SYBERLABS
SyberLabs / The factory
The autonomous software factory.
Agents write, test and repair code on their own. SyberWork, the factory floor, runs every check itself, keeps a signed record of each step, and lets nothing reach your branch until a person admits it.
One change, step by step
A Build Thread is one governed change to one repository. Each step writes to the record, and each has a line it never crosses.
- 01
Start
Pins the base commit, the contract version and the paths the change may touch.
Never moves a branch or touches your working tree.
- 02
Context
Chooses the excerpts an agent will read from path and symbol matches, and records why each one was chosen. No embeddings.
Never stores the excerpt text; it is re-read from Git when an agent runs.
- 03
Propose
Model adapters write candidates as Git commits on side refs. The default repair loop sends the host’s own check results back to the model until a candidate passes or the budget runs out; an evolutionary search is the alternative. On the factory’s own benchmark fixtures, repair solved more tasks per dollar, so it is the default.
Never edits your working tree. A model saying its tests pass is shown as unverified and changes nothing.
- 04
Check
The host runs the contract’s checks on the candidate’s exact tree, in a fresh worktree with a scrubbed environment, and records each result’s state, exit code and output digest. An independent critic reviews the change; the critic can never be the candidate’s own author, and a high finding blocks acceptance.
Never counts a provider’s claim as a result.
- 05
Admit
Twenty-one ordered admission rules decide, the first to answer wins, and agents and people face the same rules. A person accepts the candidate, or a second person with the right role approves it first.
The only write is a compare-and-swap of the thread’s own branch: no push, no merge, no change to main.
- 06
Publish
Pushing the branch, opening a pull request and publishing a package are separate actions, each admitted, each recorded, each safe to retry and reconcile.
Accepting never publishes on its own.
What the record guarantees
- Observed by the host
- Check results are processes the host started on a tree it wrote, not reports from an agent.
- Chained and signed
- Every event joins a hash chain. A separate witness process holds the key that signs the chain head and appends to a transparency log.
- Budgeted
- A contract can price each model. The host measures the spend, stops a search at its dollar limit, and refuses to admit a change the thread could not afford.
- Measured
- Each work item reports its cost, turns, agent time, fix rounds, lookups, review rejections and human interventions, each traced to the events it came from.
Built by its own factory
SyberWork’s own pull requests run through a Build Thread before they merge. The receiving repository checks out the change, proposes it as a candidate, runs its tests and conformance on the exact tree, and admits it under the same rules. Each pull request carries the trail: who admitted it, the rules review, and the host’s checks.
The GitHits client and its Claude Code wiring were made this way.
Where the claims stop
- Checks run in a temporary worktree with a scrubbed environment. That is not a sandbox, so untrusted agent code runs as a separate command.
- An admitted change is tested: the named checks passed on that tree. It is not proof that the change is right, wanted, measured or deployed.
- The hash chain is integrity evidence inside its database’s trust boundary, not a public transparency service.
- Browser verification of documentation with Attest and Kane is designed, not built.