Who, on what evidence, allowed an agent to make this change?
Saphan is the control plane that makes that question answerable — for every change, on the record.
What it is
The workbench
Saphan Studio is where you run AI agent fleets: briefs out, evidence-bearing returns in, gate decisions from your editor. You read results, not transcripts.
The guarantee
Work passes only with evidence attached and a human decision recorded. An approval without proof is unrepresentable — by construction, not by convention.
The record
Everything above lands as plain files in your git — the operating memory of the work, built to flow into the audit tooling your organization already runs.
Saphan Studio — the workbench
Governance is the guarantee. This is the daily work.
Briefs out
Work starts as an order: a self-contained brief with scope, constraints, and a proof standard. The engine dispatches it to your agents — no context lost in a chat window.
Returns in
Agents come back with evidence-bearing returns — claims with proof attached. You read results and analyze diffs, not transcripts. The difference is a workday.
Decide in your editor
The fleet projection lives in VS Code: what is running, what awaits you, one command per decision. Gate a merge without leaving the file you were reading.
The bridge
Every project carries its bridge: orders, decisions, findings — the operating memory of the work, as plain files in your git. Studio ships it, and your codebase gets one on day one. The method has a home before the first agent runs.
And this is what the files themselves look like — not screenshots of a promise, the actual shape of the work:
+ a brief — what an agent actually receives
# ORDER — payments-refactor · wave 1 From: master · To: one executor · Stream: payments-refactor Worktree: worktrees/payments-refactor · Base: main @ 4f21c09 Protocol: saphan-protocol v1.0 · pinned in PROTOCOL_BASELINE.md ## Context — read first The payments module calls three providers (stripe, adyen, in-house ledger) directly from checkout code. Retries are ad hoc; a network blip on 06-24 double-charged three orders (postmortem PM-12). ADR-0007 (attached below) ratified one provider interface at STOP-1. This stream implements it. Nothing here asks you to design — the design decisions are made and recorded; your job is the build. ## Scope IN: a. PaymentProvider interface exactly per ADR-0007 §Decision — the Charge/Refund signatures are frozen there; do not redesign them. b. Three adapters: stripe, adyen, ledger. Existing behavior is preserved; parity proven call-for-call against recorded fixtures in tests/fixtures/providers/. c. Retries with idempotency keys (key = order_id + attempt window), stored in pending_payments — migration 0042, up AND down. d. Wire pin W-2: the public /payments API is FROZEN. Golden tests in tests/golden/payments_test.go must pass untouched — if a golden blocks you, STOP and report; never edit a golden. OUT (recorded — do not touch): checkout UI · refund flows (wave 2) · provider timeout policy (carry-forward on ADR-0007). ## Proof standard build green · full suite, counts as passed-of-total with skipped named · migration 0042 proven up+down on a schema copy, row counts pre/post · adapter parity: fixture diff empty · goldens untouched (git diff --stat on tests/golden = empty) · diff summary per file ## Stops STOP-1 already passed (ADR-0007). STOP-2: full return per template before merge. Merge is human-only, from the gate. ## If blocked Write the blocker under "Open questions" in the return, flag the stream, stop. Guessing past ambiguity is a protocol violation, not initiative.
Self-contained down to the frozen signatures: context, contracts, wire pins, a blocked-path instruction. If the agent has to guess, the brief was the defect — so nothing is left to guess.
+ a return — what comes back
# RETURN — payments-refactor · STOP-2 Executor: agent-7 · Commits: 6 (head a3f9e12) · Base: main @ 4f21c09 ## Claims, with evidence 1. PaymentProvider extracted; 3 providers behind one interface. → diff: 14 files (+612 −208) · golden tests untouched, green 2. Retries are idempotent under duplicate delivery. → TestRetryIdempotency: 200 duplicate deliveries, 1 charge 3. Migration proven both ways on a copy of the production schema. → up 1.2s / down 0.9s · row counts identical pre and post ## Open questions for the gate Provider timeout is 30s, inherited. Keep or tighten? Out of scope — flagged, untouched. ## Not done Refund flows: out of scope per order (recorded — wave 2).
Every claim travels with its proof. You read this in minutes — not a two-hour transcript.
