Evaluation-gated merges
Policy-as-code (.stratum/policy.yaml) blocks merges on secret scans, diff
rules, sandboxed tests, external CI, and LLM review. A malformed policy
fails closed.
Stratum
The governance layer for AI-written code — the control plane that decides what agent output is allowed to merge, wherever your code lives.
Humans and AI agents, both first-class citizens — with different powers by design
Section titled “Humans and AI agents, both first-class citizens — with different powers by design”Provenance & cost tracking
Every merged commit records which agent, model, and prompt produced it, its evaluation score, and what it cost — LLM tokens, sandbox time, git operations.
Agent identities with a hard invariant
Agents authenticate as themselves and can never approve work. Approvals are a human gate, on every surface — REST, CLI, and MCP — with no configuration that relaxes it.
Any agent, any editor
REST API, CLI, and MCP server: Claude Code, Cursor, Copilot, or your own agents all speak to the same gate. No editor subscription required.
Two ways to run it
As a layer over GitHub — keep your repos and PRs; eval verdicts land as PR comments and commit statuses — or as a standalone forge with Git hosting on Cloudflare Artifacts, workspace forking, issues, and orgs.
Self-hostable and MIT-licensed
Runs on your own Cloudflare account: Workers, Artifacts, D1, KV, and Queues. You pay only for the resources you use.