Docs and ADR map
One row per page under docs/, ADRs included. An ADR's status is the column that says whether its decision still holds; superseded ones stay listed because the reasoning is still the reason.
| Page | Title | Opens with | Status |
|---|---|---|---|
docs/README.md | Documentation | This index describes the current repository state. | — |
docs/adr/001-round-robin-router-mode.md | ADR-001: Adding the round_robin mode to Router | The Iterion v1 DSL orchestrates multi-agent workflows with a small set of | Accepted |
docs/adr/002-desktop-assetserver-proxy.md | ADR-002: Desktop studio hosted via Wails AssetServer handler | The desktop binary (iterion-desktop) is a thin native shell around the | Accepted |
docs/adr/002-editor-runview-separation.md | ADR-002: Separating the Run console from the Workflow editor | The Iterion editor is a React/Vite SPA embedded in the Go binary | — |
docs/adr/003-privacy-tools-pure-go.md | ADR-003: Pure-Go privacy tools (privacy_filter / privacy_unfilter) | Iterion needed a built-in mechanism to detect and redact PII (emails, | Accepted |
docs/adr/004-provider-fallback-chain.md | ADR-004: Per-node provider fallback chain as a credential-routing-hint chain | below; the cross-API deferral recorded here is discharged by | Accepted (amended 2026-06-22 — per-element model shipped,… |
docs/adr/005-runs-stats-cache.md | ADR-005: Runs-stats cache — lazy version-keyed memoization, not broker-push invalidation | (runStatsCache, runVersion), | Accepted |
docs/adr/006-sandbox-strict-doctor.md | ADR-006: iterion sandbox doctor --strict — dry-run validation that never pulls | (buildStrictReport, PreflightSandbox), | Accepted |
docs/adr/007-runview-files-combined-default.md | ADR-007: Run-view files panel — combined default by lifecycle, merged from two git… | (modeCombined, combinedFiles, lifecycle tags), | Accepted |
docs/adr/008-bot-golden-replay-framework.md | ADR-008: Bot golden-test framework records at the NodeExecutor seam and replays statically | Taskfile.yml (test:goldens, test:goldens:record, check) | Accepted |
docs/adr/009-daily-spend-cap.md | ADR-009: Per-day LLM spend cap — shared ledger + pre-exec pause, not a new run status | recordAndCheckBudget) and pkg/runtime/pause.go | Accepted |
docs/adr/010-findings-auto-hygiene.md | ADR-010: whats-next findings auto-hygiene — destructive prune on a conservative git-log… | (emit_action node, emit_action_system steps 10–13, emit_output | Accepted |
docs/adr/011-whole-improve-loop-context-chunking.md | ADR-011: whole_improve_loop fragments the workspace by package into per-pass… | (snapshot_chunk tool, streak_check compute, max_review_chunk_tokens var), | Accepted |
docs/adr/012-dispatcher-before-remove-hook-on-worker.md | ADR-012: Dispatcher workspace teardown (incl. | (runWorker — teardown now invoked here before postFinished), | Accepted |
docs/adr/013-dispatcher-attachments-unsupported.md | ADR-013: dispatch.attachments is unsupported — fail fast instead of silently dropping… | (Config.Validate attachments rejection, unsupportedAttachmentsErr, | Accepted |
docs/adr/014-dispatcher-paused-run-parking.md | ADR-014: a dispatched run that pauses for input is parked, not retried | (finishRun — the new ErrRunPaused / ErrRunPausedOperator branch), | Accepted |
docs/adr/015-dispatcher-retry-attempt-cap.md | ADR-015: Dispatcher retry attempt cap — bounded retries that give up into a terminal… | (finishRun default branch, giveUpIfExhausted), | Accepted |
docs/adr/016-in-run-worktree-file-editor.md | ADR-016: In-run worktree file editor — handler-layer write reusing one audited path… | (handleGetRunFileContent, handleSaveRunFileContent, | Accepted |
docs/adr/017-devbox-first-bot-toolchain.md | ADR-017: devbox-first bot toolchain — bot tools vs project devbox, project-devbox… | (BashExtraEnv, the devbox run -- project-managed-toolchain hook), | Proposed (design + feasibility prototype; staged rollout… |
docs/adr/018-bot-secret-binding-egress-enforcement.md | ADR-018: Bot-secret binding scope-tightening — enforce AllowedHosts, drop the… | A BotSecretBinding makes a stored org/user secret resolvable for a | Accepted |
docs/adr/019-sandbox-doctor-static-binary-check.md | ADR-019: sandbox doctor detects a dynamically-linked host iterion binary | (detectBinaryLinkage, staticBinaryWarning, binaryLinkage), | Accepted |
docs/adr/020-git-arg-injection-and-path-traversal-hardening.md | ADR-020: Allowlist + filepath.IsLocal hardening of git arg/path surfaces | pkg/git builds git command lines and worktree file paths from | Accepted |
docs/adr/021-is-ancestor-via-merge-base-equality.md | ADR-021: IsAncestor via merge-base equality, not --is-ancestor plumbing | After a worktree-using run finalizes, the studio must decide whether to | Accepted |
docs/adr/022-empty-tree-sha-synthetic-baseline-for-root-commits.md | ADR-022: Hardcoded empty-tree SHA as synthetic baseline for root commits | ShowCommit and DiffOfCommit in | Accepted |
docs/adr/023-c-locale-pinned-stderr-substring-error-classification.md | ADR-023: C-locale-pinned stderr substring matching for git error classification | The wrapper must distinguish several git outcomes that are not errors from | Accepted |
docs/adr/024-nul-framed-parsing-for-adversarial-git-metadata.md | ADR-024: NUL-framed (-z) parsing of all git output for adversarial metadata | The studio's Commits tab and files panel parse git log, git status, | Accepted |
docs/adr/025-git-panel-reflects-working-tree-not-the-index.md | ADR-025: Studio file panel reflects the working tree, not the index | The studio's modified-files / diff panel answers one question for the | Accepted |
docs/adr/026-main-repo-root-resolution-for-project-rooted-state.md | ADR-026: Main-repo-root resolution (gitdir pointer parse) for project-rooted state | Run and dispatcher worktrees live under the repo they belong to: | Accepted |
docs/adr/027-git-cli-shell-out-not-embedded-pure-go.md | ADR-027: pkg/git shells out to the host git binary, not an embedded pure-Go library | iterion needs git status / diff / log for the studio's modified-files | Accepted |
docs/adr/028-dispatcher-actor-io-offload.md | ADR-028 — Dispatcher actor: offload blocking tracker I/O | Status: Accepted. | — |
docs/adr/029-sandboxed-claw-via-hidden-claw-runner-ndjson-ipc.md | ADR-029: Sandboxed claw via hidden claw-runner NDJSON IPC | Sandboxed claw calls need two properties that pull in opposite directions. | Accepted · amended 2026-09-29 (see… |
docs/adr/030-sandbox-network-proxy-binds-all-interfaces-not-loopback.md | ADR-030: Sandbox network proxy binds all interfaces, not loopback | The sandbox network CONNECT proxy is started by the launcher but must be reachable from sibling sandbox containers. | Accepted |
docs/adr/031-sandbox-one-long-lived-sleep-infinity-container-per-run.md | ADR-031: Sandbox uses one long-lived sleep-infinity container per run | A single sandboxed run can issue many delegate executions and tool calls. | Accepted |
docs/adr/032-quota-optimistic-inc-with-detached-context-rollback.md | ADR-032: Quota uses optimistic increment with detached-context rollback | Per-org monthly run and webhook caps must be enforced under concurrency. | Accepted |
docs/adr/033-launch-gate-fails-open-on-metering-error.md | ADR-033: Launch gate fails open on metering error | Run admission combines several gates: org suspend/read-only status, active-run concurrency, in-memory launch rate, monthly run quota,… | Accepted |
docs/adr/034-webhook-dual-mode-auth-token-header-vs-body-hmac.md | ADR-034: Webhook auth supports token headers and body HMAC | Forge webhook providers authenticate deliveries differently. | Accepted |
docs/adr/035-per-org-sso-generic-oidc-plus-dedicated-connectors.md | ADR-035: Per-org SSO uses generic OIDC plus dedicated connectors | Per-org SSO must support arbitrary standards-compliant OIDC identity providers, including org-admin-supplied issuers. | Accepted |
docs/adr/036-jws-id-token-verification-alg-allowlist.md | ADR-036: JWS ID-token verification uses an asymmetric algorithm allowlist | Per-org OIDC lets tenant administrators configure arbitrary issuers. | Accepted |
docs/adr/037-sso-auto-link-requires-domain-dns-txt-not-idp-email-verified.md | ADR-037: SSO auto-link requires DNS-verified domain, not only IdP email_verified | Auto-linking a fresh SSO identity onto an existing iterion user by email is sensitive: if an org-controlled IdP can assert an email address… | Accepted |
docs/adr/038-github-team-gating-via-materialized-reverse-lookup-index.md | ADR-038: GitHub team gating uses a materialized reverse-lookup index | GitHub logins can grant access to iterion orgs based on allow-listed GitHub org/team memberships. | Accepted |
docs/adr/039-per-tenant-sealed-oauth-app-store-replaces-global-env.md | ADR-039: Per-tenant sealed OAuth app store replaces global env | Multi-tenant cloud deployments must support many forge providers and instances. | Accepted |
docs/adr/040-oidc-callback-cookie-samesite-lax-not-strict.md | ADR-040: OIDC callback cookie uses SameSite=Lax, not Strict | OIDC login starts on iterion, redirects the browser to an identity provider, and returns through a cross-site top-level GET callback. | Accepted |
docs/adr/041-ultracode-is-a-mode-not-a-wire-value-4-8-only.md | ADR-041: Ultracode is a mode, not a wire value, gated to Opus 4.8 | The DSL exposes reasoning_effort as a user-facing control. | Accepted |
docs/adr/042-dynamic-model-specs-curated-fallback-async-fetch.md | ADR-042: Dynamic model specs over a curated fallback, fetched async | capabilitiesForModel() resolves a model's ModelCapabilities — | Accepted |
docs/adr/043-provider-model-support-tiers.md | ADR-043 — Provider/model support tiers: Anthropic + OpenAI first-class, z.ai/GLM as an… | Status: accepted (2026-06-23) | — |
docs/adr/044-adaptive-recovery-for-deterministic-action-nodes.md | ADR-044 — Adaptive recovery for deterministic ACTION nodes (gates stay deterministic) | Status: accepted (partial) (2026-06-23) — the Verified Action quad is | — |