+ an ADR — why it is like this, forever
# ADR-0007 — one PaymentProvider interface; providers are adapters Status: accepted · Date: 2026-06-30 · Actor: marcin · Gate: STOP-1 ## Context Three providers are called directly from checkout code. Each has its own retry style and error mapping; the test surface triples; adding or swapping a provider means surgery on callers. Incident 06-24: a timeout retry double-charged three orders (postmortem PM-12). ## Decision One interface, signatures frozen: Charge(ctx, Order, IdempotencyKey) → (Receipt, error) Refund(ctx, ReceiptRef, Amount) → (Refund, error) Providers become adapters behind it. Error taxonomy unified as retryable / terminal / unknown — the mapping is owned by each adapter and may not leak provider-specific errors upward. ## Consequences + one contract to test; parity provable against recorded fixtures + retries live in one place, above the adapters — idempotency enforced at a single seam, not three − adapters gain a lint rule: no provider error types cross the seam − migration 0042 required for idempotency-key storage ## Considered and passed Per-provider services — triples the test surface, scatters retry logic. Feature flags per provider — hides the seam from the record. ## Carry-forward Timeout inherited at 30s. Decide at wave 2 — trigger: refund flows.
Context with the incident that forced it, frozen signatures, consequences with their minuses, roads not taken with reasons. The brief above cites it — decisions are load-bearing, not decorative.
+ a finding — how the method learns
# Finding 4.2 — a number without a definition is not evidence Seen: a return claimed "tests: 124 passed" while 9 were skipped. The count was true and the claim was false. Rule: every number in a return carries its definition — passed of total, skipped named and justified. Applied: same cycle. All return templates updated; the gate now asks for the definition when a bare number appears.
A failure becomes a rule in the same cycle it was found. The protocol is case law, not a manifesto.
+ the sandbox — the whole machine on one screen
# The sandbox — how the pieces talk you — the operator │ briefs out · gates · reads returns ▼ editor / CLI (VS Code panel · saphan) │ ▼ saphan engine — self-hosted, one binary │ dispatch · fleet projection · refusals ▼ worktrees — one isolated sandbox per stream ├─ agent-3 payments-refactor running, wave 1 ├─ agent-7 atrisk-push stop-2 — awaiting you └─ agent-12 notification-svc merged, observed │ ▼ the bridge — plain files in your git orders · returns · ADRs · findings · gate log │ ▼ main — merge is human-only The protocol is the language every arrow speaks. The record is what every arrow leaves behind.
Agents run isolated in worktrees; the engine speaks protocol in both directions; every hop leaves a file. Nothing meaningful happens off the record.
+ the editor — the same fleet, inside VS Code
The fleet projection in your editor: pick a stream, read the evidence, gate it — without leaving the file you were in.
From the terminal
$ saphan fleet show [awaiting-human] payments-refactor · stop-2 — evidence attached → run: saphan gate payments-refactor --gate stop2 --actor you
An agent finished its work and attached the proof. Nothing merges — the engine hands you, by name, the exact decision to make.
+ the refusal — an approval attempt without full proof
$ saphan gate payments-refactor --gate stop2 --actor marcin [refused] evidence incomplete — claims without proof cannot pass nothing advanced · the gate holds · nothing was merged
The refusal is the product. A gate that cannot say no is a rubber stamp.
+ the record — what the auditor sees
$ saphan gate payments-refactor --gate stop2 --actor marcin [recorded] stop-2 approved · actor: marcin · 2026-07-14 09:12 +07 evidence: build green · 124 tests passed · diff 6 files · bundle sha256:9f2c…
Who, on what evidence, allowed it — answered in one line, forever.
+ the fleet — three agents, three states
$ saphan fleet show [running] atrisk-push · wave B in progress [awaiting-human] payments-refactor · stop-2 — evidence attached [merged] notification-service · observed on main
Many agents, one projection — and every state tells you whose move it is.
The engine never merges. It makes your decision recordable — and refusable.
Routing — the execution plane
A fifty-engineer company does not have a frontier-model budget for work a script can do. The routing rule is simple: the cheapest worker that can still meet the proof standard.
Commands before models
An iOS build, a test suite, artifact packaging — these are commands, not conversations. Under the protocol they are executors like any other: dispatched by order, returning evidence, leaving the same record. Zero tokens spent on work a toolchain does better.
Local models for the mechanical middle
Self-hosted models behind the same boundary contract take the repetitive work: pattern migrations, summaries, scaffolding. Your metal, your data, your electricity bill — not a per-token invoice.
