One environment from the editor to the observation window.
Astvyr is split into clients, a control plane, AI orchestration, an execution plane and a data plane. Each boundary is a deliberate trust boundary, not an accident of growth.
Five planes, one authority model.
The model proposes. Authoritative services decide state, permissions, budgets and release gates.
Desktop, Web, CLI, Mobile, SDK — human interaction, local workspace, explicit consent and review.
Mission, policy, scheduler, identity, verification, release, audit, metering.
Context, model gateway, agent profiles, prompt registry, evaluations.
Runners, sandboxes, Production Twins, artifact and build services.
Transactional, graph, object, event, cache, analytics and search stores.
Ten rules the architecture is not allowed to break.
Cell-based global architecture
A tenant belongs to a home region and cell. The failure of one cell is not a global outage.
Control and execution are separated
Code and commands can run inside the customer boundary; the cloud manages metadata and policy.
Deterministic authority
The model proposes. Authoritative services decide state, permissions, budgets and release gates.
Event-driven long workflows
Missions and releases survive disconnects, retries and restarts without doing anything twice.
Immutable artifacts
Builds, evidence and release candidates are identified by hashes and signatures, not mutable tags.
Least privilege everywhere
Short-lived rights, brokered secrets, no standing access.
Observability by construction
Every request, job, tool call and release carries a trace and an auditable outcome.
Portability at boundaries
OCI, OpenTelemetry, standard identity, documented APIs and export formats.
Graceful degradation
A failing model, provider or marketplace does not break editing, source control or emergency operations.
Security before autonomy
Autonomy grows only after measured evaluations and bounded action paths.
Fourteen services hold the authoritative state.
The scheduler owns durable timers, retries, dependencies and leases — and no model authority at all.
Edge and API gateway
Global routing, protection, rate limits, protocol termination.
Tenant directory
Home region, entitlements, identity federation.
Identity and authorisation
Regional cache over authoritative policy data.
Mission service
Transactional state with an event-sourced history.
Workflow scheduler
Durable timers, retries, dependencies and leases. No model authority.
Policy service
Immutable policy versions and signed decisions.
Model gateway
Routing, redaction, quotas, metering and fallback, with minimised content retention.
Context service
Index registry, retrieval, snapshots and the knowledge graph, region-scoped.
Verification service
Plans, checks, findings, evidence and sealing.
Runner and Twin manager
Capacity, placement, leases and cleanup.
Release service
High-consistency release state.
Audit service
Append-only, tamper-evident regional log with export.
Marketplace
Global metadata with regional delivery.
Billing and metering
A financial-grade ledger.
- Idempotency keys, fencing tokens and recorded desired state.
- Lease and heartbeat: a worker that lost its lease cannot continue a privileged action.
- Outbox and inbox patterns between transactions and the event bus.
- Compensation is not universal rollback: irreversible operations need a human-approved recovery plan.
- Model outputs are stored as inputs and results, so a Mission can be replayed deterministically.
Sandboxes, runners and Twins that never share a trust domain.
A runner that lost its lease cannot continue a privileged action, and untrusted output never becomes an executable cache for another tenant.
ISOLATION BY RISK CLASS
- LOWContainer with a hardened runtime, default deny, approved package mirrors, no production credentials.
- MEDIUMgVisor or Kata-class sandbox, egress proxy with a domain allowlist, task-scoped short-lived tokens.
- HIGHMicroVM or a dedicated node, private network segment, JIT credential through the broker with re-authentication.
- UNTRUSTEDDisposable MicroVM for marketplace and unknown repositories: no shared cache secrets, no egress until policy grants it, no customer secrets by default.
- AIR-GAPPEDCustomer-managed isolated runner, no external network, local HSM or vault.
RUNNER PROPERTIES
- Ephemeral by default, with no cross-Mission persistent filesystem beyond a content-addressed trusted cache.
- Read-only base image, non-root, seccomp, AppArmor or SELinux equivalents and kernel hardening.
- Per-job quotas on CPU, memory, disk, processes, time and network, with fork-bomb and crypto-mining detection.
- Artifacts and logs are redacted before upload.
- Build caches are partitioned by trust domain: output of untrusted code never becomes an executable cache for another tenant.
- Every runner publishes an attestation: software version, image digest, policy and isolation class.
SANDBOX LIFECYCLE
REQUESTED → POLICY_EVALUATED → PLACED → PROVISIONING → READY → LEASED → RUNNING → DRAINING → SNAPSHOTTING → DESTROYING → DESTROYED
An orphan scanner runs independently of the main scheduler, so a leaked environment does not survive a control-plane restart.
SCHEDULING
- Placement respects region, data residency, isolation class, architecture, accelerator, capacity and the customer boundary.
- Weighted fair queuing by plan and tenant, with reserved capacity for emergency workflows.