docs/adr/045-whole-improve-loop-progressive-context-disclosure.md | 045 — whole-improve-loop: progressive context disclosure for the reviewer | Status: Accepted (2026-06-23) — implemented behind context_mode, default explore, validated by run (see… | — |
docs/adr/046-event-driven-runs-trigger-spine.md | ADR-046 — Event-driven runs: a unified trigger spine (board events first) | Status: accepted (phases 1–4) (2026-06-25) — shipped end-to-end, local + | — |
docs/adr/047-forge-token-out-of-git-config.md | ADR-047 — Keep the forge token out of the cloned repo's .git/config | Status: accepted → implemented 2026-07-20 by a different mechanism, amended 2026-10-28 (no kill-switch — see Amendment) | — |
docs/adr/048-org-team-hierarchy.md | ADR-048 — Org → Teams two-level hierarchy | Status: Accepted (implemented — P0→P2) | — |
docs/adr/049-forge-as-interchangeable-substrate.md | ADR-049 — Forge as an interchangeable substrate (iterion stays a layer, not a forge) | Status: Accepted | — |
docs/adr/050-dsl-turing-completeness-fuel-liveness.md | ADR-050 — DSL Turing-completeness: relocate termination to fuel + liveness | Status: accepted (Layer 0 + Layer B shipped) (2026-06-30) — the bounded | — |
docs/adr/051-in-bot-event-driven-primitives.md | ADR-051 — In-bot event-driven primitives (emit / wait) | Status: proposed → Brick 1 implemented (2026-06-30). | — |
docs/adr/052-review-topology-mono-dual.md | ADR-052 — Mono/dual review topology for bi-model review-loop bots | Status: accepted → implemented (2026-07-01). | — |
docs/adr/053-unified-run-streaming.md | ADR-053 — Unified, store-agnostic run streaming (events + logs, local + cloud) | Status: accepted (2026-07-03; amended same day — see Amendment). | — |
docs/adr/054-monotonic-active-duration-semantic-loop-counting.md | ADR-054 — Monotonic active-duration + semantic loop counting | Status: accepted (2026-07-03; shipped 85ea12d7f). | — |
docs/adr/055-unit-convergent-adaptive-improve-loop.md | ADR-055 — Unit-convergent, adaptive improvement loop (inverting the "manual Claude Code… | Status: accepted (2026-07-03). | — |
docs/adr/056-adaptive-run-level-recovery.md | ADR-056 — Adaptive transient retry + bounded auto-resume | Status: accepted (2026-07-03; shipped f84ad6af6). | — |
docs/adr/057-axis-driven-work-list-sweep.md | ADR-057 — Axis-driven work-list sweep (whole-improve-loop's real mechanism) | Status: accepted (2026-07-03). | — |
docs/adr/058-minimal-framing-lean-on-the-agent.md | ADR-058 — Minimal framing: lean on the agent, don't cage it in a graph | Status: accepted (2026-07-03). | — |
docs/adr/059-skill-library.md | ADR-059 — Skill library: a first-class, referenceable store of skills | Status: accepted (2026-07-05). | — |
docs/adr/060-conversational-single-agent-bots.md | ADR-060 — Conversational single-agent bots: the chat loop pattern | Status: accepted (2026-07-07, amended 2026-10-29 — the durable-brief half of the dialogue contract is withdrawn, see Amendment) | — |
docs/adr/061-per-backend-system-prompt-composition-mode.md | ADR-061: Per-backend system-prompt composition mode | user setting scope left claude_code's default; the ambient-context policy | Accepted |
docs/adr/062-system-reminder-envelope-for-harness-injections.md | ADR-062: <system-reminder> envelope for harness-origin injections | Both backends inject harness-origin text into a running conversation: | Accepted |
docs/adr/063-post-compaction-todo-reseed-nudge.md | ADR-063: Post-compaction todo-reseed nudge | The claw path compacts conversation history when it approaches the | Accepted |
docs/adr/064-worktree-finalization-requires-delegated-authority.md | ADR-064: Worktree finalization requires delegated workspace authority | The worktree finalization path (see the engine's worktree: auto | Accepted |
docs/adr/065-dedicated-cli-agent-backend.md | ADR-065: Dedicated CLI-agent backend for non-claude-code argument protocols | iterion had no way to run a third-party agent CLI whose argument protocol | Accepted |
docs/adr/066-runner-build-cache-architecture.md | ADR-066 — Runner build-cache architecture: shared RWX Go caches now, Nix binary-cache… | Cloud runner pods (devbox-first-class image, ADR-lineage: the 2026-07-08 | — |
docs/adr/067-persist-run-git-metadata-for-cloud-panels.md | ADR-067 — Persist run git metadata to the store so cloud Commits/Files panels survive… | In cloud mode the studio's run Commits and Modified files panels | — |
docs/adr/068-persist-run-diff-content-for-cloud-panels.md | ADR-068 — Persist per-file diff content so cloud file/commit diff clicks resolve | run Commits and Modified files panels render by persisting a | — |
docs/adr/069-mid-run-file-secret-refresh-for-sandboxed-runs.md | ADR-069 — Mid-run file-secret refresh for sandboxed runs | GitHub App installation token, which lives ~1h) is a **launch-time | — |
docs/adr/070-kubernetes-sandbox-orphan-gc.md | ADR-070 — Garbage-collect orphaned kubernetes sandbox pods and their… | The kubernetes sandbox driver (pkg/sandbox/kubernetes) cleaned up its | — |
docs/adr/071-board-as-pipeline-projection.md | ADR-071 — Board as a projection of a pipeline (additive) | Status: proposed (2026-07-12). | — |
docs/adr/072-web-search-capability-tiers.md | ADR-072 — Web search as a sovereign capability ladder (SearXNG → Firecrawl) | Status: accepted (2026-07-13). | — |
docs/adr/073-cloud-twins-for-fs-only-run-detail-seams.md | ADR-073 — Cloud twins for the three filesystem-only run-detail store seams (turns, tool… | Three optional store.RunStore seams were implemented only on | — |
docs/adr/074-dedicated-pipeline-board-projection.md | ADR-074 — A dedicated pipeline board projection | Status: proposed (2026-07-14, revised same day). | — |
docs/adr/075-irref-fallback-for-oversized-cloud-queue-ir.md | ADR-075 — IRRef fallback: offload an oversized compiled IR out-of-band at cloud dispatch | Cloud-mode dispatch marshals a run's compiled IR (the AST File) inline | — |
docs/adr/075-nexie-roadmap-study-cycle-skill-level.md | ADR-075 — Nexie v3: the roadmap-study cycle as a skill-level behavior | Status: accepted (2026-07-16). | — |
docs/adr/076-pipeline-hard-blockers-and-waiting-deps.md | ADR-076 — Pipeline hard blockers, waiting_deps, and unified launch admission | Status: accepted (2026-07-18). | — |
docs/adr/076-scoped-config-share-editor.md | ADR-076 — Scoped config-share editor (self-service, per-field, per-repo) | Status: proposed · 2026-07-17 | — |
docs/adr/077-declarative-per-bot-config-share-surface.md | ADR-077 — Declarative per-bot config-share surface | Status: accepted · 2026-07-18 | — |
docs/adr/078-config-editor-role-sso-team-scoped-access.md | ADR-078 — Config-editor role: SSO-team-scoped access to config-share | Status: accepted · 2026-07-18 | — |
docs/adr/079-cloud-portable-plugin-and-library-skills.md | ADR-079 — Cloud-portable plugin & library skills | Status: accepted (2026-07-20). | — |
docs/adr/080-git-backed-org-private-plugin-sources.md | ADR-080 — Git-backed, org-private plugin sources | Status: accepted (2026-07-20). | — |
docs/adr/081-async-human-interaction.md | ADR-081 — Async human interaction: ask, keep working, sync later | Date: 2026-07-21 | — |
docs/adr/082-sandbox-by-default.md | ADR-082 — Sandbox by default | Sandboxing was opt-in: a workflow had to declare sandbox: (or the | — |
docs/adr/083-json-field-schema-type-union.md | ADR-083 — JSON-typed schema fields compile to a type union, not the empty schema | The DSL json field type (ir.FieldTypeJSON) means "this output field | — |
docs/adr/084-subbot-reattach-across-restarts.md | ADR-084 — Subbot parents re-attach to their child across a restart | Date: 2026-07-22 | — |
docs/adr/085-pi-as-execution-backend.md | ADR-085: pi as an execution backend | iterion's backend fleet has a shape problem at the edges. | Accepted |
docs/adr/086-pipeline-card-drawer-hand-rolled-overlay.md | ADR-086 — The pipeline card drawer stays a hand-rolled overlay, and owns its own focus… | The studio ships a Radix-backed right-side sheet primitive, | — |
docs/adr/087-cross-backend-model-fallback-chain.md | ADR-087: Cross-backend model fallback chain (fallbacks:) — loud, IR-visible, opt-in | (dispatchWithProviderFallback, providerFallbackEligible), | Accepted |
docs/adr/088-error-tracking-via-sentry-dsn-protocol.md | ADR-088: Error tracking through the Sentry DSN protocol, opt-in by env | (Init, Enabled, Capture*, Flush), | Accepted |
docs/adr/089-session-persist.md | ADR-089 — session: persist: a node resumes its own conversation on re-entry | transcript rehydration (reserved conversation_ref, not this PR) | Accepted (revision 8 — Codex review) |
docs/adr/090-model-registry-and-operator-model-choice.md | ADR-090: a model registry, and letting the operator choose the model | Nobody could say which model the studio assistant ran on, and nobody could | Accepted |
docs/adr/090-runtime-operational-settings-db-backed.md | ADR-090 — Runtime-configurable operational settings, DB-backed with TTL-bounded… | The subscription usage caps were frozen at process start from env | Accepted |
docs/adr/091-fallback-skip-route-and-plan-peer-review.md | ADR-091: action: skip terminal route + when: route gate — and the cross-model plan… | (checkFallbackAction, checkFallbackWhen), | Accepted |
docs/adr/091-ubiquitous-assistant-chat-dock.md | ADR-091 — The assistant is a shell-level dock with implicit route context, not a route | The studio's assistant was reachable from exactly one route. | — |
docs/adr/092-product-docs-editorial-sovereignty-and-git-native-source-deltas.md | ADR-092 — Editorial sovereignty in the target repo, and git-native cross-repo source… | product-docs is the first catalog bot whose **workspace and subject | Accepted |
docs/adr/093-bot-vars-runtime-settings.md | ADR-093 — Bot-var overrides: ${ITERION_X:-default} resolved from the DB before the… | Bots parameterize their model pins, reasoning effort and tunables as | Accepted |
