Portable execution
Move work between qualified environments without transferring credentials or machine authority.
Execution Package, Handoff, CapsuleVerified delivery
AI delivery that survives the model, the machine, and the handoff.
Verchestra is a verified AI software-delivery harness. It turns discovery, planning, implementation, validation, and human approval into portable, signed, and reviewable delivery work.
0.0.0-qualificationT77 verified1.0 decision: signed holdnpx verchestra@0.0.0-qualification.9 --version
npx verchestra@0.0.0-qualification.9 self-test --profile smokeThe first run verifies and activates the signed release; self_test.verdict: PASS proves it on your machine.
Public source development and a published qualification package are available. A production release is not.
- 01RequestA developer brings a real delivery outcome, not a provider-specific prompt.
- 02DiscoveryRepositories, approved documentation, and read-only data context become source-bound evidence.
- 03Execution PackageRequirements, decisions, tasks, authority, and completion gates are sealed into a portable contract.
- 04Qualified driverClaude Code, Codex, or OpenCode/Qwen receives the same bounded delivery contract.
- 05EvidenceTests, digests, signed reports, and handoff state prove what happened.
- 06Human reviewAn accountable reviewer accepts or rejects evidence after independent verification.
Trust model
What travels. What stays.
A developer can begin with one AI environment and hand the next developer an executable contract, verified evidence, and the exact next action — without transferring credentials or relying on chat history.
Travels, signed
- Requirements
- Decisions
- Tasks
- Evidence digests
- Next action
Closed under content digests and signatures inside the Execution Package and the Handoff.
Stays local
- Credentials
- Provider sessions
- Tokens
- Machine paths
Never enters a shared artifact. A receiving environment rebuilds its own authority before it continues.
What works today
13 capabilities, 81 public reports, one maturity each.
Human-readable status first, internal task ids second. Each state has one meaning: available — runnable today from the published npm package (npx verchestra). qualified — backed by a public validation report; not yet composed into the cli surface. experimental — present in the tree for evaluation; interfaces and evidence may change.
| Capability | Status | Evidence |
|---|---|---|
| Workspace initialization (init preview and apply) | available | issue #64 slice A/B |
| Evidence signing-key lifecycle (persist, rotate, revoke) | qualified | T68a |
| Cost and duration budget enforcement | qualified | T68b |
| Declared gate repair loop with human escalation | qualified | T68c |
| Policy boundary: declarative tests and signed bundles | qualified | T68d |
| AI driver adapters (Claude Code, Codex, OpenCode/Qwen) | qualified | driver qualification |
| Read-only database probes (7 engines, fixture-qualified) | qualified | database matrix |
| Signed distribution, activation, and rollback (TUF) | qualified | T66-T68 |
| Self-Test trust domain and doctor --deep | qualified | T69-T72 |
| Public regression campaigns and sealed-holdout promotion | qualified | T73-T74 |
| Platform matrix and release candidate | qualified | T75-T76 |
| 1.0 release decision: a signed hold, not promoted | qualified | T77 |
| Governed task delivery (plan, approve, start, review) | experimental | #405, #406 |
Handoff and contract
Start in Claude Code. Continue in OpenCode / Qwen.
The receiving developer rebuilds local authority while the signed execution contract stays the same: requirements, evidence, gates, and the exact next action.
Source environmentClaude CodeDiscovery · specification
Signed Execution Packagerequirements · evidence · gates
Receiving environmentOpenCode / QwenLocal authority · same contract
- Claude Code
- Codex
- OpenCode / Qwen
Policy before effects
Capabilities, approvals, leases, and egress rules are evaluated before external actions.
Cedar, approvals, leases, egressRead-only discovery
Bounded database probes expose approved context without creating a hidden writer.
bounded plans, audit evidence, read-only credentialsEvidence, not assertions
Packages, runs, reports, and release inputs bind their source state by digest and signature.
content digests, signatures, sealed reportsHuman control
Independent verification and human acceptance remain explicit workflow states.
independent verification, then human acceptanceSafe repetition
Initialization, effects, Git operations, recovery, and handoff converge idempotently.
idempotent init, effects, Git, recovery, handoffRead-only data probes
Seven engines, one no-writer contract.
Database discovery runs through bounded plans, explicit capabilities, audit evidence, and read-only credentials. SQLite is live-qualified in this repository; the other six engines are contract-verified here and qualified at the edge.
Explore database discoveryApproved probe surface
mode: read_only- SQLitelive-qualified
- MongoDBcontract-verified
- MySQL / MariaDBcontract-verified
- Oraclecontract-verified
- PostgreSQLcontract-verified
- SAP ASE / Sybasecontract-verified
- SQL Servercontract-verified
Architecture
A delivery control plane, not a model wrapper.
Portable delivery facts are separated from machine-local credentials, sessions, and provider state. The drawing mirrors the system overview in the repository, node for node.
- vestra CLI → Application workflows
- Application workflows → Domain state and policy contracts
- Application workflows → Workspace and Git adapters
- Application workflows → Claude · Codex · OpenCode drivers
- Application workflows → Read-only database Probes
- Application workflows → Hybrid memory and retrieval
- Application workflows → Signed evidence and handoff
- Application workflows → Hermetic distribution and activation
- Cedar policies · approvals · egress → Application workflows
- Signed evidence and handoff → Independent verification
- Independent verification → Human review
Status and evidence
T77 is evidence. The 1.0 decision is a signed hold.
Foundations through T77 are backed by 81 public validation reports. The declared qualification chain is fully verified. The signed promote-or-reject decision has been made: a reject, recorded as a hold. The candidate keeps operating as 0.0.0-qualification; a promote round would decide on a fresh candidate with its own decision file.
T01T77
1.0: signed hold
What Verchestra is not
- It is not a public production release - the published npm package installs 0.0.0-qualification, not 1.0.
- It is not a hosted service - everything runs on your own machine.
- It does not transfer provider credentials - a handoff carries evidence and next actions, never sessions or secrets.
- It does not make unapproved paid model calls - a missing provider reports not configured, never a silent pass.
- It does not treat CI as human review - acceptance is an explicit human decision recorded as evidence.
- It does not call same-author checks independent verification - that distinction is stated, not blurred.
- It does not expose unqualified commands - the installed CLI advertises init, self-test, doctor, secret, and task and nothing else, and secret and task report not configured on any platform without a qualified credential store.
Build the standard with us
AI delivery deserves better evidence.
Explore the architecture, challenge the design, and help qualify the path to 1.0.