- Warm pools are prepared from images that contain no tenant data.
- Backpressure and admission control refuse work before overload instead of degrading.
- Spot, committed and on-demand capacity are mixed, with checkpoint and resume or a clean retry from immutable input.
Local-first interaction, cloud-scale execution.
Editing, source control, search, terminal and debugging keep working when the cloud is unavailable.
Editor shell
The interface process. It does not hold cloud secrets.
Extension host
A separate process with a permission broker for sensitive APIs.
Local agent daemon
Signed background service for indexing, context, tool mediation and local models, inside an OS sandbox.
Workspace service
Files, search, snapshots, checkpoints and multi-repo support with least-privilege filesystem scope.
Terminal and task service
PTY, tasks and builds with policy hooks and process-tree control.
Browser and preview
An isolated profile with domain policy and no silent credential reuse.
Credential broker
OS keychain, device identity and short-lived cloud tokens.
Telemetry client
Minimisation, redaction and per-tenant controls.
Updater
Signed staged updates with rollback and key rotation.
- Editing, source control, search, terminal, debugging and saved local context keep working when the cloud is unavailable.
- Local checkpoints live in content-addressed storage with quotas.
- Indexing is incremental and resource-aware: it never blocks the editor thread.
- One corrupted index never damages the repository.
Windows x64 / ARM64 · macOS Intel / Apple Silicon · Linux x64 / ARM64
- StableStaged rollout, minimum soak, rollback, signed provenance.
- Early accessNot offered before release. After release: opt-in, a separate telemetry and evaluation cohort, a clear downgrade path.
- InsiderDaily builds with no production guarantee.
- Enterprise LTSLong support, security backports, an admin-controlled upgrade window.
- Air-gappedOffline signed bundles, checksums, chain verification and a rollback package.
Four model tiers behind one policy-controlled gateway.
The model layer stays replaceable. No critical path depends on a single provider.
External frontier models
Several leading providers for complex reasoning and coding, where quality justifies cost and policy permits.
Optimised specialist models
Smaller, faster models for review, routing, extraction and other high-volume subtasks.
Customer and private models
Enterprise endpoints or on-premise models for sovereignty, custom domains and offline work.
Astvyr models
Fine-tuned and reranked models only where proprietary outcome data gives an advantage: routing, verification, risk, context.
GATEWAY PIPELINE
- 01Classify task, data and risk
- 02Evaluate effective policy
- 03Redact and minimise
- 04Select the route
- 05Enforce context and tool budget
- 06Stream the response
- 07Validate the schema
- 08Record usage and outcome
RULES
- Fallback is allowed only inside the same or a stricter data and security class; a high-risk route can fail closed.
- Rate limiting, spend guardrails, abuse controls and provider health checks act before the request is sent.
- No silent model substitution: the route is always visible.
- A degraded route is removed from production automatically until it is reviewed.
- Astvyr does not begin by training a frontier foundation model. The moat is verified delivery, outcome data, orchestration and trust.
Who owns what, and for how long.
Secrets are not a business entity. Only a reference is stored; the value is brokered as a short-lived credential.
| Data class | Owner | Handling |
|---|---|---|
| Customer content | Customer | Code, prompts, documents, logs, snapshots. Region-scoped, encrypted, never used for training, configurable retention. |
| Operational metadata | Contract-defined | Identifiers, timings, sizes, status, cost. Minimised and retained for service, security and accounting. |
| Evidence | Customer | Test logs, screenshots, attestations. Policy retention, immutability and export. |
| Audit | Customer and provider | Access, admin, policy and deployment events. Longer retention, tamper-evident, restricted access. |
| Aggregated analytics | Contract-defined | De-identified performance and outcome statistics with thresholded aggregation that cannot reconstruct customer content. |
| Marketplace data | Publisher and platform | Package metadata, reviews and publisher information with public or private scope. |
- Secrets are not a business entity. Only a secret reference is stored; the value is brokered as a short-lived credential for one permitted action.
- The secret value never reaches a prompt, a log or an evidence bundle.
- Raw production data is not copied by default: Twins use synthetic or sanitised snapshots.
- Deletion and reindexing follow the retention SLO.
A live graph of entities, edges and memory.
The graph updates from git events, build metadata and telemetry — not by a full reindex each time.
Entities
Files, symbols, tests, packages, services, APIs, databases, queues, owners and environments become graph entities.
Edges
Edges capture calls, imports, data flow, deployment relation, ownership, incident and evidence.
Node attributes
Every node stores freshness, source, access policy and confidence.
Impact analysis
Which services, tests, customers and SLOs may be affected.
Incremental updates
The graph updates from git events, build metadata and telemetry, not by a full reindex each time.
MEMORY MODEL
Ephemeral session
Retention: minutes to hours. Working hypotheses and transient tool outputs.
