagon, quote against actual against cap with the billing class on every figure, burndown and cumulative flow per train, cycle time and where the hours went — the leg, waiting for review, waiting for the owner, the merge. Every plate names the table it reads and the figures it cannot have yet; a number without a source is not printed.
What it looks like — previews from the console:
The generator prints readings from the record and refuses to invent one: a wagon merged is not a wagon released, and the chapter says so in its own running head.
The documentation and report screens ship with the enterprise build; the console is not yet public. This page will say “shipped” when they ship, not one release before.
The human is not a clicker, and not merely another participant in the process. They own it: they set direction, define the authority delegated to the fleet, and remain accountable for the outcome. That is the name the fleet itself uses for the role — human owner.
Requirements change mid-flight. Caught at the gate, a changed requirement costs you one turned stream — not a week of swarm output in the bin. The gate is where the cheap turns happen, before the wrong direction compounds across the fleet.
“Explain this before I approve it.” The operator catches up with the system instead of signing blind — and the return’s whole job is to make that take minutes, not an afternoon. You approve with your eyes open, or you don’t approve.
“Why this way, and not the other?” is answered by documents — an ADR, the options considered and passed — not by anyone’s memory of a call made weeks ago. The reasoning is on the record before the question is asked.
Bounded delegation — never ambient autopilot
A human owner may sign a named policy that delegates explicit classes of low-risk decisions to a named automation actor. The delegation has scope, authority and provenance of its own. Outside that scope the gate still waits for a person; supplying a model as an actor does not grant it authority.
Human authority is the root. Automation can exercise only the bounded authority a person explicitly signed, and the record preserves that chain for every decision.
A fifty-engineer company does not have a frontier-model budget for work a script can do. The routing rule is simple: the cheapest worker that can still meet the proof standard.
An iOS build, a test suite, artifact packaging — these are commands, not conversations. Under the protocol they are executors like any other: dispatched by order, returning evidence, leaving the same record. Zero tokens spent on work a toolchain does better.
Self-hosted models behind the same boundary contract take the repetitive work: pattern migrations, summaries, scaffolding. Your metal, your data, your electricity bill — not a per-token invoice.
Claude Code, OpenAI Codex, Qwen Code, Factory Droid or a model behind Saphan Agent-Loop — reserved by policy for the work that deserves it: design, hard debugging, review. The policy is a file you write and version, not a default nobody chose.
The record knows which worker served every stream — attribution is a contract field, not a guess. Spend belongs beside the proof, per stream, per gate: “what did this change cost” deserves the same one-line answer as “who approved it”.
You already pay twice: engineers drive agents from CLI consoles on seat subscriptions, while pipelines burn metered tokens over the API — and the credits leak where nobody attributes them. Saphan puts both behind the same boundary: the same order in, the same evidence back, the same record — whether the executor is an interactive CLI session or a headless API call. Spend stops being a mystery split across two invoices.
The routing plane runs in our own stack today — one policy, from a local model server to frontier APIs, with CLI-driven agents working under Saphan right now. The headless/API lane is designed into the same contract; the cost surface is being finished with design partners — the attribution seam already sits in the contract.
Routing decides where a class of work belongs. Bench is how you find out what your own machine can take, so that decision rests on measurement instead of assumption. The gap between the two is not small, and it is not knowable in advance.
$ saphan-verdict [verdict] class-120b — 120.99 GiB addressable · hot + large fit co-resident → note: glm-4.5-air rejected — dominated by gpt-oss-120b on this class [critical] addressable memory is 63.3 of 125.5 GiB installed — raise the ceiling
The free step installs nothing and calls nothing. It reports GPU-addressable memory rather than installed RAM, because on the reference box those differed by half the machine — and every fit decision follows the smaller number.
Four models measured on one 128 GB node: GLM-4.5-Air, the flagship you would have picked, turned out 2.1× slower on both prompt processing and token generation than gpt-oss-120b — and 10 GiB heavier. Neither model card says so, because neither model card is about your machine.
Read the Bench brief — the measurements, and what they cost to learn →
Everything you already run keeps its job. Saphan takes over one task: the point where agent output becomes a software change someone must answer for.
