A coding agent you can actually own.

What Jeden is#

Jeden is a harness for AI agents built from real-life experiences. It routes models intelligently, manages credentials, and understands how to pursue, complete, and verify tasks over time — while the agent’s inference path, spend attribution, and tool permissions remain under your control rather than a third-party hosted agent’s. It is compatible with OpenAI, Anthropic, Kimi, and any other model reachable through an OpenAI-style endpoint.

Jeden is not a hosted or multi-tenant service; it is a local harness, and its local runtime is usable without a hosted Wisent account. It runs as a single local process: nothing but that process reads the checkout, and inference is reachable only through the Brama model router — Jeden carries no provider API key and no provider SDK.

Jeden serves two audiences:

• Engineers, who run interactive and one-shot coding tasks in the terminal with local approval over every write and command.
• Tooling and automation, which drives the same harness through its machine interfaces (RPC, ACP, headless mode, SDKs) inside editors and workflows.

Design contract#

Jeden separates five concerns. Each part stays visible, inspectable, and local — the model can reason freely, but the harness decides what may actually happen.

• Inference — model calls go through Brama using HMAC-signed, OpenAI-compatible chat completions: each request carries x-agent-id, x-agent-timestamp, x-agent-body-sha256, and x-agent-signature, so the signing secret itself never leaves the process.
• Policy — the harness prompt and approval rules are explicit and local.
• Tools — a small allowlisted registry enforces path jails and write or command permission.
• Run loop — the model may return native tool calls or strict JSON actions that enter the same local execution loop.
• Pursuit adapter — jeden pursue maps the separately owned Pursuit engine stages onto persistent planner and executor conversations plus fresh read-only reviewers.

How a task runs#

A task enters through CLI, TUI, RPC, ACP, headless or an SDK. Jeden records the original request before a model call and uses a separate read-only conversation to record its acceptance requirements. The execution loop proposes results; a fresh verifier reads real observations before the native controller accepts completion. A new question does not erase earlier work.

Tool schemas are derived from each tool’s input contract and sent with the model request. Tool results are recorded in the session and returned to the model until it produces a final answer. File mutations return Jeden-native visual diffs and previews, and oversized tool results are persisted as session artifacts and replaced in the model loop with a compact reference.

Failure handling is fail-closed. Without BRAMA_URL the run stops with BRAMA_URL is required and no model call is made. Transient model errors retry with the router’s backoff, but neither retry nor subscription failover happens once model output has become visible; a typed quota-exhaustion response records a Retry-After-bounded cooldown in .jeden/subscription-cooldowns.json before the next eligible subscription is selected.

Waiting is bounded in three separate places, because a gateway that is down, a model still reading a long prompt, and a stream that stopped mid-answer are three different failures. A reasoning route may take minutes to send its first token, so a turn waits five minutes for it before reporting model stream first-event timeout; a stream that has produced output and then goes quiet is cut by modelRouting.retry.idleTimeoutMs; and an unreachable gateway fails at once as a transport error rather than waiting at all. Writing modelRouting.retry.firstEventTimeoutMs into .jeden/config.json replaces the five minutes with exactly that value.

Model discovery is not that gate. A catalog read that times out, is rate limited or answers 5xx leaves the catalog unread rather than answering about the configured model, so the run says so on standard error and sends the request anyway; the gateway that serves it decides. A catalog that does answer still refuses an unknown or unavailable model by name, and an explicit non-retryable refusal still stops the run before any provider spend.

An answer the model does deliver can still be unusable: cut off mid-JSON, or stopped by the output budget. That is one answer failing, not the work failing, so the turn quotes the exact refusal back to the model once and only then ends — naming what happened to the answer, with the retained request still open.

Native intake and acceptance inspectors accept their structured JSON directly, inside a Markdown code block, or encoded in the text of a final action. Read-only tool actions still run through the same permission checks. A parsed answer is not evidence of completion: the controller still checks every acceptance requirement and its observation receipts.

Quick start#

Prerequisites: a supported platform (aarch64-apple-darwin, x86_64-unknown-linux-gnu, x86_64-pc-windows-msvc) or a Rust toolchain for source builds, a Brama-compatible model endpoint, and a caller-owned signing credential.

Running jeden opens the welcome view. Its first screen can adopt an existing repository in place; the same operation is available as jeden workspace adopt <path>, /setup workspace <path>, and the Jeden Desktop Settings screen. The accepted canonical path becomes the default for the next task unless --cwd is explicit. /setup remains an idempotent wizard for workspace, Brama URL, agent id, default model, and preferences; it writes non-secret router values to ~/.jeden/.env at mode 0600, while workspace selection uses the atomic user config. WISENT_APP_AGENT_AUTH_SECRET is read from the process environment only — the harness holds no credential store and writes no secret to disk; the bundled launch scripts export it from the Skarbiec item agent:wisent-app, which also owns rotation and revocation. jeden doctor returns a JSON health report and exits non-zero when an active probe is unavailable.

On macOS, source builds also need Wisent Products and an available Apple Development or Developer ID Application identity. Build jeden and jeden-sandbox-helper together, then run wisent-products signing sign --product jeden target/release/jeden target/release/jeden-sandbox-helper. The helper must stay beside the executable. Signing failures stop installation; there is no ad-hoc fallback. The shared contract is Native macOS code signatures.

