Covert Coder

Sovereign AI software engineering. Local by default. Connected by choice.

A governed AI development workbench for local and connected models, bounded context, typed tool execution, verification, evidence, provenance, and operator-controlled automation.

Architecture · Local runtime · Privacy · Verification · Quick start · Engineering Preview · Contributing

Covert Coder is a local-first AI software-engineering environment built around one architectural rule:

Models are replaceable workers. They are not the authority.

The workbench is designed to coordinate the complete engineering transaction around intelligence: context selection, workflow, model identity, provider/runtime routing, tool execution, authorization, verification, provenance, replay, recovery, and persistent project state.

The goal is not another model-specific coding client. It is an operator-controlled development system that can use local inference, configured providers, or hybrid role assignment without moving trust into the model itself.

Your models. Your machine. Your workflow.

Covert Coder is the current public product identity. AIDE Sovereign Workbench is historical engineering lineage and still appears in older evidence, package metadata, and migration records.

The governed product loop is designed around one Resident surface with specialized worker roles behind it:

USER
  → RESIDENT ASSISTANT
  → CONTEXT CONTROL
  → WORKFLOW ENGINE + SKILL INTELLIGENCE
  → ORCHESTRATOR
  → MODEL ACCESS / ROLE ROUTING
  → EXECUTION AUTHORITY
  → RESOURCE ADMISSION
  → WORKER MODELS + TOOLS
  → VERITAS / VERIFICATION
  → GHOST / PROVENANCE
  → MISSION RECEIPT + MEMORY
  → RESIDENT
  → USER

Resident is the continuity and interaction surface.

Planner, Coder, and Reviewer are logical roles behind Resident. They are not required to be three separate chats or three simultaneously loaded physical models.

A constrained machine may assign one model to multiple roles. A larger system may assign distinct models. Hybrid configurations can eventually use local and connected models for different roles while preserving the same authority and verification boundaries.

The application topology separates browser UX, product routing, canonical backend ownership, and model runtimes:

flowchart LR
  UI["Browser Workbench<br/>:4173"] --> EDGE["Product Facade<br/>:4777"]
  EDGE --> TS["Canonical TypeScript Backend<br/>:4778"]
  EDGE --> LEGACY["Legacy Backend<br/>:4779<br/>migration inventory"]
  TS --> CAP["Workspace · Git · Terminal<br/>Tasks · LSP · DAP · Memory"]
  TS --> AUTH["Execution Authority"]
  TS --> MODEL["Model Access + Runtime Broker"]
  MODEL --> LOCAL["Local Runtime<br/>Unsloth V1"]
  MODEL -. "explicit opt-in" .-> CLOUD["Configured Provider"]

New user-facing behavior is expected to travel through the product facade and canonical backend. The legacy backend exists as migration inventory, not as a second product architecture.

See docs/ARCHITECTURE.md for route ownership and migration details.

Covert treats model selection as a chain of identities rather than a single string in a dropdown:

logical role
→ model identity
→ source / artifact identity
→ provider route
→ credential source
→ execution adapter
→ observed response identity

This prevents configuration from being mistaken for execution truth.

Selecting a model does not prove that model answered. A stored credential does not prove provider authentication. A provider health check does not prove an exact model route. A downloaded artifact does not prove runtime qualification.

Those states are intentionally separate.

A model-generated tool request is untrusted input until it crosses the applicable control boundaries.

model proposes tool
→ parse
→ schema validation
→ capability / policy evaluation
→ Execution Authority
→ operator policy / approval where required
→ execution
→ result
→ model continuation
→ verification
→ evidence

This separates four different questions:

1. Can the model describe the action?
2. Is the action structurally valid?
3. Is the action permitted?
4. Did the resulting work actually satisfy the engineering requirement?

Covert does not collapse those into a single “agent succeeded” state.

The active engineering preview has qualified Unsloth as the canonical V1 local runtime backend through the Runtime Broker boundary.

Direct llama.cpp remains an explicit reference/recovery path. It is not intended to become an invisible fallback when the primary runtime is unavailable.

The frozen qualification profile is deliberately narrow:

That exact profile passed bounded live qualification for:

• model discovery and exact artifact identity;
• authenticated and unauthenticated API behavior;
• non-stream inference;
• streaming;
• cancellation and recovery;
• invalid-request recovery;
• unload/reload;
• runtime interruption, restart, and reload;
• clean owned shutdown;
• one governed read-only tool path through Execution Authority.