Frontier APIs, and local models behind OpenAI-compatible endpoints such as Ollama and vLLM, are lanes Saphan routes to by a policy you version. Supporting many models is a routing question; it is not the same as governing a ready-made coding agent.
Claude Code, OpenAI Codex, Qwen Code, Factory Droid and Saphan’s own Agent-Loop run as dispatched, seat-isolated backends — no framework adapter, no SDK to embed. The contract is small: receive a self-contained order, work in an isolated worktree, return claims with proof.
LangGraph, CrewAI, Microsoft Agent Framework and A2A are a separate integration layer, not coding-agent runtimes. Their adapter contract is specified; individual adapters are built with design partners in the order they are actually needed, and none is presented as shipped.
Saphan never writes to your repository. It observes commits, branches and merges through a read-only boundary; merging remains a human act in your tooling. The gate reaches the forge itself — a required status and the exact pull-request head — how it works →
Admission of machines, sandboxed runs, orders out and evidence-bearing returns in, human gates with bounded delegation, and the signed record — above the frameworks, orthogonal to AI-governance suites that watch models and data from above. Swap the agent stack; the authority plane stays.
The method is not locked inside the tool. Saphan Protocol is the written discipline the engine enforces — orders, gates, evidence standards, decision records — versioned, human-readable, and hardened daily against our own fleets.
Machines execute it; auditors and engineers can simply read it. Protocol v1.0 publishes with the release.
Saphan is Thai for bridge — สะพาน. I build this in Hua Hin, Thailand, and the mark on this page is the Rama VIII bridge in Bangkok: a single pylon on one bank, holding the whole deck on cables you can count. I liked that honesty. Nothing hidden inside the structure — every line of force is visible, and you can trace exactly what holds what. That is the whole product, drawn in steel: work crosses, nothing falls silently, and you can always see what carries the load.
There is also an older reason. Every system I have run in decades of infrastructure eventually failed at the same place — not in the code, but in the crossing: the moment work moved from one side to another and nobody could later say who let it through, or why. Agents did not create that problem; they multiplied it past what human memory can absorb. So the tool is named after the thing that was always missing. Not a wall, not a gate for its own sake — a bridge that remembers every crossing.
The protocol and engine are running in production on our own projects — the system built and governs itself.
Public release is staged: protocol v1.0, engine, and audit pack ship together.
We are selecting 2–3 design partners (teams of 50–500 engineers with real compliance obligations).
The mechanism behind the record is the subject of a U.S. patent application — patent pending.
Poland — IP Partner, Warsaw. IP Partner represents Saphan in Poland: the first conversation in Polish, deployment on your own infrastructure, and a local team for organizations bringing AI agents into regulated engineering. Contact Łukasz Bederski, MBA, Founder — partner page · ippartner.pl · LinkedIn.
Representing Saphan in your market? [email protected]
Agent output is outrunning your review. Pull requests pile up, review slides into theater — and now your enterprise clients and auditors ask who supervises what the agents change. “A senior looked at it” answers neither problem.
A pilot team working the method daily: briefs out, evidence-bearing returns in, gate decisions from the editor — and your codebase carries its bridge from day one, so the discipline has a home before the first agent runs.
The audit dividend, for free: because every change already carries evidence and a recorded decision, the security-questionnaire answer becomes a document you attach, not a paragraph you improvise.
A claim your sales team can make to your clients, with receipts: “our AI fleets run under an auditable authority layer.” You sell trust; this is trust with a record.
One team, one repo. The founder does the deployment — first gates on your real work in week one. Self-hosted on infrastructure you control: Saphan introduces no new place your code goes. One hour a week. No license fee for the entire design phase. Walk away any time and keep everything below.
The record is plain files in your git — readable without our tooling, forever. The protocol publishes openly at v1.0: the discipline your team learned does not die with a vendor. The deployment you self-host keeps running. This is the opposite of lock-in, by construction.
Your edge cases become protocol rules (abstracted, never your internals), your friction sets the roadmap, and the Team tier — org-wide gates, shared projection, audit views — takes the shape of your organization, because you are in the room. Founding terms in writing before any public price list exists.
Design partner inquiries
Contact us — [email protected]