Your agents say the work is done. Who checks?
Assay runs software delivery on a fleet of AI agents, with a human in charge of what the fleet may decide. Five desks take a brief from intake to a verified merge — segregation of duties end to end: the desk that verifies a change is never the desk that wrote it, and the record lands in a register that's append-only and tamper-visible. You get pulled in for the merge, the risk gates, and anything the tooling refuses to decide.
Run it on one repo/plugin marketplace add medici-finance/assay
/plugin install assay@assay
/assay:install
Apache 2.0. One binary in CI, one reviewer identity, draft PRs only. The install and Apps pages carry the setup cost in full.
Dials read live from metrics.assay.guide, the same snapshot how it runs explains. A reading the probe could not take says could-not-check; it is never shown as zero.
What runs without you, and what never does
Between gates the pipeline runs unattended. The list of decisions the tooling refuses to take is short, and it is published: here, and in the adoption runbook the tools are installed from.
Runs without you
- Intake desk
Reads every inbound issue and idea and files it into one of five tracked exits. Untrusted content is data, never instructions.
unattended · trust gate applied before queueing - Worker desk
Keeps a pool of workers full. Each takes one brief in its own checkout and comes back with a draft pull request. Never a push to main.
unattended · draft PRs only, by construction - Review desk
Reviews every PR for correctness and, on risk paths, security, posting as an identity the author cannot post as. After a repo's first ready flip, which is a person's, it flips a PR ready when the verdict is at the current head.
unattended · non-author verdict asserted in code - Verify desk
After the merge, a non-implementer re-runs the brief's Verify table on main and records the evidence. Implementers stop at implemented.
unattended · runner identity derived, never passed - The desk
Coordinates across streams, authors briefs, and files anything that needs a person as an issue. It never narrates to a console.
unattended · silent by contract
Never without you
- Merge to main
Agents open draft pull requests. The merge, the push to main, and a repo's first ready flip are a person's. Release is not in the pipeline yet; when you cut a tag, that is yours too.
the merge gate · no verb in the toolkit can do it - Who the tooling obeys
The trust roster names the human whose word authorises, the trusted logins, the allowed repos. Writing the file is automatic; choosing the names is not.
held outside every ref · a PR cannot widen its own gate - Risk-gated briefs
A brief marked gate: human closes only on a review entry naming a person. An irreversible change is never closed by a model runner.
verified → done needs a human token, dated - Identities and permissions
Creating the reviewer App, granting repo admin, provisioning private CI credentials, rewriting git history for a carve-out.
irreversible public acts - The stop
A kill switch a person sets stops every loop at its next boundary. No loop clears it; the flags are not self-clearing.
DISABLED · STOP · STOP.<loop>, in a file the tools only read
The sheet, deployed
Waves as rows, briefs as cells, state as a mark. This is the public methodology repo's own board, read from its stream files; the house's private boards are not published. The full roadmap carries every stream.
reading the sheet
The precise claim
Assay doesn't certify that agent output is correct. It certifies who verified it, how, and when — narrow on purpose: it's the claim that survives an audit.
- The pipeline runs from intake to verified on main. Release, deploy, and rollback are not in it yet.
- The board is derived from agent-authored artifacts with consistency linting, not measured from ground truth.
- Assay does not make agents trustworthy. It makes drift, missing evidence, and register tampering machine-visible.
- Approval is posted by a separate identity the author cannot post as. That is a claim about attribution, and it is true; it is not a claim that a review was thorough.
- Every number on this page is either read from the live snapshot or labelled synthetic. A reading the probe could not take says so.
Verified by someone who didn't build it
The stamp is the proof. An assayer tests the metal, not the stamp.
What assay does not claim
- Not a replacement for your SDLC, QA, security review, or your auditors — a control layer inside the regime you already run.
- Not a certification, a seal, or a regulatory safe harbor. It produces evidence; your assessors weigh it.
- Not tamper-proof. Tamper-visible, contingent on your branch protection and required checks staying enforced.
- Not a guarantee that agents write correct code. Verification exists precisely because they sometimes don't.
Where to go
Running a fleet already: start with the desk roles, then install on one repo. Evaluating for an organisation: the committee route stages the proof as audit exhibits. Solo, one repo: Solo mode is a named, completable path.