The same profile completed a bounded 30-minute stability run with 23 interval ticks, 46 host-resource samples, 19 requests, and zero failures. The run included repeated inference, streaming, cancellation/recovery, unload/reload, and adapter-owned restart/reload behavior.

The detailed runtime evidence is maintained on the active convergence branch: Unsloth Runtime V1 closeout.

Covert keeps model lifecycle states explicit:

DISCOVERED
→ SELECTED
→ DOWNLOADING
→ VERIFIED
→ REGISTERED
→ ROLE_ASSIGNED
→ RUNTIME_QUALIFIED
→ READY

The product should not report READY because a filename exists, a manifest contains an entry, or a catalog lookup succeeded.

A registered model is not automatically qualified.

A selected model is not proof that the same identity produced the response.

The project includes daemon-side infrastructure for:

• Hugging Face search and repository-file discovery;
• explicit model downloads;
• resumable partial transfers;
• bounded retry;
• cancellation and cleanup;
• egress journaling before network activity;
• GGUF import and validation;
• hardware/model fit evaluation;
• runtime registration;
• model-role assignment foundations.

The active first-run work is converging those pieces into one transaction:

hardware + workflow
→ recommendation
→ operator approval
→ exact artifact
→ download
→ integrity / format validation
→ registration
→ role assignment
→ runtime qualification
→ persisted readiness

The objective is to remove unnecessary manual setup without removing operator control.

Covert is not designed to solve context management by sending the entire repository to every model.

The system separates:

• Context Control — bounded project context selection;
• Workflow Engine — durable engineering task structure;
• Skill Intelligence — procedural capability and methodology;
• Memory — scoped retained project/user state;
• Ghost / provenance — evidence and replay relationships between requests, actions, artifacts, and outcomes.

These systems are at different maturity levels. Public capability claims remain bounded by current evidence rather than architecture diagrams.

The current workbench includes or exposes infrastructure for:

• Monaco-based editing;
• workspace and filesystem operations;
• project search;
• Git;
• governed terminal/process execution;
• tasks;
• TypeScript LSP;
• Python DAP;
• model/runtime state;
• Resident;
• provider and model access state;
• memory;
• verification and evidence surfaces.

Covert is being built as one development environment rather than a loose collection of external chat and model-launcher windows.

Covert is local-first, not “network activity can never occur.”

The boundary is explicit:

• services bind to loopback by default;
• local models and local tools can operate without cloud-provider credentials;
• provider credentials are intended to remain daemon-side rather than browser state or logs;
• Model Hub search/download is an explicit network operation;
• configured online providers are explicit network operations;
• when an online provider is enabled, that provider receives the context selected for that request;
• imported models, plugins, dependencies, provider responses, and model-generated output are treated as untrusted inputs;
• privileged writes and tool actions remain subject to the applicable authority boundary.

Local inference is not dependent on a remote inference provider once the required local runtime and model artifacts are present.

For a fully disconnected environment, required runtime/model assets must already be present locally or supplied through an approved offline import path.

Read SECURITY.md before using Covert with private source or external providers.

Security vulnerabilities should be reported through GitHub private vulnerability reporting, not a public issue.

The public baseline intentionally uses conservative labels.

For the active status snapshot, see docs/ENGINEERING_PREVIEW.md.

Covert deliberately separates:

IMPLEMENTED
AVAILABLE
CONFIGURED
AUTHENTICATED
QUALIFIED
AUTHORIZED
EXECUTED
VERIFIED
READY

Those words are not synonyms.

The repository contains architecture tests, integration tests, acceptance checks, browser checks, Veritas tooling, evidence records, and exact-SHA CI.

The current HEAD is a documentation/evidence-only child of the preceding green code checkpoint and also passed exact-SHA CI.

One earlier aggregate Windows E2E failure remains preserved. The same code passed after host resource headroom was restored, which supports host contention as the failure category. The exact lower-level Windows scheduling/paging/I/O mechanism was not captured and is not claimed as proven.

A later green does not erase unexplained evidence.

