A cloud bot clones your repo, fixes the issue with your own Claude subscription, and opens a proven PR on a heimdall/* branch. You review. You merge. No shared keys. No self-merge.
Nothing ships unproven.
Prereqs, once: install Heimdall (below), install the GitHub App on your repo, and run claude setup-token for your own Claude credential. Then:
rr at the control planerr setup --mode control-plane --endpoint <endpoint> --enroll-token <enroll-token>Writes your mode + endpoint. The enroll token is a one-time bootstrap credential your admin hands out — never your signing key.
heimdall-presence beatGenerates a local Ed25519 keypair and enrolls it. From here on, every request you send is signed — the server derives your team_id from the signature, so you never send it.
rr connect --gh-app-installation-id <id> --repo <owner/repo>Two signed POSTs: your Claude credential (write-only, into your team's own Secret Manager partition) and your GitHub App installation. The bot works with your tokens, on your repo.
The maintainer clones, fixes with your Claude sub, and opens a PR on a heimdall/* branch. It cannot push to main and it cannot merge — that's yours.
Not a diff dumped over the wall — a reviewable PR with runnable evidence and an honest attestation. The autonomy ends at the merge button.
Every request is Ed25519-signed and the team_id is derived server-side — a client cannot claim another team. Each team's Claude cred lives in its own Secret Manager partition, under a per-team daily spend cap. The public surface is enqueue-only and provably cannot dispatch. We wrote a cross-tenant attack oracle — six mutant attacks, each a real breach attempt — and it kills 6 / 6 = 1.0.
Heimdall puts verification gates in front of AI coding agents: every change ships behind an external, falsifiable oracle that must be proven able to go red before it's trusted green. A gate that can't fail proves nothing.
Every fix wires a check the implementation can't satisfy by claiming success. It's written so it can actually fail — no test that cannot go red.
The PR ships only on a gate-PASS: deterministic checks that go red on failure, not the model's say-so. The verdict rides along as evidence.
The gates decide with falsifiable checks; the model does the reasoning and generation. Prove with tools, reason with the model.
The maintainer opened its first autonomous PR end-to-end on real Cloud Run + Firestore — a gate-PASS fix a human merges. Behind it: the isolation oracle, the reuse engine measured on 8 cold repos against a frozen rubric, and the open bring-up ladder — 29 real bugs, found and fixed before that PR.
Every fix — the bot's or your own — runs the same gates before it can ship. Each item below is a shipping binary, grouped by what it guards.
--no-verify →Visual-parity gate for React Native screens — your build scored against the design canonical. /hmd:designmatch
Reuses existing code instead of reinventing it — the part measured to generalize on cold repos.
Runs measured keep/discard experiments on its own routing — the parts that don't help get cut.
hmd --team NSpawn N parallel Claude workers on one task, locally.
The watchman HUD self-bootstraps for every teammate on SessionStart — no manual config — and renders across any terminal (Warp, iTerm2, Terminal.app, tmux, screen, VS Code, kitty, Alacritty) via capability tiers (truecolor → 256 → plain).
rr drives the cloud maintainer; hmd runs the gates and swarm on your own machine.
A presence wall for your team: who's online, what each watchman is verifying, the file they're on, and how fresh the last beat is. Scoped to the teams you belong to — nothing else.
The page shows a one-time device code — run hmd dashboard login <code> in a terminal where hmd is signed in, and your local HAID key proves who you are. No password, no pasted secret: the browser only ever holds a short-lived, server-scoped session token — never a team secret.
One line installs the CLI that gives you rr, hmd, and the gates. Pinned to a release tag, so what you read in the source is exactly what runs. The gates run local; the cloud maintainer only ever holds your own credentials, in your own partition. Remove it with hmd uninstall.
Free while we prove it — no plans, no cards. Heimdall is free while we earn your trust.
curl -fsSL https://raw.githubusercontent.com/randomittin/heimdall/v2.0.16/install.sh | bash
A credible roadmap signals direction. None of the below is in the current build — it's here, fenced, on purpose. Recently landed: the first autonomous PR proven end-to-end, multi-tenant rr on a live control plane, per-team BYOC with daily spend caps, the cross-tenant isolation oracle, presence opt-out (per-repo + global invisibility), and the self-bootstrapping statusline — now shipped, no longer roadmap.
A front door that vends a bounded enroll token, so a team can onboard without an admin handing one over. Today: admin-issued tokens.
rr status <task-id> reading the live queue + PR state, so you never poll blind.
Proposes and performs the cut, not just flags dead code.
Multiple humans on one project, with shared state and conflict awareness. Today: N parallel workers + coordination ledger.