docs/adr/093-model-spec-registry-as-a-leaf-package.md | ADR-093: The model-spec registry is a leaf package, and its published prices are a cost… | (Registry, Default, SetDefault, NewSeeded), | Accepted |
docs/adr/094-shared-subbot-bundles-bot-uri.md | ADR-094: Shared subbot bundles — the bot:// dependency URI, a unified subbot source… | Two sibling projects (Town, Tabarria) run different main bots but share the | Accepted |
docs/adr/094-trigger-effect-outbox.md | ADR-094 — Durable effect outbox for cloud board triggers | work, the lossy-bus doctrine in docs/merge-gate.md | — |
docs/adr/095-terminal-state-contract-and-failure-taxonomy.md | ADR-095 — Canonical terminal-state contract and persisted failure taxonomy | state machine; this ADR adds classification only, zero new transitions), | — |
docs/adr/096-board-claim-lease-and-watchdog.md | ADR-096: Board claim lease + fenced watchdog | ADR-070 (k8s orphan GC — the TTL+parenthood+reaper triad, conserve on | — |
docs/adr/097-github-projects-v2-board-sync.md | ADR-097 — GitHub Projects v2 ↔ native board sync | cloud team onto the Iterion project board | — |
docs/adr/098-connector-catalog.md | ADR-098 — The connector catalog: MCP for agents, deterministic nodes for workflows | autonomous, redistributable connector catalog; lot P0 is | — |
docs/adr/098-dsl-versioning-and-authoring-surface.md | ADR-098 — DSL versioning, explicit imports, and the authoring surfaces | ADR-093 (leaf packages), the .bot as a git-native artifact | — |
docs/adr/099-public-contracts.md | ADR-099: Public contracts, bound to the program | A bot has a face the outside reads without opening its prompts: what it takes, | — |
docs/adr/100-dry-run-at-the-executor-seam.md | ADR-100: The dry run at the executor seam | A .bot that compiles still dies at its first paid run, in ways the compiler | — |
docs/adr/101-review-request-withdrawal-after-publish.md | ADR-101: The App withdraws the review request its own review answered | Asking for a re-review by adding a bot identity as reviewer is a lane the | — |
docs/adr/102-yaml-author-twin.md | ADR-102: The YAML author twin — a draft, never a truth | What the lot then had to settle is what a .bot.yaml IS to every surface that can meet one: a launcher, a packer, a content hash, the… | — |
docs/adr/103-run-addressed-by-id-across-teams.md | ADR-103: A run is addressed by its id, across the teams you may see | ADR-048 made one ACTIVE team per identity the tenancy primitive: the auth middleware stamps it on the request context, and the store… | — |
docs/adr/104-product-docs-route-table-resolved-once-at-the-run-base.md | ADR-104 — The product-docs route table is resolved once, at the run base | When a golden-master net is present, the exhaustiveness gate holds the | Accepted |
docs/adr/105-ci-build-cache-on-the-org-runners.md | ADR-105 — CI build cache on the org's runners: cold, measured, and never a shared… | (the product's cloud runners — a shared writable RWX cache, off by default; | — |
docs/adr/106-resume-restores-the-scratch-banked-at-teardown.md | ADR-106 — A resume restores the scratch its run banked at teardown | Nodes keep working state under ${PROJECT_SCRATCH_DIR}: a verify.sh an | Accepted |
docs/adr/107-seaweedfs-object-store.md | ADR-107: SeaweedFS is the object store of the cloud deployment | MinIO no longer distributes its community edition. | Accepted |
docs/adr/117-server-side-leader-lease-for-idempotent-nets.md | ADR-117 — A server-side leader lease for idempotent nets | (a server-side sweep "would need its own lease"); 096-board-claim-lease-and-watchdog.md | — |
docs/adr/118-merge-gate-settle-marks-and-verdict-attribution.md | ADR-118 — Merge-gate settle marks, and the verdict attributed at publish time | (the sweep's election — this record is what the elected sweep still spends); issue #2002; docs/merge-gate.md | — |
docs/adr/119-ambient-context-policy.md | ADR-119 — ambient_context: what an agent node inherits besides its prompt, declared… | operator's personal setup should reach a bot; full backend parity in one | — |
docs/adr/120-agent-instruction-tree.md | ADR-120 — One canonical instruction root, with its size gated | (the work-tracking contract the root carries); issue #2071 under epic #1480; | — |
docs/adr/121-adaptive-routing-policy.md | ADR-121: adaptive routing — a multi-level policy that picks the (harness, credential)… | Today a run finds its credential through pieces that do not compose. | Arbitrated (2026-10-02 — the operator's four decisions… |
docs/adr/122-gateway-models-resolved-exactly.md | ADR-122 — A gateway's models are resolved exactly: the operator's table, then a… | amended for gateway ids only, in two places: its third rejected alternative (an embedded table), and the | — |
docs/adr/123-run-bundle-dek-in-envelope.md | ADR-123: Run bundles seal under a per-run DEK carried in the queue envelope | Date: 2026-10-06. | — |
docs/adr/124-gating-bot-merge-gestures.md | ADR-124 — A gating bot: merge-gate gestures as a declared capability, executed by the… | extends the verdict-order authority from commit statuses to the gestures that follow them. | — |
docs/adr/125-a-lots-contract-is-a-directory-judged-on-what-lands.md | ADR-125 — A lot's contract is a directory, judged on what lands | The modernize bot carries one lot of a programme to its exit gate, and writes | Accepted |
docs/adr/126-accessibility-audits-delegate-the-judgement-to-the-ultra11y-engine.md | ADR-126 — Accessibility audits delegate every judgement to the ultra11y engine; iterion… | Two accessibility bots shipped in the catalogue, and neither could stand | Accepted |
docs/adr/127-an-agent-nodes-processes-end-with-the-node.md | ADR-127 — An agent node's processes end with the node | (claude_code and its formatting pass, codex, cliagent and the backends | Accepted · amended 2026-10-21 (see… |
docs/adr/128-a-repositorys-suites-run-at-every-lots-gate.md | ADR-128 — A repository's suites run at every lot's gate | plan_read, the campaign_user prompt; bots/assessment (Assessy) — | Accepted |
docs/adr/129-per-integration-typed-routing-overrides.md | ADR-129 — Per-integration routing: typed node overrides and a provider allowlist ride… | them, amended by three adversarial reviews of the first draft, § Objections) | Arbitrated (2026-10-12 — the operator chose options 2+3… |
docs/adr/130-env-expansion-opt-out-for-tool-bodies.md | ADR-130 — env_expansion: a tool body the engine leaves verbatim, and the lint where… | A tool node's body gains a property that tells the engine to stand back from | Proposed |
docs/adr/131-tenant-gateway-credential.md | ADR-131 — A tenant's OpenAI-compatible gateway is a credential: base URL + key, sealed… | A deployment serves openai_compatible/<gateway model id> from its own environment only: OPENAI_COMPATIBLE_BASE_URL / _API_KEY are… | Proposed (2026-10-21 — the plan it records was arbitrated… |
docs/adr/132-a-run-reads-no-environment.md | ADR-132 — A run reads no environment: every setting it observes is a database level,… | shape for review before any code) | Proposed (the operator's doctrine, 2026-10-22, is binding… |
docs/adr/134-identity-tree-read-separately-credentials-derive-at-the-chokepoint.md | ADR-134 — The identity tree is read, never trusted, and credentials derive only where… | The org tree was a lie three ways: the auth routes built it from per-document decodes that could half-fail (#2624's class), a revoked… | Proposed (2026-10-23; lands with the #1668 PR and is… |
docs/adr/135-a-clients-sign-out-is-a-machine-not-a-flag.md | ADR-135 — A client's sign-out is a machine, not a flag: OWED until the server confirms,… | A browser cannot end its own httpOnly session: "sign out" is a request, and until the server confirms it the session is live. | Proposed (2026-10-23; lands with the #1668 PR and is… |
docs/adr/136-a-bot-source-write-carries-what-a-whole-read-issued.md | ADR-136 — A bot-source write carries what a whole read issued: stored bytes are… | The DSL reader carries a read budget (#1690), so a bot past its bounds — or holding one unreadable file — opens as a salvage: a… | Proposed (2026-10-23; lands with PR #2712 and is reviewed… |
docs/adr/137-local-gate-hermetic-by-default.md | ADR-137 — The local gate is hermetic by default | An unrelated diff's task check spends the full 1200-second package timeout | Proposed (2026-10-24; implementation and review in #2585) |
docs/adr/138-forge-provisioning-immutable-identities.md | ADR-138: immutable webhook identities and hybrid reconciliation | Status: accepted. | — |
docs/adr/139-language-stays-go-sidecars-for-the-rest.md | ADR-139: iterion stays Go; other languages enter as sidecars behind seams | A proposal reached the operator: with today's coding agents able to write large | Accepted |
docs/adr/140-discovery-claims-what-the-bundle-package-claims.md | ADR-140: Discovery claims what the bundle package claims, and a nested bundle is nothing | Discovery and the bundle package disagreed about what a directory is. | — |
docs/adr/141-board-issues-join-the-by-id-class.md | ADR-141: Board issues join the by-id class — an issue is served from its team | ADR-103 deferred the board to this epic's lane: /api/v1/native/issues/{id} and /api/v1/pipeline-board/tasks/{id} — some 42 routes… | — |
docs/adr/142-dependency-internalization-doctrine.md | ADR-142: dependencies are pruned, fork-patched or kept — never rewritten wholesale | The operator asked whether today's coding agents make it cheaper to | Accepted |
docs/adr/143-sandbox-read-back-contract.md | ADR-143: A sandbox path the run reads back is declared, served by storage the driver… | The runtime hands a container paths to write into — the run-files | Accepted |
docs/adr/144-shared-skills-are-bundle-dependencies.md | ADR-144: A shared skill is a bundle DEPENDENCY, not a copy — exports.skills declares… | The catalogue duplicates skills, and the duplication is now declared | Accepted (2026-10-29) — on the clauses below, each backed… |
