▍ stado / brand 01
stado is a sandboxed, git-native coding agent for the terminal. Sessions live in a sidecar repo until you explicitly land them. Every tool call is committed to a signed audit log. Tool execution is capability-gated through the OS sandbox.
Streaming responses. Bundled tools. Every read, edit, and shell invocation lands as a signed commit on the session's trace ref.
Agent state lives outside your working tree. Landing is always explicit.
No unsigned commits, no un-logged tool calls, no "trust us."
Capabilities declared in the manifest. The kernel — not a promise — keeps tools in their lane.
Thinking blocks, prompt caching, provider-native features round-trip verbatim.
Bundled and installed applications share a capability-gated ABI in wazero. Bundled modules are trusted embedded release assets; installed plugins require signature, trust-store, digest, and canonical-identity verification. The stado-owned native model-tool allowlist is empty; the exact external MCP adapter is not a native product application.
The accepted design launches bounded research agents for long investigations and keeps their context isolated. Its official replacement package is not shipped until signed, published, installed, and release-verified.
read the design →Retain useful workers, supervise their lifecycle, and coordinate through durable mailboxes instead of losing every collaboration when a prompt finishes.
Accepted direction: shadow-rank authorized context under hard budgets before any adaptive policy changes prompts. Ranking, reports, signing, and publication remain unfinished.
read the design →Staged unsigned source reviews bounded evidence into candidates only. Fresh activation awaits a separately trusted presenter; commands and UI callbacks cannot approve artifacts.
read the design →Project objectives, blockers, decisions, corrections, and deterministic mistake signals into durable state that humans and agents can query directly.
read the design →Crash-safe events, explicit budgets, replayable delivery, and shared supervision state give agents and automations one durable coordination backbone.
durable substrate →Configured verification commands run before completion and record their evidence. The broader independent-judge design remains intentionally deferred.
read the design →Constrained Lua hooks can inspect, deny, and mutate lifecycle events while stado keeps tool execution, capabilities, and enforcement inside the native harness.
hook contract →Host facts say what is available and what happened. WASM application policy decides when to research, retain, learn, and coordinate without gaining tools, audit, approvals, or sandbox authority. Native stado contains no guidance wording or fallback.
read the guidance → placement correction →/supervise belongs to the official WASM lifecycle application under foobarto/stado-plugins/supervise: it owns contract flow, cadence, detectors, prompts, and verdict policy while the broker supplies authenticated facts and enforces scoped holds, pause, and stop. Native stado has no fallback. Offline-key-signed release supervise/v0.1.1 is published for stado 0.80.0 and newer and must be explicitly installed and enabled.
Sessions live as a sidecar bare repo with per-session tree and trace refs that grow with every turn. The history is a branching graph you can walk, resume, search, and replay — not a flat chat log. Rewind to any earlier turn into a fresh session; the parent is never modified.
* turns/6 edit CHANGELOG.md a1f2…cc91 * turns/5 bash pnpm test useScroll 9b8e…2701 * turns/4 edit src/hooks/useScroll.ts 3c4d…f80a │ ╲ │ ╲── fork → session a4e1b0 (--at turns/4) │ * turns/4' alt: useSyncExternalStore │ * turns/3 grep "useScroll" — 7 sites 6e21…0042 * turns/2 read useScroll.ts f9aa…b1c4 * turns/1 session start 0000…7a3f
Stado core is the runtime, capability sandbox, and signed-distribution lifecycle. fs.read, shell.bash, web.fetch, rg.search — even auto-compact — ship as signed WASM plugins. Don't like one? Rewrite it in any language that targets wasm. Stado-owned native model-tool registration debt is empty; explicit lifecycle applications own larger workflows.
Tool execution is gated through real OS sandboxing — not a promise the agent makes about itself. Subprocess networking is mediated through a CONNECT-allowlist proxy in a private netns; plugins run inside wazero with capabilities declared in the signed manifest.
| os | subprocess sandbox | status |
|---|---|---|
| linux | landlock · bubblewrap · seccomp BPF · pasta CONNECT proxythe supported current and v1 platform; sandboxed by default | ▮ shipped |
| wasm | wazero with manifest-declared capabilitiesfs:read · fs:write · net:<host> · exec · env | ▮ shipped |
stado mcp-server exposes your entire installed registry over stdio MCP. Mount it in Claude Code, Codex, or anything that speaks MCP — and inherit every plugin you've signed and trusted locally.
One curl. Cosign-verified manifest. Lands in ~/.local/bin by default.
curl -fsSL https://raw.githubusercontent.com/foobarto/stado/main/install.sh | bash
For folks who already trust the tap. Updates land through brew upgrade.
brew install foobarto/tap/stado
Go 1.26+. Pure Go, CGO_ENABLED=0. Bundled wasm tools are built at make time.
git clone https://github.com/foobarto/stado && cd stado && make
Release archives ship with checksums.txt.sig + checksums.txt.cert (cosign keyless, Rekor-logged) — the live verification path. The minisign airgap path is wired end-to-end in the release pipeline (pubkey embedded via ldflags + a CI signing step); it activates the moment the project's release key is provisioned, at which point stado verify --show-builtin-keys prints the embedded root offline and checksums.txt.minisig ships alongside each release.
Bubbletea. Streaming. Slash commands. Model picker. Theme picker. Explicit lifecycle applications.
stado run --prompt "…". With or without the audited tool loop.
Speaks Zed's Agent Client Protocol. Drive from your editor.
Run as a server (mcp-server) or consume capability-gated MCP servers via config.
Long-running daemon. Drive from any JSON-RPC 2.0 client.
Reproducible builds. Cosign-keyless signatures over a per-asset checksums.txt, Rekor-logged — the live path today. The stricter minisign airgap layer is wired into the pipeline (pubkey embedded via ldflags, plus a CI signing step) but is not provisioned for v0.80.x. Once its release key is provisioned, each release publishes checksums.txt.minisig and self-update verifies it without ever falling back to unsigned manifest verification — airgap-friendly. Audit the chain yourself.
Pre-1.0 and shipping fast. Open source. Built by people who didn't want to choose between agent velocity and a clean working tree.
For the Herd!