Mission memory
Retention: the Mission lifetime plus policy. Plan, decisions, failures and evidence.
Repository memory
Retention: until the source changes or retention applies. Architecture and symbol summaries.
Organization knowledge
Retention: controlled long-term. Standards, patterns, ownership and incident lessons.
Outcome learning
Retention: long-term aggregated. What checks predicted success and where a false green occurred.
Five ways to run it, from shared to air-gapped.
Shared
Regional shared services with shared, isolated MicroVM pools.
Isolated pool
Shared services with a dedicated node or cluster pool and network.
Dedicated cell
Dedicated regional application and data services plus a dedicated execution plane.
Customer VPC
Astvyr metadata in SaaS; runners and Twins inside the customer account.
Self-hosted
Customer-operated, including sovereign and air-gapped deployments.
What every release is actually connected to.
Each link is directional and typed — defined_by, verified_by, seals, deploys, results_in and the rest.
Mission → Objective / AcceptanceCriterion
defined_by
Mission → ContextSnapshot / AgentProfile / ToolDefinition
uses
PlanStep → ChangeSet / Artifact / Decision
produces
AcceptanceCriterion → Check / EvidenceItem
verified_by
EvidenceBundle → ChangeSet / Artifact / Config / PolicyVersion
seals
Release → EvidenceBundle-backed candidate
deploys
Deployment → TelemetryLink / VerificationRun
observed_by
Deployment → Outcome / Incident
results_in
Incident → Criterion / Check / Policy / Context
reveals_gap_in
CorrectiveAction → Template / Eval / Runbook / Standard
updates
The outcome link is the part that compounds.
Connecting intent to a production outcome is what makes routing, risk prediction and test selection better over time — under a standing rule about whose data it is.
Outcome-linked learning
The privacy-safe link between intent, change, verification and production outcome is what improves model routing, risk prediction, test selection and evaluations.
No training on your code
Customer code is never used to train general models without a separate, explicit opt-in, and aggregated operational signals are de-identified before they are used.
Astvyr orchestrates the controls you already have.
It never bypasses an existing approval silently. Depth of integration beats copying features.
SOURCE CONTROL
GitHub, GitLab, Bitbucket
ISSUES AND KNOWLEDGE
Jira, Linear, Azure Boards, Confluence, Notion
CI/CD
GitHub Actions, GitLab CI, Jenkins, CircleCI, Buildkite, Azure Pipelines
PROGRESSIVE DELIVERY
Argo CD, Argo Rollouts, Flux, Harness, Spinnaker
CLOUD
AWS, Azure, Google Cloud
KUBERNETES
EKS, AKS, GKE, OpenShift, self-managed
INFRASTRUCTURE AS CODE
Terraform, OpenTofu, Pulumi, Ansible
OBSERVABILITY
OpenTelemetry, Datadog, Grafana, New Relic, Sentry, Elastic
SECURITY
SAST, SCA, container and IaC scanners, SIEM, secrets managers
COMMUNICATION
Slack, Microsoft Teams, email, PagerDuty, ServiceNow
FEATURE FLAGS
LaunchDarkly and compatible providers
IDENTITY
Okta, Microsoft Entra ID, Google Workspace, SAML, OIDC, SCIM
BILLING
Stripe and enterprise invoicing and tax providers
CERTIFICATION LEVELS
Where the platform shows up.
Astvyr Desktop
The primary IDE: local workspace, coding, missions, review.
Astvyr Web
Missions, dashboards, reviews, admin, incidents.
Astvyr CLI
Headless missions, CI, scripts, remote runner control.
Astvyr Mobile
Approvals, incident alerts, release control — a companion, not an editor.
Astvyr Agent Cloud
Model routing, orchestration, long-running agents.
Astvyr Verification
Independent checks, evidence bundles, evaluations.
Astvyr Production Twin
Ephemeral production-like environments.
Astvyr DevOps Control Plane
Delivery, canary, metrics, rollback.
Astvyr Enterprise
Identity, policy, audit, residency, support.
Astvyr Marketplace
Agents, skills, connectors, templates.
- Own universal cloud provider — Astvyr orchestrates, it does not have to own the customer's infrastructure.
- Own foundation model as a mandatory condition — the model layer stays replaceable.
- Full replacement of GitHub, GitLab or Jira in the early stages — depth of integration beats copying features.
- A legal guarantee of error-free code — the product provides evidence, controls and risk reduction.
Six ways to work, from advice to autonomy.
The mode sets how much authority the agent holds. Every mode still routes through the same approval and evidence path.
Assist
AI advises; the human applies the changes. For unfamiliar repositories, learning and high-control work.
Collaborate
AI proposes a multi-file diff and commands with confirmation. For everyday development.
Delegate
A Mission runs locally or in the cloud with checkpoints. For features, bugs, tests and migrations.