docs/adr/145-shared-fragments-are-bundle-dependencies.md | ADR-145: A shared fragment is a bundle DEPENDENCY, not a copy — exports.fragments… | A .bot can already be several files. | Accepted (2026-10-29) — on the clauses below, each backed… |
docs/adr/146-secret-boundary-v2-grants-and-sinks.md | ADR-146: Secret boundary v2 — a secret is granted to a sink, and what crosses a node… | Three layers are live and documented in secrets.md: | Accepted — the three axes below are decided by the… |
docs/adr/147-operator-bound-bot-context-is-a-pinned-source.md | ADR-147: Operator-bound bot context is a PINNED SOURCE under a kinded binding — the… | The ticket asks for reference material an operator controls, materialised | Accepted (2026-10-29) on the clauses below, each backed by… |
docs/adr/148-run-visibility-org-sharing-axis.md | ADR-148: run visibility — an org sharing axis, not a second tenancy | Status: accepted (plan reviewed by codex gpt-6-astra xhigh, 9 findings, 2026-10-27) | — |
docs/adr/149-the-run-logger-redacts-what-it-keeps.md | ADR-149: The run logger redacts every record it keeps — one chokepoint, not N sink… | A run's log sinks printed the errors of non-crossing producers raw: four sinks | Accepted — the operator picked this option on… |
docs/adr/150-attachments-reach-cloud-runs.md | ADR-150: attachments reach cloud runs — a staging seam on the store, a copy where no… | Status: accepted (ARB-111, session-vagues46, 2026-10-29) | — |
docs/adr/152-the-reliability-invariants-have-owning-layers.md | ADR-152: The reliability invariants have owning layers — one invariant, one owning… | The close-out of #1006 published the ledger its eight tranches owed. | Accepted (2026-11-03), decision 5 amended the same day on… |
docs/adr/153-ports-are-a-semantics-the-engine-runs-not-a-declaration.md | ADR-153: Ports are a semantics the engine RUNS, not a declaration — the contract… | The ticket asks for four reading levels — a workflow's public contract, a | Accepted (2026-11-03) — on the clauses below, each read… |
docs/adr/154-the-sovereign-pool-boundary-is-a-namespace-and-an-enforced-proxy.md | ADR-154: The sovereign pool boundary is the pool's own RBAC, a standing policy and an… | A sovereign runner pool isolates a team by CODE: routing, admission, | Proposed (2026-11-03) — D27 (the operator) decided the… |
docs/adr/155-reserved-capacity-is-a-durable-allocation.md | ADR-155: reserved capacity is a durable allocation — one ledger, one atomic acquire, a… | Status: accepted — the decisions are taken: the operator decided on 2026-11-03 that the shape stands as written and that a reservation's… | — |
docs/adr/156-bearer-token-hashing-doctrine.md | ADR-156: Bearer tokens at rest — an unsalted SHA-256 digest; HMAC is reserved for… | Every long-lived bearer token iterion stores — refresh token, personal | Accepted — the operator decided it on 2026-11-03… |
docs/adr/157-authentication-events-join-the-audit-log.md | ADR-157: Sign-ins join the audit log — platform-scoped refusals, a peppered subject, no… | The audit log (pkg/audit) records control-plane mutations — org and team | Accepted — the operator picked this option on 2026-11-03… |
docs/adr/158-run-launches-join-the-audit-log.md | ADR-158: Run launches join the audit log — one choke point, one row per run, the… | A run came to exist through six lanes — POST /api/runs, the operator's | Accepted — the operator picked this option on 2026-11-03… |
docs/adr/160-legal-content-is-deployment-configuration.md | ADR-160: Legal content is deployment configuration — never the bundle, never the… | A public online service in France owes its visitors four texts: a legal | Accepted — the operator picked this option on 2026-11-03… |
docs/adr/161-one-resolver-decides-the-credential-a-call-spends.md | ADR-161 — One resolver decides which credential a call spends; dispatch, admission,… | Four readers answer "which credential does this call spend?", each its own way (sites on main; † only on the bench): | Accepted — the operator decided it on 2026-11-04: the… |
docs/adr/README.md | Architecture decision records | One decision per file, named NNN-kebab-title.md, where NNN is the next | — |
docs/agents/README.md | Agent instructions — the tree | Doctrine specific to this repository: what to know before touching iterion, | — |
docs/agents/backends/README.md | Backends and execution — the domain | Who runs the prompt, with which tools, and what the node keeps of its | — |
docs/agents/backends/backend-selection.md | Backend selection — the seven wired backends | Read it when a node runs on the wrong backend or you wire a new one. | — |
docs/agents/backends/facade-substitution.md | Facade substitution — the served model is not the label | Read it when a zai/moonshot route answers with GLM/Kimi under a | — |
docs/agents/backends/fallbacks-and-parity.md | Fallbacks, schema re-ask and system-prompt parity | Read it when you write fallbacks:, hit C173/C176, a node acts "dumber" | — |
docs/agents/backends/gateway.md | The OpenAI-compatible gateway | Serving openai_compatible/<gateway model id> from the deployment's | — |
docs/agents/backends/metering.md | Trusted metering | delegate.Result carries harness accounting independently of model JSON: | — |
docs/agents/backends/plugins-compression.md | Plugins — rewriters, MCP, skills, lifecycle; and compress: | Read it when command output is compressed (rtk) or a plugin changes what a | — |
docs/agents/backends/prompt-engineering-dials.md | Cursors, supervisors, ultracode | Read it when authoring cursor: / supervisor: blocks or | — |
docs/agents/backends/sandbox.md | Sandbox — what a node may touch | Read it when a SANDBOX_* failure appears or you change what a node may | — |
docs/agents/bots/README.md | Bots — the catalog domain | A bot shipped in bots/ is a general-purpose tool. | — |
docs/agents/bots/bot-authoring.md | Authoring bots — the four rules a catalog bot must clear | A bot shipped in bots/ is a general-purpose tool. | — |
docs/agents/bots/convergence.md | Improvement loops converge to an asymptote | Read it when writing or reviewing a loop, campaign or reviewer bot — the asymptote rule, the stop criteria, and the shipped examples. | — |
docs/agents/bots/engine-bot-agnostic.md | The ENGINE stays bot-agnostic | Read it when engine code is about to name a bot or bake one in. | — |
docs/agents/bots/input-drop-traps.md | The two traps a dropped input leaves behind | Dropping a dead field from an LLM node's input (input-reaches-the-model.md holds the remedy table) leaves two… | — |
docs/agents/bots/input-reaches-the-model.md | A value on an input reaches the model only if a channel of THAT node renders it | Read it when adding, dropping or re-referencing a field on an LLM node's input schema or on an edge's with. | — |
docs/agents/bots/rgaa-audit-run.md | Run the RGAA audit yourself — the demo path | rgaa-audit (Acci) audits a product against the RGAA 4.1.2 standard and | — |
docs/agents/bots/run-link.md | A forge-facing bot links its run | Anything a bot posts outside the deployment — a pull-request body, a review, a | — |
docs/agents/bots/shipped-workflow-corpus.md | The shipped-workflow corpus | Every guard that holds this repository's .bot files to something — they | — |
docs/agents/bots/skills.md | Skills live with their bundle | Read it when editing a bundle's skills/ — the mirror into .claude/skills, naming, and the sharing rule. | — |
docs/agents/bots/taxonomy.md | Category & tags — the six-verb navigation spine | Read it when touching a manifest's category: / tags:, adding a tag | — |
docs/agents/bots/toolchain-devbox.md | A bot's toolchain is its devbox.json | Read it when a bot needs a binary the sandbox does not carry. | — |
docs/agents/bots/universality.md | Repo-agnostic and stack-agnostic — the universality rules | Read it when touching a catalog bot's vars, prompts or scanners; enforced by the catalog tests. | — |
docs/agents/bots/untrusted-input.md | The UNTRUSTED INPUT BOUNDARY | Read it when a node's prompt can carry repo- or issue-derived text and the node acts: shells out, writes, files issues. | — |
docs/agents/engine/README.md | Engine — the domain | Which package owns a behaviour, and the invariants each one carries. | — |
docs/agents/engine/automation-surfaces.md | Automation surfaces — what launches a run without a human typing | The four trigger families and the spine they converge on: the dispatcher's | — |
docs/agents/engine/bot-catalog-regeneration.md | Which runs regenerate the bot catalogue | Nexie's routing table, <bundle>/skills/iterion-bot-catalog.md, is generated | — |
docs/agents/engine/dsl-and-runtime.md | DSL and runtime — the compiled graph and how it executes | Node types, edge and reference syntax, the workflow-level fields | — |
docs/agents/engine/dsl-backend-execution.md | DSL, backends and execution — package invariants | One entry per package, verbatim from the engine map this tree replaces. | — |
docs/agents/engine/dsl-errors-resume.md | DSL errors, persistence and resume | Read it when a run fails, resumes or rewinds, or a checkpoint looks torn (docs/resume.md carries the operator view). | — |
docs/agents/engine/dsl-quick-reference.md | DSL quick reference — workflow dials, edges, budget | The exact syntax of the cross-cutting fields, one line each. | — |
docs/agents/engine/events-leases-and-schedules.md | Events, leases, queues and schedules — package invariants | One entry per package, verbatim from the engine map this tree replaces. | — |
docs/agents/engine/extensions-and-bot-sources.md | Extensions, skills and bot sources — package invariants | One entry per package, verbatim from the engine map this tree replaces. | — |
docs/agents/engine/http-failures.md | HTTP failures and partial identity reads | internal/httpx.WriteError and WriteErrorJSON own public error responses. | — |
docs/agents/engine/identity-data-lifecycle.md | Identity data lifecycle — audit of sign-ins and launches, retention, erasure | What the platform records about a person's account beyond the account row | — |
docs/agents/engine/run-provenance.md | Run provenance and execution attempts | A run keeps its ID across resumes. | — |
