Architecture
Deterministic gates, hybrid routing
The deterministic gate
Every repository Zecor works on has a gate script — .zecor/verify.sh
(.fleet/verify.sh is still accepted). It runs the repo's linters,
type checks, and test suite. A task is done when the gate exits 0. A bounded
bug fix starts from a red gate: the failing test is the deliverable,
and the loop's job is to make it pass without breaking anything green.
The gate runs in a capped subprocess: its own process group, a hard wall-clock
timeout, SIGKILL on overrun, and an environment with vendor API
keys stripped so a lane cannot reach the operator's paid accounts.
The routing ladder
Escalation climbs a fixed ladder; each rung is skipped only if the ledger records it as unavailable.
| Tier | What | Cost |
|---|---|---|
| T0 | Deterministic ast-grep codemods for recurring fix shapes | none |
| T1 | aider + a local coder model on an OpenAI-compatible endpoint | none (local) |
| T2 | Reader tiers: an HTTP model that returns text but touches no lane | metered |
| T3 / T4 | Cloud reasoning appliers (Codex, Claude); one paid call at a time | metered |
Bounded and mechanical work gets two local attempts before any escalation.
route() is a security-sensitive module: written attended,
property-tested against a synthetic ledger, never changed by an automated run.
Escalation triggers
A model is never asked whether it succeeded. The harness computes each trigger from artifacts the model cannot fake:
- gate red for two consecutive attempts
- the same failing-assertion set as the previous attempt
- a diff identical to the previous attempt
- a previously-green test now failing
- files touched outside the card's allow-list, or a line count over the ceiling
- prompt tokens over the local context cap
- an unresolved symbol (routes to retrieval, not a bigger model)
One backend, many surfaces
zecor/core/ holds the read model and the write verbs. The CLI, the
operator TUI (zecor console), and the HTTP API + PWA
(zecor serve) all go through it. A boundary test fails the build if
a task card is written from anywhere outside core/.
Running unattended
A supervisor keeps the run alive across crashes, sleep, and reboots. When the queue drains it decomposes the next unplanned roadmap item into fresh cards. A daily pass records what landed and flags any goal that has burned attempts without progress. A spend ceiling throttles to local-only, then pauses.