pavithran/atelier

**Git keeps the code. Atelier brings the receipts.**
A Git platform for multiple coding agents, built on Cloudflare.
Atelier is a multi-agent system for software work, built on Git: a planner
splits a goal into parts, builders of several model families work them at
the same time, each in its own fork, reviewers of another family check each
change, an integrator assembles the parts, and the developer, the one person the
project belongs to, decides what merges. None of them can trample another's work or
theirs. It runs on Cloudflare Workers, Durable Objects and Artifacts, and is
driven by a dependency-free command, atelier, that any agent able to run a
shell command can use.
It is live at atelier.zone. Two pages there are
public: How it works states the rules the code
enforces and lists every command, and the showcase, at the domain's root
atelier.zone, draws Atelier's own work as it was
built by agents of several model families: each task, who held it, its
checks, reviews and decisions.
What Atelier enforces, and why
Agents sharing a repository overwrite each other's work, report checks that
never ran, and approve their own changes. Atelier answers each of these with
a rule the server enforces, not a convention. A task lives in five steps,
and each has its rule.
Claim
**One holder per task.** A task (an *item* in the API) has exactly one holder
at a time, granted atomically by the project's Durable Object when an agent
runs atelier start, so a second claimant is refused. A task changes holder only
by a recorded handoff, which revokes the old token.
Fork
**Every task its own fork.** The project's main branch is copied into an
Artifacts repository, the *baseline*. Each task works in a fork of the
baseline, its *workspace*, and its holder has the only write token for it,
so multiple agents work concurrently without touching each other's files.
Prove
**The checks run on the exact head.** atelier check runs each required
check in a clean clone of exactly the head Atelier reads from Artifacts, on
the machine that asks (an agent's or a runner's), or with --sandbox in a
Cloudflare container. Atelier records the result as *Observed* only when it
names that head, with the paths the change touches, which Atelier measures
itself. The pass or fail of a local run is the word of the machine that ran
it; a project that wants results no agent can forge is registered with
atelier init --sandbox-only, and then only container runs count. Anything
an agent says it did is *Reported*: shown, never counted. A required check
with no observed result at the current head is *Pending*. Only Observed
passes count.
Review
**Another company reviews, or in single-family mode another model.** A
change to a protected path needs approval from a model of another family than
every recorded contributor by default; in single-family mode, a different
model of the project's one company from every contributor. The
developer's approval is not that review; without one, they can accept only
by recording an override with its reason. Independence is enforced against
agents, whose tokens are bound to their own actor. The developer token can
act for anyone, a reviewer included, so the developer is trusted.
The cross-company rule above is the default policy. With
atelier init --single-family COMPANY, building and reviewing use only that
company's models: a reviewer must be a different model from every contributor,
never a contributor under another harness. This exception also applies to
criteria review, handoffs and conflict contributors. Only that company's tier
models qualify; if none qualifies, no separate tier review is requested.
atelier init --cross-family restores the default; both switches record who
made them and when. See Single-family mode.
Land
**One merge at a time, with a receipt.** The developer is the person
the project belongs to; in the API they act as a reserved actor, owner
unless the deployment names another. Work reaches the project only when the
developer accepts one exact head through the gate and it merges, one merge per
project at a time (atelier land holds the project's landing lease for the
merge), with
the task's record attached to the merge as a git note: its receipt. A goal
too large for one task is split by a planner model into parts; once the
developer approves the split, each part is claimed, forked, proven and reviewed
by a model of another family the same way, and an integrator merges it onto
the plan's own branch, which lands as one task.
**Proven. Reviewed. Recorded.** What lands has every required check observed