docs/agents/engine/tenancy-credentials-spend.md | Tenancy, credentials and spend — package invariants | One entry per package, verbatim from the engine map this tree replaces. | — |
docs/agents/engine/workspace-and-review-scope.md | Workspace, review scope and sandboxes — package invariants | One entry per package, verbatim from the engine map this tree replaces. | — |
docs/agents/engine/worktree-finalization.md | Worktree finalization (worktree: auto) | Read it when a run's workspace finalization misbehaves, or you touch finalizeWorktree. | — |
docs/agents/ops/README.md | Ops — the domain | — | — |
docs/agents/ops/dependency-surface.md | Dependency surface — measure it before arguing about it | cutting a dependency — or judging "how much third-party code do we actually | — |
docs/agents/ops/runbooks.md | Operational runbook index — capture what a session cost you to discover | The discovery entry point for "how do I configure / operate / debug X on | — |
docs/agents/ops/security-selfaudit.md | Security self-audit — running iterion's own security bots on iterion | How this repo audits itself: the scanner toolchain, the sec sandbox image, the | — |
docs/agents/orientation/README.md | Orientation — the domain | Exact questions (where, impact, path) go to iterion map and the committed | — |
docs/agents/orientation/graphify.md | Knowledge graph — graphify | graphify-out/ holds a queryable knowledge graph of this repository — Go/TS | — |
docs/agents/testing/README.md | Testing — the domain | — | — |
docs/agents/testing/background-oracles.md | Background sessions — prove the decision before measuring duration | The fake Claude CLI and the engine are separate processes. | — |
docs/agents/testing/engine-contracts.md | Engine contracts — testing an external CLI against the real pinned binary | for rgaa-audit today; deepsec for sec-audit-source was the counter-example), | — |
docs/agents/testing/flakes.md | Machine-dependent tests — annotate, measure, re-check | Record each machine-dependent failure: test, machine, evidence, disposition | — |
docs/agents/testing/process-fixtures.md | Process fixtures — captures, corpus copies and host state | Evidence for the test-author rules, linked from the | — |
docs/agents/testing/testing.md | Testing patterns — the helpers, and the traps that ejected PRs | Testing patterns and failure modes: a git subprocess that outlives its temp dir, a run whose workspace is the | — |
docs/agents/workflow/README.md | Workflow — how work reaches main | Board mechanics live in ../../board-epics.md; the | — |
docs/agents/workflow/adversarial-review-loop.md | The local adversarial round — what iterion requires, and who pays for it | scoping a round, the seven things the subagent prompt must carry, verifying the | — |
docs/agents/workflow/billy.md | Billy is paused — the zero-touch fixer lane, and its re-arm | State and re-arm procedure for this repository. | — |
docs/agents/workflow/dogfood.md | Dogfood discipline — a run the operator cannot watch does not count | Launching a catalog bot against this repo for real: where the run must land so | — |
docs/agents/workflow/push-to-main.md | Push to main — operator runbook | The operator direct-landing lane | — |
docs/agents/workflow/release.md | Release and changelog — how the cut reaches main | Floors, mirrors, refused cuts and the changelog pipeline, for the change that | — |
docs/agents/workflow/review-and-merge.md | Before merge — the required loop, and how a change reaches main | Every change lands through a pull request whose revi/review gate is green. | — |
docs/agents/workflow/worktrees.md | Worktrees — where an interactive session changes files | Where an interactive session makes its changes: a dedicated worktree per task, | — |
docs/architecture.md | Architecture | Iterion is organized around one compiled workflow and runtime model with | — |
docs/assistant-dock.md | The assistant dock | The studio's assistant is reachable from every authenticated route, | — |
docs/asymptote-bench.md | 📈 Asymptote benchmark | iterion bench asymptote measures the inter-session quality stabilisation curve of a workflow: rerun the same task in N independent… | — |
docs/async-interaction.md | Async human interaction — ask, keep working, sync later | ADR: 081-async-human-interaction | — |
docs/attachments.md | Attachments — file & image inputs | The attachments: block lets a workflow declare binary inputs (files, | — |
docs/authoring-lock.md | The authoring lock — one lock for every writer of a stored bot file | A stored bot file has several writers — the studio, the assistant, the unit | — |
docs/auto-maintenance.md | Auto-maintenance — wiring a repository so its dependencies update themselves | The goal: a repository receives its dependency updates, aligns its own code | — |
docs/backend-capability-registry.md | Backend capability registry — seed and review contract | pkg/backend/backendcaps is the declarative leaf shared by compiler and runtime. | — |
docs/backends.md | 🤝 Backends and credential auto-detection | A backend is the executor iterion routes a node to — either the in-process | — |
docs/board-epics.md | 🗂️ Runbook — the GitHub board's epics | anchor, and a leading emoji slugs differently on GitHub than in VitePress. | — |
docs/bot-bundle-snapshots.md | Cloud bot bundle snapshots | A cloud launch resolved through the server's bot authority freezes one bundle | — |
docs/bot-invocations.md | Bot invocations — how a bot is triggered on a repo | A bot's manifest.yaml declares a typed invocations: block: how the bot | — |
docs/bot-runs/2026-06-23-glm-dogfood-campaign.md | 2026-06-23 — GLM-5.2 dogfood campaign (Wave 1 + Wave 2 + integration) | Cross-bot campaign record. | — |
docs/bot-runs/2026-06-23-retest-campaign.md | 2026-06-23 — Catalog re-test campaign + Verified Action delivery | Goal (operator): re-test every catalog bot until each runs reliably on the | — |
docs/bot-runs/2026-06-24-fleet-dogfood-campaign.md | Fleet dogfood campaign — every catalog bot, one night (2026-06-24) | Goal: run all catalog bots on iterion itself; each must run to a terminal | — |
docs/bot-runs/README.md | Bot runs — validation & knowledge base | This directory is the committed knowledge base for iterion's catalog bots. | — |
docs/bot-runs/adr-cartograph.md | adr-cartograph (Adry) — bilans | ADR cartographer + completeness auditor. | — |
docs/bot-runs/adr-rechallenge.md | adr-rechallenge (ReArchi) — bilans | Human-in-the-loop ADR re-challenger. | — |
docs/bot-runs/app-dev.md | app-dev (Appy) — dogfood runs | Newest first. | — |
docs/bot-runs/arbitrate.md | Themis — arbitrate run bilans | Doctrine-bound judge for the divergence cases a modernisation programme | — |
docs/bot-runs/bmady.md | bmady (Bmady) — dogfood bilan | Index + template: README.md. | — |
docs/bot-runs/branch-improve-loop.md | Billy — branch-improvement validation | a scratch repository, the in-loop review clean. | — |
docs/bot-runs/campaign.md | Campy 🧭 — campaign run bilans | Supervises a whole modernisation programme by running modernize as a subbot | — |
docs/bot-runs/copilot.md | Copi — bots/copilot | Conversational iterion assistant: the DSL, the Cxxx diagnostics, run/resume | — |
docs/bot-runs/dep-update-guard.md | Vetty — dep-update-guard run bilans | Reactive security + alignment guard for automated dependency-update PRs | — |
docs/bot-runs/devbox-setup.md | devbox-setup (Devy) — dogfood bilan | Index + template: README.md. | — |
docs/bot-runs/docs-refresh.md | docs-refresh (Doki) — bilans | Documentation refresh bot (v3: adaptive paradigm). | — |
docs/bot-runs/e2e-coverage.md | e2e-coverage (Endy) — run bilans | Matrix-anchored e2e coverage completion bot (ADR-058 v2, sibling of Testy). | — |
docs/bot-runs/evolve.md | Evoly (evolve) — bot run bilan | Strategic / architectural evolution partner. | — |
docs/bot-runs/feature-dev.md | Featurly — feature-dev run bilans | every LLM node of the graph exercised but the peer review (off by var). | — |
docs/bot-runs/feature-gap-fill.md | feature-gap-fill (Fini) — bilans | Gap-driven feature completer. | — |
docs/bot-runs/feed-watch.md | feed-watch (Vigie) — run log | Newest first. | — |
docs/bot-runs/golden-master.md | golden-master (Goldy) — dogfood bilan | Index + template: README.md. | — |
docs/bot-runs/instrument.md | instrument (Obsy) — run bilans | Newest first. | — |
docs/bot-runs/issue-triage.md | issue-triage — Triagy | Single-shot card router: fired by the trigger spine on triage:auto | — |
docs/bot-runs/keepalive.md | Bilans — always-on (overlap: keepalive) + examples/keepalive | The keepalive/always-on scheduling feature and its demo bot | — |
docs/bot-runs/modernize.md | Morphy 🧱 — modernize run bilans | Carries a repository through a programme of modernisation lots — steps whose | — |
docs/bot-runs/product-docs.md | product-docs (Prody) — run bilans | Functional, business-audience product documentation generated and maintained | — |
docs/bot-runs/revi-converse.md | revi-converse — run bilans | Newest first. | — |
docs/bot-runs/review-env.md | Envy — review-env run bilans | Deploys the current commit's already-published image to the attached platform | — |
docs/bot-runs/review-pr.md | Revi — review-pr run bilans | Read-only code reviewer. | — |
docs/bot-runs/rgaa-audit.md | Acci — rgaa-audit run bilans | Accessibility auditor (read-only) on the pinned ultra11y engine since v3 | — |
docs/bot-runs/sec-audit-deps.md | Depsy — sec-audit-deps run bilans | Universal supply-chain / SCA auditor: enumerates installed deps per ecosystem, | — |
docs/bot-runs/sec-audit-source.md | Seki + deepsec — validation | repository: three candidates triaged, a full pool of three voters, a clean | — |
docs/bot-runs/secured-renovacy.md | secured-renovacy (Renovacy) — dogfood bilan | Index + template: README.md. | — |
docs/bot-runs/supply-shield-cve.md | supply-shield-cve (Vulny) — run bilans | Newest first. | — |
docs/bot-runs/supply-shield.md | supply-shield (Shieldy) — run bilans | Newest first. | — |