Autonomous within policy
The agent performs the permitted actions and opens a pull request or release proposal. For repeatable low and medium risk workflows.
Incident mode
Diagnostics, containment, rollback and fix take priority. For production incidents.
Offline / private
Local models and customer-hosted tools only. For air-gapped or restricted environments.
WORKSPACE TRUST
The first opening of a repository classifies the workspace as untrusted. Trust is granted locally, by the organisation or through a signed policy bundle — and four capabilities stay blocked until it is.
Untrusted
The first opening of a repository classifies the workspace as untrusted.
Local trust
Trust granted on this device for this workspace.
Organisational trust
Trust granted by the organisation for its repositories.
Signed policy bundle
Trust granted through a signed policy bundle.
Automatic script execution
Not permitted until trust is granted.
Extension activation with high permissions
Not permitted until trust is granted.
Network tools
Not permitted until trust is granted.
Disclosure of secrets
Not permitted until trust is granted.
Eight zones that hold one Mission together.
The same zones answer where the work is, what it will do, what it costs and what proves it happened.
Workspace Explorer
Files, symbols, services, repositories and environments.
Mission Center
Active, queued, blocked, awaiting approval and completed Missions.
Intent Composer
Stating a task in text or by voice, from an issue or from an incident.
Plan & Contract
The plan, acceptance criteria, risks, budgets, proposed tools and approvals.
Agent Timeline
Agent actions in real time, with pause, intervention and replay.
Evidence Panel
Tests, scans, screenshots, traces, metrics, provenance and unresolved risks.
Production Lens
Health, recent deployments, incidents and ownership for the selected code or service.
Cost & Privacy Indicator
Model provider, data boundary, token and compute estimate, and retention mode.
MANDATORY UX PROPERTIES
Reviewable agent changes
Every agent change appears as a reviewable diff with its author, the reason and the linked criterion.
Checkpoint undo
Undo and restore work from a checkpoint, not only from textual history.
Local work continues
Ordinary development continues while Agent Cloud is unavailable.
No collapsed status
Failed, skipped, unknown and stale checks are not hidden under a single green status.
Distinct dangerous actions
Dangerous actions look different from ordinary editing and require clear consent.
One identity graph, whichever surface you are on.
Mission state synchronises across desktop, web, CLI and mobile in near real time.
SURFACE SYNCHRONISATION
- One identity and session graph, with a device inventory and remote revoke.
- Mission state synchronises across desktop, web, CLI and mobile in near real time.
- Sensitive evidence can be limited to devices with a managed posture.
- Deep links open a specific criterion, finding, diff, trace or deployment stage.
MOBILE APPROVALS
- A human-readable statement of impact.
- An evidence summary.
- A rollback alternative.
Mobile is not a place to write large changes. It is for safe approvals, incident notification, release observation, emergency stop and communication.
WEB CONSOLE SCOPE
The Web Console serves asynchronous work and organisation management. It does not have to copy the desktop editor, but it allows code to be explored, changes to be reviewed, Missions to be run, approvals to be taken and delivery to be managed.
Cross-repository Mission dashboard and queue.
Diff review, threaded comments, evidence drill-down and approval workflows.
Organisation, projects, environments, policies, integrations, budgets and billing.
Release cockpit with rollout stages, metric gates, incidents and rollback controls.
Fleet management for runners, sandboxes, regions and dedicated cells.
Executive analytics: adoption, verified outcomes, risk, cost and delivery metrics.
Six principles, one conformance bar.
Hidden cost, collapsed status and colour-only states are treated as defects, not trade-offs.
Trust before magic
Show source, scope, cost, risk and action before execution.
Progressive disclosure
A newcomer sees a simple path; an expert opens the raw details.
Keyboard first
Every critical flow is available without a mouse.
State clarity
Running, waiting, blocked, failed, stale and rolled back are distinguishable.
Actionability
A finding carries an owner, impact, recommended action and evidence.
No dark patterns
Usage cost, data transmission and downgrade consequences are not hidden.
ACCESSIBILITY
- Web interfaces and critical desktop surfaces target WCAG 2.2 AA as the conformance standard.
- Screen-reader labels and semantic navigation.
- High contrast, with states that do not depend on colour alone.
- Zoom and reduced motion are supported.
- Full keyboard operation, including accessible charts.
- AI-generated explanations offer a plain-language mode.
A package is a lifecycle, not an upload.
Every agent, skill, connector and template moves through the same states. Revocation is a state, not a deletion.
DRAFT → SUBMITTED → AUTOMATED_REVIEW → MANUAL_REVIEW → APPROVED → PUBLISHED → UPDATED → DEPRECATED → SUSPENDED → REVOKED
Code and commands can stay inside your boundary.
The cloud manages metadata and policy. Execution happens where your policy says it happens.