One loop. It opens, gates, fixes, and lands. It never stops.

Every merge gets a verdict, not a review.

Score to a band. Clear the bar and land. Fall short and get a typed gap back: the exact fix, returned to the agent. No human courier.

New primitives for the agents era.

The pull request, the review, the merge thread: built for humans reviewing humans. Agents land code in volume; that workflow buckles. cachet replaces the primitives instead of bolting automation onto them.

The agent's whole life runs through one binary.

One command opens the slice, follows it, and lands it. The exit code is the verdict, so an agent branches on it directly, with no jq-and-while pipeline to babysit.

# open from the pushed ref, stream progress, land on a clean verdict
$ git push && cachet slice open --follow
  slice_8f3 · confidence mid · waiting: ci, review:plugin · bar: high
  ✓ ci.passed                47s
  ! review:plugin        1 finding on seg_b · confidence mid→low
  → fix seg_b, git push      re-vets only the changed segment
  ✓ resolved · confidence high · clears bar · floors pass
  ✓ merge → queue → landed on main    0 humans · signed + logged

# exit code = verdict. want per-event hooks? `cachet slice watch --json` streams NDJSON.

fix is edit + git push. no patch command. pushing to the slice re-vets only the segments that changed.

Honest about what a model can and can't judge.

Bands (None, Low, Mid, High, Excellent) defined against real outcomes: reverts, incidents, hotfixes. Not a vibe.

• detDeterministic signals, no LLM. Blast radius via static call-graph, test-delta on changed lines, churn, dependency and secret scan, path criticality. Reliable and cheap.
• triA fast tier triages the easy ~80%. Description plus soft correctness judgment. Low-risk, well-tested, low-blast slices clear here. cachet runs every model; you host nothing.
• escHard cases escalate to a frontier model. High blast radius, low confidence, or core logic goes to a stronger model (or a reviewer plugin). Nothing self-certifies a high-stakes merge.
• calCalibration is load-bearing. Overconfident raw scores are re-mapped through measured revert and incident rates, so the threshold maps to real risk rather than a model's self-report.

reviews are optional. built-in or plugins (any external reviewer): zero, one, or many. they feed the confidence; they don't gate it unless you ask.

The gate is yours to program.

Define what each band requires, set your repo's review rules, write custom prompts. You review the policy once; cachet enforces it on every slice. Humans stay off unless you opt them in.

# .cachet.yml
gate: on                     # on (default) | off (plain forge, governed)
auto_merge:
  require: high              # the band a slice must reach to land

bands:                       # what it TAKES to earn each band: your definition-of-done
  high:
    requires:
      - tests_cover_changed_lines: { min: 0.8 }
      - no_new_deps_without_provenance
      - blast_radius: { max: moderate }

rubric:                      # repo rules, injected into every review
  - "DB migrations must be reversible (ship a down-migration)."
  - "No `any` in TypeScript; justify every @ts-expect-error."

prompts:
  reviewer: "Payments service. Errors are Result<T,E>, never throws."

severity: { high: cap:mid, medium: demote:1, low: annotate }
human_review: { enabled: false }   # off by default; opt in per repo/path

The gate is on by default (the opposite of most forges, where branch protection is an opt-in a human flips). A new repo is gated; a repo with no .cachet.yml runs at require: high. gate: off exists so you can adopt incrementally: start with cachet as a plain forge, add gating when you're ready. The off-switch is reflexively governed: the slice that sets gate: off is judged at the old, stricter bar before it lands. You can opt out; you can't game out.

full schema (per-path overrides, plugins, merge-queue, custom checks) in the docs.

Built for a world where the author is an untrusted program.

cachet runs humans-off by default. Unattended merge is only defensible if what replaces the reviewer is stronger than a green checkmark. This is that chain.

• →Merge-queue only. No direct merge, ever. The queue tests the combined state before landing, so a green slice that breaks main can't happen. Speculative batching, auto-bisect on failure.
• →Attested builds. CI runs in TEEs; secrets release only to an attested workload image. A poisoned runner can't read a token out of memory, so provenance alone is no longer the trust boundary.
• →Keyless-signed, tamper-evident. Every commit, score, verdict and merge is keyless-signed against cachet's own trust root and appended to a tamper-evident log. No long-lived signing key; an auto-merge is cryptographically reconstructable after the fact.
• →Non-human identity, done right. Agents hold no long-lived secret: short-TTL, sender-bound tokens, down-scoped per operation, every action traceable to a model, prompt and run.

Agents are first-class principals. No seat tax.

Your pipeline runs hundreds of agents across dozens of repos. Every tool that bolted agent support onto a human-reviewer model charges you by the seat or the contributor. cachet is built principal-first: an agent account is a real identity with its own short-TTL credential, scoped to exactly what it needs, billed per gate activity rather than per seat. A fleet of a hundred agents costs the same as one if they land the same volume.