docs/bot-runs/test-coverage.md | test-coverage (Testy) — run bilans | Universal test-coverage augmentation bot (ADR-058 v2). | — |
docs/bot-runs/vuln-watch.md | vuln-watch (Senti) — run log | a model receives; the run on a bare scratch refused at plan. | — |
docs/bot-runs/whats-next.md | Nexie — whats-next run bilans | Conversational co-CTO (v3: ONE agent in a chat loop — board intelligence, | — |
docs/bot-runs/whole-improve-loop.md | Willy — whole-improve-loop run bilans | Whole-repository improvement loop (ADR-058 v2). | — |
docs/bot-runs/wiki-gen.md | wiki-gen (Wikky) — run bilans | Wikky generates and incrementally maintains a navigable, Open-Knowledge-Format | — |
docs/brand.md | Brand — the iterion-bot mascot, everywhere iterion shows a face | The mascot on the official iterion-bot | — |
docs/browser-pane.md | Browser pane | The run console's Browser tab renders web content tied to a workflow | — |
docs/browser-security.md | Browser security posture — CORS, CSRF, cookies, CSP | What protects the studio from the browser side: which cross-origin requests | — |
docs/bundles.md | Bundles — .botz packaged workflows | A bundle is a deterministic ZIP archive that ships a workflow | — |
docs/byok.md | BYOK API keys (cloud) — per-org, per-user, per-webhook | How iterion-cloud resolves the LLM provider API keys a run uses. | — |
docs/c082-board-emit-fix-plan.md | C082 board-emit fix — implementation plan | Status: **RESOLVED + live-validated end-to-end (2026-06-14), cloud half | — |
docs/changelog.md | — | — | — |
docs/changelog/v0.md | Changelog — v0.x | Archived releases. | — |
docs/changelog/v1.md | Changelog — v1.x | Archived releases. | — |
docs/changelog/v2.md | Changelog — v2.x | Archived releases. | — |
docs/ci-performance-buildkit-operator.md | CI performance — buildkit-operator migration (measured) | Evidence file for the image.yml migration to | — |
docs/ci-pipeline-topology.md | CI image pipeline — topology | The image workflows are split so that **each deployable artifact's workflow | — |
docs/cli-permission-seam-spike.md | Spike — the permission seam on the grok and kimi CLI backends | grok and kimi the permission seam pi already has (C176 locks CLI forfaits out of | — |
docs/cli-reference.md | CLI reference | This page maps every public top-level command in the current binary and documents the common operational flags. | — |
docs/cloud-admin-guide.md | Iterion Cloud admin runbook | multiple teams and the org admin who manages their team inside it. | — |
docs/cloud-admin.md | Iterion cloud — operator guide | This guide covers everything you need to run an iterion cloud | — |
docs/cloud-architecture.md | Cloud architecture | multi-tenant platform — to debug a stuck run, design an integration, | — |
docs/cloud-backup.md | Cloud — Backup & Restore (Mongo + Blob) | This runbook covers the durable state iterion owns in cloud-mode: | — |
docs/cloud-cli.md | Cloud CLI — iterion remote | iterion remote turns the local CLI into a full client for a remote | — |
docs/cloud-deployment.md | Cloud deployment | This document is the operator runbook for the cloud-mode topology | — |
docs/cloud-llm-credentials.md | Cloud LLM credentials — provisioning a cloud run's model access | How a cloud run (queue → runner pod) gets its LLM credential, and how to | — |
docs/cloud-overview.md | ☁️ Iterion Cloud — the multi-tenant control plane for AI agents | platform engineer about to helm install, a tech-lead choosing between | — |
docs/cloud-public-exposure-checklist.md | Cloud — public exposure checklist | This page is a pre-flight checklist for opening an iterion deployment to traffic outside your private network (i.e., putting it behind… | — |
docs/cloud-queue-schema-rollout.md | Queue schema rollout runbook | How to ship a queue.RunMessage schema bump (pkg/queue/types.go, | — |
docs/cloud-rest-api-generated.md | Cloud REST API — generated inventory | The freshness and two-way gates of pkg/server/docs_rest_inventory_test.go fail on drift. | — |
docs/cloud-rest-api.md | Cloud REST API reference | SDK author, an operator writing curl runbooks. | — |
docs/cloud-troubleshooting.md | Cloud troubleshooting | Symptoms-first reference for operators running iterion in cloud mode (Helm chart, docker-compose, or any setup using Mongo + NATS +… | — |
docs/cloud-user.md | Iterion cloud — user guide | You signed up for an iterion workspace (or got an invite). | — |
docs/cloud.md | Cloud Mode | Cloud mode runs iterion as a multi-tenant control plane for AI agents — the | — |
docs/comparisons/assets/logos/README.md | Logo and icon provenance | Original assets retrieved on September 11, 2026, stored locally without graphical modification. | — |
docs/comparisons/feature-inventory.md | 🧭 Iterion feature inventory | September 11, 2026 · Capabilities, use cases and limitations of the reviewed version. | — |
docs/comparisons/feature-matrix.md | 🧭 Iterion and alternatives — feature matrix | Documentation reviewed on September 11, 2026. | — |
docs/comparisons/index.md | 🧭 Iterion and alternatives: choose your agent workflow architecture | Updated September 11, 2026. | — |
docs/comparisons/methodology.md | 🔎 Comparison methodology and sources | September 11, 2026 — companion to the feature matrix. | — |
docs/config-share.md | Scoped config-share editor | The config-share editor lets an operator hand a non-operator a bookmarkable | — |
docs/connector-identities.md | Connector identities across regeneration | iterion connectors gen maintains identity.lock.yaml beside connector.yaml. | — |
docs/credential-pool.md | Credential pool — mutualising contributors' unused LLM capacity | How developers lend spare LLM capacity to an iterion deployment — a Claude | — |
docs/current-bot-models.md | Catalog model defaults and deployment | As of September 2026, catalog Anthropic routes default to claude-opus-5-5. | — |
docs/current-state.md | Current state of Iterion | _A living, as-built snapshot maintained against main — the page footer shows | — |
docs/cursors.md | Prompt-engineering cursors | Cursors are framing dials, not gates. They adjust the tone and | — |
docs/delegation.md | Delegation | Iterion can mix lightweight in-process calls and full coding-agent CLIs in one | — |
docs/desktop-architecture.md | Iterion Desktop — Architecture | The desktop build is a thin native shell wrapped around the existing | — |
docs/desktop-build.md | Building the Iterion Desktop app | Iterion ships an optional desktop wrapper built with Wails v2. | — |
docs/desktop-distribution.md | Iterion Desktop — Distribution | Pushing a v* tag triggers two GitHub Actions workflows in parallel: | — |
docs/desktop-qa-checklist.md | Desktop — release QA matrix | This is the per-platform sign-off sheet the team walks before tagging a desktop release. | — |
docs/desktop-qa.md | Iterion Desktop — QA Checklist | Walk this list before tagging a release. | — |
docs/desktop-release-checklist.md | Desktop — release checklist | Walk this checklist before pushing a desktop-v* (or v* if CLI + desktop release together) tag. | — |
docs/desktop.md | Desktop App | A native desktop build (Wails v2) wraps the visual editor in its own window with multi-project switching, OS-keychain credential storage,… | — |
docs/development.md | Development | This page is for contributors to Iterion itself. | — |
docs/diagrams/README.md | Diagrams | Entity-relationship models of the MongoDB data and the access-control matrix, drawn from the code. | — |
docs/diagrams/access-control.md | Access control — who may do what | This page maps who may do what: the principals a credential resolves to, the gates that admit or refuse them, and the standing in a team or… | — |
docs/diagrams/data-model-automation.md | Data model — automation surfaces | The trigger spine that turns a board event into a bot launch, the two surfaces that fire a bot on a clock, and five things a multi-replica… | — |
docs/diagrams/data-model-credentials.md | Data model — credentials, metering and routing policy | Seventeen Mongo collections hold what funds a run: a credential sealed at rest, the connector alias a workflow addresses it by, the bundle… | — |
docs/diagrams/data-model-forge-bots.md | Data model — forges, repositories and bots | Enabling a bot on a repository binds it in two documents — the webhook config that enforces the binding first, the integration row that… | — |
docs/diagrams/data-model-identity.md | Data model — identity and tenancy | A team id is the tenant of almost every resource an iterion deployment stores, a team belongs to at most one org, and the credentials a… | — |
docs/diagrams/data-model-knowledge.md | Data model — memory, config shares and notifications | Three slices of a tenant's own content: the knowledge spaces bots and people share, the scoped config-edit grants a non-operator holds, and… | — |
docs/diagrams/data-model-runs.md | Data model — runs and their satellites | A run is one execution; this page draws its per-run streams, its tree, the collections its launch and its outcome bind it to, and its… | — |
docs/diagrams/erd-complete.md | The complete ERD — every collection, one diagram | The whole Mongo data model in a single entity-relationship diagram: every collection plus the marked non-Mongo participants, and every… | — |
docs/diagrams/flow-assistant-dock-session-board.md | Flow — the assistant dock, run watches and the session board | Three assistant surfaces meet at one seam: a bot's chat manifest declares a human pause with two doors, one for the operator's typed text… | — |
docs/diagrams/flow-auth-login.md | Flow — signing in and authenticating a request | Six families of credential reach the iterion cloud API, and each one either converges on the single function that mints a session or on the… | — |
docs/diagrams/flow-board-dispatcher.md | Board dispatch | A board card becomes a run when one dispatcher tick walks it through a gauntlet of guards, claims it under a fenced lease, hands its bot to… | — |