Covert separates:

implementation ≠ availability ≠ qualification ≠ authority ≠ verification ≠ release acceptance

Relevant evidence surfaces include:

• common/ — shared contracts and generated API definitions;
• tests/ — unit, integration, architecture, and acceptance coverage;
• harness/ — model-independent verification and operating gates;
• docs/evidence/ — public evidence records where appropriate;
• capsules/ — portable runtime/evidence metadata;
• benchmarks/ — benchmark definitions and published results.

The default branch is intentionally more conservative than the active convergence branch.

• Git
• Node.js 26.4.0 — current pinned CI reference runtime
• npm
• a compatible local model/runtime if local inference is required

The package currently declares Node >=20. That declaration is not a certification that every Node 20+ release passes the complete verification path.

git clone https://github.com/AnonymousNomad/covert-coder.git
cd covert-coder
git switch covert-production
npm ci
npm run doctor
npm start

Open:

http://127.0.0.1:4173/

npm run doctor reports missing runtime binaries, model artifacts, and environment requirements. It does not silently download private assets, create execution authority, or enable an online provider.

Experienced testers can inspect the active convergence lane:

git fetch origin
git switch nightshift/production-convergence-20260926
npm ci
npm run doctor
npm start

Record the exact SHA tested.

Covert is entering controlled beta recruitment, not declaring V1 complete.

The remaining beta-entry work is primarily convergence between systems that already exist:

• first-run hardware/workflow profiling;
• recommendation → exact artifact → acquisition → integrity → registration → role assignment;
• clean Resident-model binding;
• governed local inference through the final first-user product path;
• connected-provider qualification;
• restart/recovery on the final beta candidate;
• clean-machine packaging/installer acceptance;
• upgrade/uninstall/state preservation;
• platform-specific gaps exposed by clean-machine testing.

The highest-value beta signal now comes from machines, models, and workflows that are not the development environment.

Covert is not intended to replace every local model server, chat interface, or AI coding product.

Projects such as llama.cpp, Ollama, LM Studio, Jan, Open WebUI, Continue, Codex, and other developer tools solve important parts of the stack.

Covert's boundary is different:

The runtime is infrastructure. The model is replaceable. The governed engineering system around the intelligence is the product.

The project focuses on combining model choice with context control, role routing, explicit authority, verification, evidence, provenance, and recovery inside one operator-controlled development environment.

The project follows an evidence-first operating discipline internally referred to as The Developer’s Way:

OBSERVE
→ PRESERVE
→ REPRODUCE
→ RESEARCH
→ ISOLATE
→ ROOT-CAUSE
→ REPAIR
→ REGRESSION
→ VERIFY
→ PROVE
→ RECORD
→ CONTINUE

Practical rules:

• do not weaken a test merely to obtain green;
• do not increase a timeout simply because a timeout occurred;
• do not convert UNKNOWN into READY;
• do not hide degraded state;
• do not silently fall back to another model/provider;
• do not treat a rerun as root cause;
• do not let documentation outrun evidence.

AI proposes. Evidence decides. The operator owns the final technical claim.

Typical development checks include:

npm run check:arch
npm run build:frontend
npm run test:e2e
npm run veritas

The repository also contains focused acceptance, runtime, browser, integration, and desktop qualification commands.

Hardware- or artifact-dependent tests may skip when required assets are absent. A skip remains a skip.

• Getting started
• Architecture
• Covert Coder North Star
• Engineering Preview
• Operations
• Veritas and Harness
• Release roadmap
• Research log
• Support

Historical documents may use the AIDE name or contain time-bound paths/status. Historical evidence should be evaluated against its recorded commit, environment, and scope.

Contributions should preserve operator control, reproducibility, explicit authority boundaries, and honest capability reporting.

Before substantial changes:

• read CONTRIBUTING.md;
• keep credentials, private source, model weights, auth artifacts, and machine-specific secrets out of commits;
• add or update applicable tests;
• update contracts and documentation when behavior changes;
• preserve skips, degraded states, and unsupported conditions accurately.

See also:

• Security Policy
• Code of Conduct
• Support Guide
• Apache-2.0 License

• GitHub Issues — bugs and engineering discussion
• GitHub Discussions — broader project discussion
• Private vulnerability reporting — security issues

Covert Coder is licensed under Apache-2.0 unless a file or dependency states otherwise.

Third-party models, runtimes, libraries, and tools retain their own licenses and attribution requirements.

Covert is being developed in public. Useful participation includes reproducible bug reports, hardware/runtime testing, documentation, code contributions, and sponsorship.