Stado publishes Jeden as a command-line package, not a running fleet service. Its Darwin archive carries bin/jeden and bin/jeden-sandbox-helper; consumers must install both from the same archive and keep them beside each other. Publication alone is not proof that a consumer can run a task.

The release worker signs the declared native stage before creating the archive. The Darwin recipe supplies desktop-signing-apple-development#certificate and desktop-signing-apple-development#private_key through scoped workload credentials and uses the signer's temporary keychain, without a system consent dialog. A missing credential, unusable signing identity or missing helper remains a failed build or run. See Stado release and compatibility for the source-bound publication commands and receipts.

Release builders receive private Git dependencies through the immutable private-cargo-sources input, not through GitHub credentials or sibling checkouts. After a Cargo.lock change, run python3 release/cargo.py export .wisent-output/private-cargo-sources.tar.gz, publish the returned archive with stado storage put <input.uri> <archive> --if-absent, and record its returned input object in .wisent-release.json. Python 3.9 or newer is required. The release Cargo wrapper refuses missing inputs and inputs from another lockfile; Cargo verifies the exported checksums without changing the lockfile.

Both release steps let Stado resolve Python directly: quality runs python3 release/cargo.py cargo ... and building runs python3 release/cargo.py stage --bin jeden, adding --bin jeden-sandbox-helper on Darwin. No shell selects a second interpreter. Staging prints the actual interpreter and copies only successful native build outputs from the source's target directory into WISENT_OUTPUT_DIR/bin. An absent output directory setting is refused with WISENT_OUTPUT_DIR is required for native staging before compilation.

The wrapper finds Cargo on PATH, then in $CARGO_HOME/bin, defaulting to $HOME/.cargo/bin. It preserves the proxy name used by Rustup and does not require shell startup files. If no executable exists, the refusal names the missing path and asks for toolchain provisioning; the wrapper does not install tools or change host configuration.

Run python3 tests/release/private-sources.py with Rust and Python 3.12 to exercise the export, offline source selection with a service-style PATH, actual helper staging and execution, and missing-output, missing-toolchain, missing-input, lockfile-mismatch and missing-package refusals. Reports under .wisent-output/release-tests/ retain the source revision, patch, command output, exit codes and staged helper hash. This check does not qualify a signed sandbox or a model-backed task.

Each native release also runs python3 tests/release/private-sources.py --stage using its declared input. This mode builds and executes the staged Jeden CLI and checks staging refusals without exporting private sources or needing GitHub credentials. It records the worker's WISENT_SOURCE_COMMIT; the archive retains its reports under evidence/release-tests/.

git clone https://github.com/wisent-ai/jeden.git && cd jeden
cargo build --locked --release
# macOS only, after building:
wisent-products signing sign --product jeden target/release/jeden target/release/jeden-sandbox-helper

WISENT_APP_AGENT_AUTH_SECRET=<signing-credential>
BRAMA_URL=<brama-model-router-url>
# Set only when Brama requires its distinct bearer.
BRAMA_TOKEN=<brama-bearer>
WISENT_APP_AGENT_ID=wisent-app

jeden run "Respond exactly: OK" --model-only   # expected output: OK

Run a named VS Code task on macOS#

On a configured Wisent workstation, scripts/run-with-stado.sh obtains the agent signing credential and the separate jeden-model-router/token bearer from Skarbiec, then launches the installed Jeden without building it. The reusable task in scripts/vscode-tasks.json runs a disk diagnosis with gpt-6-astra in a dedicated integrated terminal, without typing into another terminal's prompt or changing the default model.

For a checkout at ~/Documents/CodingProjects/Wisent/jeden, run the command below from the repository root only when VS Code has no user task file. If that file already exists, preserve it and add this task to its tasks array instead. Choose Terminal → Run Task… → Jeden: diagnoza dysku bez zmian; the named terminal retains the command and final exit status, and only one instance can run at a time.

The task asks for paths, sizes, growth causes and APFS accounting without deletion, compilation, configuration changes or consent prompts. It grants command execution, not a filesystem sandbox; these restrictions are part of the diagnosis prompt. A Brama refusal remains a failed run instead of causing a model switch or a new login.

ln -s "$PWD/scripts/vscode-tasks.json" \
  "$HOME/Library/Application Support/Code/User/tasks.json"

Current scope#

The private milestone includes:

• interactive terminal and one-shot jeden run modes;
• autonomous outcome pursuit through jeden pursue, with source-grounded contracts, independent reviews, and durable receipts;
• session transcripts and artifacts under ~/.jeden/sessions/;
• model routing through required BRAMA_URL, WISENT_APP_AGENT_ID, and WISENT_APP_AGENT_AUTH_SECRET;
• model selection through --model, JEDEN_MODEL, or native config;
• jailed filesystem, document, archive, image, SQLite, search, Git, process, evaluation, URL, artifact, memory, todo, delegation, and MCP tools;
• guarded file mutations using the digest or snapshot tag returned by read_file;
• custom JavaScript tools, project and user lifecycle hooks, and native .jeden configuration paths;
• transactional jeden update that verifies a DSSE release manifest against the binary’s embedded canary and stable ed25519 trust roots, checks the artifact digest plus SBOM and provenance evidence, and rolls back to the journaled last-known-good binary on failure;
• interactive approval for writes and commands unless explicitly enabled.