docs/diagrams/flow-bot-resolution-overrides.md | Bot resolution — team row, platform override, baked catalog | Every site that turns a bot id into launchable source walks three tiers in one order — the launching team's own stored bundle, then the… | — |
docs/diagrams/flow-bot-to-running-graph.md | From a .bot to a running graph | A .bot file, a .botz bundle or a bundle directory becomes a running graph through one compile path and one engine, whichever door… | — |
docs/diagrams/flow-cloud-run-lifecycle.md | Cloud run lifecycle | A cloud run is admitted once by the server, persisted as a queued document before anything is published, carried to a runner pod as a… | — |
docs/diagrams/flow-config-share.md | Flow — config-share: the mint, the two access paths, the fail-closed write | A config-share is one grant that lets a non-operator edit a declared allow-list of fields in one JSON file of one repository — through a… | — |
docs/diagrams/flow-credential-resolution.md | Credential resolution — which credential funds a cloud run | Every cloud launch and every resume walks the same seven tiers to decide which LLM credential funds the run, then seals what it found under… | — |
docs/diagrams/flow-forge-connect-enable-bot.md | Flow — connect a forge, enable a bot on a repository | Connecting a forge seals one credential for a team, and enabling bots on a repository derives a managed token from that credential, then… | — |
docs/diagrams/flow-memory-knowledge.md | Flow — memory and knowledge: four writers, one seam, two adapters | A memory space is a quota-governed tree of Markdown documents addressed by a visibility and the qualifiers that visibility needs, and the… | — |
docs/diagrams/flow-notifications-callbacks.md | Flow — notifications and callbacks: one outcome event, three outbound families | A run that pauses or terminates publishes one outcome event, and three independent outbound families read it — a browser push to the… | — |
docs/diagrams/flow-org-team-lifecycle.md | Flow — org and team lifecycle: suspend, soft-delete, purge | An org and the teams under it share one status field written by different callers, and only an org can be scheduled for deletion and then… | — |
docs/diagrams/flow-pause-resume-rewind.md | Pause, resume and rewind | A run parks durably when a question needs a person or an operator stops it, comes back through a ladder of refusals whose surface verdicts… | — |
docs/diagrams/flow-revi-review-merge-gate.md | The revi/review merge gate | A reviewer bot's findings are advice; what blocks a merge is a deterministic commit status on the pull request head, written by six writers… | — |
docs/diagrams/flow-sandbox-isolation.md | Flow — sandbox isolation | A four-tier precedence picks one of four sandbox modes, a host-kind factory picks a driver, and then the mode alone decides what an absent… | — |
docs/diagrams/flow-secrets-sealed-bundle.md | Flow — the sealed credentials bundle | A cloud run's credentials travel in two halves that never share a channel: the sealed bundle waits in Mongo under a random ref, and the… | — |
docs/diagrams/flow-triggers-and-schedules.md | Flow — triggers and schedules: five sources, two deliveries, three clocks | A stored binding becomes a run when an event matches it or its clock comes due, through one matching prelude, one of two deliveries, and… | — |
docs/diagrams/flow-webhook-to-run.md | Flow — webhook-to-run: the admission gates, every refusal, and the one chokepoint | An inbound forge or CI delivery becomes a run by crossing an authenticating middleware, a provider handler's ordered refusals and one… | — |
docs/dispatcher.md | iterion dispatch — long-running dispatcher | The dispatcher turns iterion from a one-shot iterion run into a | — |
docs/dsl-totality-and-tc.md | DSL totality, Turing-completeness, and the static-predictability surface | This page is the canonical answer to two questions that sound opposed but are | — |
docs/dsl-whats-new.md | What's new in the .bot DSL — the authoring-first programme (2026-09) | Between v3.128.0 and v3.154.0 the DSL, its tooling and its documentation were | — |
docs/dsl.md | 🧩 The .bot DSL | Source files end in .bot; deterministic bundles end in .botz. | — |
docs/e2e-coverage-matrix.md | E2E coverage matrix | The single feature×coverage inventory for iterion. | — |
docs/e2e-stabilisation-plan.md | E2E stabilisation plan — per surface | recorded below with the decision that settles each; the order is fixed and | — |
docs/e2e_coverage.md | E2E coverage matrix | Where each iterion + claw-code-go feature is exercised. | — |
docs/environment-variables.md | Environment variables | Operational ITERION_* environment variables read directly by the engine | — |
docs/examples.md | 🤖 Bots and examples | Iterion ships a maintained fleet of production bots — a co-CTO, a feature | — |
docs/forge-conversations.md | Forge conversations — replying to the bot (forge threads → run → in-thread reply) | How an authorized forge user "talks back" to a bot (reply to its review, | — |
docs/forge-integrations.md | Forge integrations (connect a repo, auto-provision) | bot (e.g. | — |
docs/forge-permissions.md | Forge permissions & identity — who a bot acts as | This is the model people most often get wrong: **the iterion user who launches | — |
docs/forge-security-read.md | Forge security-read — org-wide Dependabot alerts for bots | The security-read flow gives a bot read access to a GitHub org's | — |
docs/getting-started.md | Get started with Iterion Cloud in one prompt | Paste one prompt into your AI coding agent and it installs Iterion, connects it to iterion.cloud, and verifies readiness to deploy. | — |
docs/github-board-sync.md | GitHub project board ↔ native board sync | Making a GitHub Projects v2 board (the roadmap humans read) and iterion's | — |
docs/gitops-warden-rollout.md | gitops-warden — binding, calibrating, and flipping a repo to enforce | The runbook for gitops-warden | — |
docs/grammar/V1_SCOPE.md | Current scope of the V1 grammar and AST | The filename and grammar version remain V1 for compatibility: Iterion has | — |
docs/groups-iteration-subbots.md | Reuse & iteration: groups, foreach, subbots | This page documents the composition + iteration constructs added on top of the | — |
docs/human-in-the-loop.md | Human in the loop | Most iterion nodes run unattended. | — |
docs/import.md | iterion import — workflow scripts (.js) → draft .bot | iterion import converts a Claude-Code workflow script | — |
docs/improvement-ratchet.md | The ratchet | open. | — |
docs/index.md | — | The cloud onboarding, ready to paste: give the whole block below to a fresh | — |
docs/install.md | 🖥️ Install | One Go core, delivered wherever you work — a scriptable CLI, a visual studio, a | — |
docs/layering.md | The layer map — package layers as an executable guard | The package layers are pinned by a test, not by prose: | — |
docs/legal-templates/README.md | Legal page templates | The four markdown templates an operator fills in — with their DPO and | — |
docs/legal-templates/accessibilite.md | État de conformité | à l'article 47 de la loi n° 2005-102 du 11 février 2005. | — |
docs/legal-templates/cgu.md | Objet | Les présentes conditions générales d'utilisation (CGU) encadrent l'accès | — |
docs/legal-templates/confidentialite.md | Responsable du traitement | Le responsable du traitement des données à caractère personnel collectées | — |
docs/legal-templates/mentions-legales.md | Éditeur | Le service <nom du service, p. | — |
docs/live-e2e-coverage.md | Live e2e coverage + quality/value snapshots | iterion ships an optional, real-LLM end-to-end layer that exercises | — |
docs/mcp-server.md | The iterion MCP server — iterion mcp | iterion mcp serves the operator-facing MCP server on stdio: any | — |
docs/memory-and-knowledge.md | Memory and knowledge spaces | memory_write / memory_list), org admins enforcing a quota on | — |
docs/merge-gate.md | Merge gate — Revi arbitrates, determinism disposes | Revi (bots/review-pr) can post a deterministic merge-gate status on a | — |
docs/merge-policy.md | Merge policy — main is protected by a merge queue | main is guarded by a GitHub merge queue (ruleset "main protected — merge | — |
docs/models.md | 🧠 The model registry, and choosing which model runs | Two questions this answers, both of which used to have no answer at all: | — |
docs/native-tracker.md | Native kanban tracker | Iterion ships with a first-class issue tracker — no Linear, no GitHub | — |
docs/notifications.md | User notifications (web push) | Iterion cloud can notify a user through the browser when one of their | — |
docs/oauth-forfait.md | OAuth forfait (consumer subscription) for cloud runs | Iterion can drive bot runs on a consumer subscription — a Claude | — |
docs/observability.md | Observability — logs, error tracking and tracing | iterion's observability layers answer different questions: | — |
docs/observability/README.md | Iterion observability stack | A self-contained docker-compose stack that gives you Grafana dashboards | — |
docs/outbound-callbacks.md | Outbound run-completion callbacks | A run-completion callback lets an external integration trigger an | — |
docs/outcome-router.md | The outcome router — ITERION_OUTCOME_ROUTER | The instance-side answer to "a run produced work and nobody routed it": a | — |
docs/permissions.md | Tool-permission gate (anti-prompt-injection) | iterion's permission gate restores Claude Code's default **"ask before | — |
docs/persisted-formats.md | Persisted formats — V1 reference | This page describes the filesystem run store. | — |
docs/philosophy.md | Philosophy | explains how we decide when a design question is open — the stance the | — |
docs/platform-bots.md | Platform bot overrides — DB-backed bots, no rollout | The bot catalog (bots/) is baked into the server and runner images, so | — |
docs/plugins.md | Plugins | Iterion's plugin ecosystem lets you extend the runtime with **declarative, | — |
