Native client
Waymark Studio
SwiftUI mission control for work, Products, evidence, setup, and approvals.
Architecture
A control plane agents cannot rewrite.
Studio and the CLI ask. Waymark Engine decides. Broker performs privileged work. Core defines the safe language between them.
Headless client
waymark CLI
Scriptable commands and JSON over the same exact, versioned protocol.
Local authority · waymarkd
Waymark Engine
Owns durable state, scheduling, command admission, lifecycle, and the only writable execution surface.
Privileged boundary
Waymark Broker
Owns credentials, git, process execution, network writes, policy gates, persistence, evidence, and recovery.
Agent-facing foundation
Waymark Core
Pure models for intent, plans, scope, validation, decisions, and Tier-A-safe summaries.
With login launch enabled, Waymark Engine can keep routine governed work moving while no Studio window is open. Human decisions remain parked until an operator answers from Studio or the CLI.
Defense in depth
One boundary, reinforced four ways.
Compile-time
Core cannot reference Broker executors, credentials, UI, process APIs, or network clients.
Runtime
Agent harnesses launch inside OS-enforced sandboxes with a rebuilt, allowlisted environment.
Workspace
Managed worktrees and RepoSeatbelt place active work and recovery on separate capability paths.
Evidence
Safe durable records exclude raw prompts, code, diffs, credentials, and command output.
Data boundary
Useful history without a source-code exhaust trail.
Tier A · Durable
Safe operational facts
Identifiers, hashes, scopes, verdicts, counts, timings, policy versions, and bounded summaries.
Tier B · Local
Sensitive working material
Source, diffs, prompts, transcripts, screenshots, command output, credentials, and raw artifacts.
Design directions
Where the boundary could go next.
These are ideas I'm exploring beyond what Studio does today. They are directions, not commitments.
Headless integration
The same boundary without the desktop app: a small set of commands, MCP tools, Git hooks, and instruction templates that let any agent harness fetch a scoped view of the repository, claim a time-bound lease on a task or path set, and check policy before submitting a change.
Agent-safe shared repositories
Studio protects one developer's machine. A team needs the boundary at the shared repository: a Git-compatible server that understands leases, path scopes, and provenance, and can quarantine, check, reject, or roll back incoming changes before they reach protected branches.
More capacity, one boundary
Concurrent governed runs, and more machines contributing work to the same Lab, without creating a second operational boundary or losing the single picture of what is running and why.
Models chosen by outcome
Routing each role to a model based on availability, cost, and how well it has actually performed on similar work, with that choice recorded in the same evidence trail as everything else.
In active development
Talk with me about Waymark.
Waymark is in active development. If your organization is working out how to let AI agents do real work safely, I'd like to hear about it, whether to compare notes or to discuss Waymark itself.