Frontier models where they earn it
Claude, Codex, whichever you contract — reserved by policy for the work that deserves them: design, hard debugging, review. The policy is a file you write and version, not a default nobody chose.
Cost lands next to evidence
The record knows which worker served every stream — attribution is a contract field, not a guess. Spend belongs beside the proof, per stream, per gate: “what did this change cost” deserves the same one-line answer as “who approved it”.
CLI seats and API meters — one boundary
You already pay twice: engineers drive agents from CLI consoles on seat subscriptions, while pipelines burn metered tokens over the API — and the credits leak where nobody attributes them. Saphan puts both behind the same boundary: the same order in, the same evidence back, the same record — whether the executor is an interactive CLI session or a headless API call. Spend stops being a mystery split across two invoices.
The routing plane runs in our own stack today — one policy, from a local model server to frontier APIs, with CLI-driven agents working under Saphan right now. The headless/API lane is designed into the same contract; the cost surface is being finished with design partners — the attribution seam already sits in the contract.
Where this sits
Agent frameworks — LangGraph, CrewAI, in-house fleets — decide how agents work together.
AI-governance suites watch models, data, and policy from above.
Between them — where agent output becomes a change a human is accountable for — there is no incumbent. Saphan is that layer: above the frameworks, orthogonal to the suites. Swap the agent stack; the authority plane stays.
Adapters — how “above the frameworks” works
The boundary contract is small on purpose: an executor receives an order and returns evidence. Anything that can do those two things can work under Saphan.
What runs under it today
CLI-driven coding agents and deterministic commands — that is how Saphan builds itself, every day, in production. No hypothetical: the fleet that ships this product works behind this exact contract.
What the contract asks of an executor
Receive a self-contained order. Do the work in an isolated worktree. Return claims with proof. That is the whole interface — no SDK to embed, no framework rewrite: an adapter translates at the boundary and your stack stays your stack.
The adapter roadmap, honestly
LangGraph, CrewAI, Microsoft Agent Framework, A2A — the adapter surface is specified; individual adapters are built with design partners, in the order partners actually need them. We would rather ship one adapter a partner runs than four logos on a slide.
What this buys you
Agent frameworks are having a fashion moment; your governance history should not churn with them. Adopt one, swap it, run two side by side — orders, gates, and the record stay identical, because they never belonged to the framework in the first place.
Saphan Protocol
The method is not locked inside the tool. Saphan Protocol is the written discipline the engine enforces — orders, gates, evidence standards, decision records — versioned, human-readable, and hardened daily against our own fleets.
Machines execute it; auditors and engineers can simply read it. Protocol v1.0 publishes with the release.
Status
The protocol and engine are running in production on our own projects — the system built and governs itself.
Public release is staged: protocol v1.0, engine, and audit pack ship together.
We are selecting 2–3 design partners (teams of 50–500 engineers with real compliance obligations).
Design partners — the deal, plainly
The problem you already have
Agent output is outrunning your review. Pull requests pile up, review slides into theater — and now your enterprise clients and auditors ask who supervises what the agents change. “A senior looked at it” answers neither problem.
Day 30: what you hold
A pilot team working the method daily: briefs out, evidence-bearing returns in, gate decisions from the editor — and your codebase carries its bridge from day one, so the discipline has a home before the first agent runs.
The audit dividend, for free: because every change already carries evidence and a recorded decision, the security-questionnaire answer becomes a document you attach, not a paragraph you improvise.
A claim your sales team can make to your clients, with receipts: “our AI fleets run under an auditable authority layer.” You sell trust; this is trust with a record.
What it costs, worst case
One team, one repo. The founder does the deployment — first gates on your real work in week one. A single self-hosted binary: Saphan introduces no new place your code goes. One hour a week. No license fee for the entire design phase. Walk away any time and keep everything below.
If we vanished tomorrow
The record is plain files in your git — readable without our tooling, forever. The protocol publishes openly at v1.0: the discipline your team learned does not die with a vendor. The binary you self-host keeps running. This is the opposite of lock-in, by construction.
What we get — and what that buys you
Your edge cases become protocol rules (abstracted, never your internals), your friction sets the roadmap, and the Team tier — org-wide gates, shared projection, audit views — takes the shape of your organization, because you are in the room. Founding terms in writing before any public price list exists.
Design partner inquiries
Talk to the founder — hello@saphan.ai