docs/post-mortem-shell.md | Post-mortem shell | Open an interactive shell inside a run's preserved worktree, from | — |
docs/privacy_filter.md | Privacy Filter | Iterion ships two complementary built-in tools that detect and redact | — |
docs/probes-and-graceful-shutdown.md | Probes and graceful shutdown | How a k8s deployment of iterion answers is this pod alive, *should it | — |
docs/quickstart.md | 🚀 Quickstart | For developers who already live in AI coding tools. | — |
docs/quotas-and-limits.md | Quotas and limits | set on a paying org, or debugging "why did this run get denied". | — |
docs/recipes.md | Recipes | A recipe pins one .bot to a named configuration — preset vars, prompt overrides, a budget, and a success metric — so you can… | — |
docs/references-bootstrap.md | References bootstrap — deepsec + harness clones | Seki's external-security-tools skill uses a local references directory | — |
docs/references/author-schema.md | The author document — keys and values | An author document (x.bot.yaml) is the YAML twin a .bot can be written as: the same declarations under the same names, with YAML's own… | — |
docs/references/context-retrieval-state-of-the-art.md | Context retrieval — the state of the art, mapped onto iterion | or an embedding store — for the agents that work on this repository, or | — |
docs/references/diagnostics.md | Iterion DSL — Validation Diagnostics | All diagnostic codes emitted during compilation (ir.Compile) and validation (ir.Validate), plus the bundle-consistency codes (C2xx)… | — |
docs/references/dsl-authoring-probe.md | The authoring probe — measuring "right the first time" | The programme behind the DSL registry, the skill and the template gallery | — |
docs/references/dsl-grammar.md | Iterion .bot grammar reference | This is the readable inventory of the syntax accepted by the current parser. | — |
docs/references/dsl-properties.md | Iterion .bot property reference | The same iterion dsl spec --write command generates Monaco's lexical | — |
docs/references/external-methodologies.md | External Methodologies Cross-Check — IACDM & AI-DLC 2026 | Two independent 2026 methodology papers mapped onto iterion's mechanisms: | — |
docs/references/map-bots.md | Bot and skill map | Run task map:gen and commit; task map:check fails on drift. | — |
docs/references/map-docs.md | Docs and ADR map | Run task map:gen and commit; task map:check fails on drift. | — |
docs/references/map-packages.md | Package map | Run task map:gen and commit; task map:check fails on drift. | — |
docs/references/patterns.md | Iterion DSL — Common Workflow Patterns | Reusable patterns for building .bot workflows. | — |
docs/references/productive-session-patterns.md | Productive-Session Patterns | What a productive human-driven agent session actually looks like — measured, | — |
docs/references/workspace-service.md | Shared local workspace service | Local development uses one per-user service, iterion-workspace.service, for | — |
docs/repo-map-and-graph.md | The repository map and graph | this tree, and a bot author who wants a workflow to orient itself without | — |
docs/repo-scope.md | Repo-first studio — the repository scope | Cloud-mode studio reads Org → Repo: below the organization switcher, | — |
docs/resume.md | ⏯️ Resume paused, failed, and cancelled runs | A run in iterion is durable: it can pause for a human, fail, or be cancelled, | — |
docs/revi-billy-loop.md | Revi → Billy on this repo — PAUSED, and how to run a deliberate pass | When Revi (bots/review-pr) reviews a pull request of this repository and | — |
docs/revi-rollout.md | Revi on GitHub — App binding and rollout runbook | Bind review-pr (Revi) to one GitHub repository through a team GitHub App | — |
docs/review-merge-gate.md | Review-&-merge gate (interaction: review) | A review-&-merge gate is a human node that walks the operator through | — |
docs/review-scope.md | 🔍 What a review gate shows | A human gate approves work. | — |
docs/reviews/codebase-2026-05-17.md | Iterion codebase review — 2026-05-17 | Author: deep review pass on main at commit baa68ab8. | — |
docs/reviews/impl-provenance.md | impl-provenance — delivery evidence | Worktree run-provenance, branch leap/run-provenance. | — |
docs/reviews/reliability-audit-2026-08-31.md | Reliability audit 2026-08-31 — traceability matrix | Source: full-repo reliability inventory (docs + dogfood bilans + code) verified item-by-item | — |
docs/routers.md | Routers | Routers are the branch points of the graph — the difference between a linear script and a real workflow. | — |
docs/sandbox.md | 🛡️ iterion sandbox | The sandbox is the boundary that makes autonomous agents safe to run: every | — |
docs/scheduling.md | Scheduling recurring bot runs (iterion schedule) | Some bots are meant to run on a clock, not on demand — a weekly | — |
docs/secrets-reference.md | Secrets reference | own account, the team, a bot binding) and operators reviewing the | — |
docs/secrets.md | Secrets protection | Iterion runs agents that can be prompt-injected (the sec-audit bots read | — |
docs/security-bots-distributed.md | Distributed security scans — design (Cap. | sec-audit-source V1 is single-process: one iterion run reads every | — |
docs/security-bots.md | Security bots — sec-audit-source (Seki) + sec-audit-deps (Depsy) | This page covers the two manual audit bundles — CLI-launched, | — |
docs/security-patcher.md | Seki — verification-ladder remediation (security-patcher) | Seki's remediation phase turns each confirmed finding into a verified | — |
docs/security/forge-cloud-audit-2026-07-01.md | Forge / cloud security audit — least-privilege (2026-07-01) | (GitHub first), the OAuth-app store, repo provisioning, and the credentials | — |
docs/sentry-feedback-loop.md | Sentry feedback loop — reading production errors back into development | server/runner/dispatcher send to Sentry (panics, fatal exits, error logs, run | — |
docs/session-board.md | Session board (per-run Tasks tab) | The Session board is a per-run view in the studio run console — the | — |
docs/settings-precedence.md | Settings precedence & provenance | Five launch-relevant knobs share the same five-level precedence chain, | — |
docs/skill.md | AI Agent Skills | Iterion ships two Agent Skills, compatible with Claude Code, Codex, Cursor, Windsurf, GitHub Copilot, Cline, Aider, and other AI coding… | — |
docs/skills-library.md | Skill library | The skill library is a curated, standalone collection of Claude-Code-style | — |
docs/sovereign-pools.md | Sovereign runner pools | A team whose code must never reach a public LLM vendor runs on a **sovereign | — |
docs/stall-human-waits.md | Human waits and stall detection | The dispatcher and runview alert manager both consult | — |
docs/state-of-the-art.md | State of the art — how proven is each surface | backends.md and board-epics.md, and a leading emoji slugs differently on | — |
docs/studio-ux-audit-2026-07.md | Studio UX coherence audit — 2026-07 | Snapshot of the systematic UX audit run against the studio (cloud-first | — |
docs/supervisors.md | Supervisor agents | A supervisor is an LLM agent that watches another running agent and | — |
docs/test-capability-ledger.md | Test capability ledger | Generate the skip and sleep census from the working tree, without running tests | — |
docs/test-process-cleanup.md | Test helpers end with their test | Issue #956 exposed a sentinel loop in the dispatcher subbot lock fixture: | — |
docs/test-waits.md | Waiting for engine state in tests | Issue #930 separates the condition a test asserts from how quickly its host can | — |
docs/thinking-metrics.md | Thinking (reasoning) metrics | Iterion surfaces two per-node extended-thinking metrics for LLM nodes: | — |
docs/ticket-context.md | Ticket conformance — plugging tracker tickets into a review | Revi (bots/review-pr ≥ 0.6.0) can verify that a PR actually delivers | — |
docs/tool-name-aliases.md | Claw tool-name aliases | Claw accepts the exact spellings Read, Bash, and Grep as read_file, bash, | — |
docs/ultracode.md | Ultracode | reasoning_effort: ultracode is the highest setting on the effort dial. | — |
docs/upstream/claude-code-positional-args-2-1-220.md | $1–$9 in project commands resolve one position early — draft upstream report, not… | Measured evidence for iterion issue #1713 across Claude Code 2.1.220 and 2.1.282: the CLI substitutes $N zero-based and did not change,… | — |
docs/url-layout.md | URL layout — what answers at the root, and what lives under /studio | A deployment serves two things from one origin: the product home and the | — |
docs/usage-caps.md | Usage caps — stop below the provider's wall | An LLM subscription ("forfait") meters two rolling windows, five hours and | — |
docs/visual-editor.md | Visual Editor (web) | Iterion includes a browser-based visual workflow editor built with React and XYFlow. | — |
docs/web-search.md | Web search & fetch | How agents discover and read the web in iterion. | — |
docs/webhooks.md | Inbound webhooks | and operators reviewing the auth + rate-limit + audit story before | — |
docs/webhooks/retry.md | Webhook receipts and launch retries | A claimed inbound delivery answers 202 with | — |
docs/why-iterion.md | Why Iterion? | Organisations are about to run fleets of AI agents — reviewing code, shipping | — |
docs/why-not-prompt-orchestration.md | Why not just prompt-orchestration? | A recurring question when someone first sees Iterion is: *"why a DSL? Can't I get the same thing with a single Claude Code session that… | — |
docs/workflow-reliability-1006.md | Workflow reliability rollout (#1006) | This document is the compatibility ledger for the reliability work. | — |
docs/workflow_authoring_pitfalls.md | Workflow Authoring Pitfalls | Hard-won lessons for authoring .bot workflows where LLM agents do real work | — |
docs/workspace-versioning.md | 🗂️ Workspace versioning | A node's real work is often not in its output. | — |
docs/worktree-pool.md | The worktree pool and its bound | A worktree: auto run executes in a fresh git worktree under | — |