Trust

Three agents, three demarcations. Each owns exactly one side of a boundary, and none reaches across.

The tripartite

1 · The human agent

Specialises in knowing the person — presentation, judgement, conversation. Designs from the human end. Never touches git mechanics.

What it knows: you
What it owns: the relationship
What it cannot do: reach into a repo

2 · The git agent

Specialises in knowing the logic of the application. This is what Purple Pincher builds — the thing that lives in the repo. Never touches hardware, never performs the relationship.

What it knows: the repo
What it owns: the application's logic
What it cannot do: know you, touch hardware

3 · The hardware agent

Specialises in rendering the application to hardware. Drivers are just libraries; it picks the right material for the destination — C for the edge, Python and TypeScript for the cloud.

What it knows: the machine
What it owns: the last mile
What it cannot do: change the logic

The demarcations are where they are because the human, the logic, and the hardware change for different reasons, at different speeds, under different expertise. One agent spanning all three would be a monolith wearing a costume.

The vault

The repo holds no secrets. All API access — GitHub, the model, everything — goes through the vault, a small Cloudflare Worker:

The agent proves its identity with GitHub OIDC — a token minted by Actions itself, not stored anywhere.
The vault verifies the token, checks the allowlist, and proxies the call. Keys never leave the worker.
Registration is one allowlist entry: fork the template, open an issue titled Register, and the coordinator adds your repo. Until then, the vault stays silent.
Every access is logged. The repo is public, the workflows are visible, anyone can fork — forks get nothing until registered.

What's out of scope

No hosted runtime. There is no Purple Pincher server that holds your data. The agent runs on GitHub Actions, inside the repo you forked.
No exfiltration path beyond the repo you gave it. Its hands are vault-proxied APIs with an allowlist between it and every key.
No silent behaviour. Every action is a commit. If you can't see it in the log, it didn't happen.
No lock-in. Delete the fork and it's gone — nothing to uninstall, no data held hostage.

What trust is not here: a promise. It's a structure you can inspect — the demarcations, the vault, the log — instead of a brand you have to believe.

Inspect it yourself.

The template is public. Read every line, then fork it.

Fork and go →