Cocotte
AI co-coding agent-harness application.
Cocotte
A local-first desktop coding agent built on a Rust daemon. In development; not yet released.
Work happens in a Session; each substantive change runs as a Run with a goal, a budget, verification evidence and an explicit completion state. The model decides how to approach a task, while deterministic code handles authority, effects, persistence and recovery. A CLI and a Tauri desktop app talk to the daemon over one versioned protocol. Until the MVP, everything is tested hermetically against scripted model providers; the first real-model campaign is milestone M14.
Architecture
The code is split across four sibling repositories by charter. Only the cocotte-app composition links them all, and an assembly lock pins the exact tuple used by each build and qualification run. Design: architecture · ADRs · threat model · repository topology.
| Layer | Responsibility |
|---|---|
Contracts (carte) | Domain values, commands, queries and events; the versioned client protocol; generated JSON Schema and TypeScript bindings. No I/O |
Core (cuisine) | The daemon: event journal and reducers, context budgeting and provenance, policy and approvals, credential broker, egress mediation, model routing and the run driver |
Execution (fourneau) | A separate, digest-checked helper that runs file, process, PTY and git effects under Windows AppContainer or Linux Landlock containment |
Product (salle, this repository) | The cocotte CLI, the Tauri desktop app, the daemon composition, and passe/: the evaluation harness and qualification tooling |
┌─ CLIENTS ────────────────────────────────────────────────┐
│ desktop: Tauri 2 shell · React UI · TypeScript core │
│ cli: cocotte │
└───────┬──────────────────────────────────────────────────┘
│ local IPC · versioned protocol
▼
┌─ DAEMON ─ cocotte-app ───────────────────────────────────┐
│ session/run supervisor · orchestrator · model plane │
│ context plane · policy · credential broker · egress │
│ event journal (SQLite) → reducers → projections │
└───────┬──────────────────────────────────────────────────┘
│ private exec wire · digest-checked helper
▼
┌─ HELPER ─ fourneau ──────────────────────────────────────┐
│ file, process, PTY and git effects under containment │
└──────────────────────────────────────────────────────────┘Why this shape.
- The journal is the truth. Projections, snapshots, crash recovery and client reloads are all replays of one append-only log.
- Deterministic harness, small decision kernel. The model chooses the approach; code decides what it may do and whether the work is verified.
- Effects cross a process boundary. Policy decides in the daemon; containment enforces in the helper. Secrets reach effects only as opaque handles.
- One contract for every surface. The CLI and desktop use the same generated bindings, so no client carries its own agent logic.
- Milestones close on evidence. Each closes on an immutable, re-verifiable qualification run, and its critical gates are mutation-tested.
Tech stack
- Runtime: Rust · Tokio · SQLite (rusqlite) · serde · reqwest + rustls · ChaCha20-Poly1305 · BLAKE3 / SHA-256
- Execution: portable-pty · git2 (libgit2) · Windows AppContainer · Linux Landlock
- Contracts: schemars (JSON Schema) · ts-rs (TypeScript)
- Desktop: Tauri 2 (WebView2) · React 19 · react-aria-components · CodeMirror 6 · Vite · TypeScript
- Quality: cargo test / clippy · Vitest with real-WebView journeys · Docker for the Linux lane ·
xtask
Roadmap
The development plan has the full ladder.
| Milestone | Capability | Status |
|---|---|---|
| M0 - Walking skeleton | CLI → daemon → journal, with a local assembled pass (plan) | ✅ Done |
| M1 - Deterministic core | Reducer, journal, snapshots, crash recovery and digest-checked replay (plan) | ✅ Done |
| M2 - Authority and effects | Policy, containment, egress mediation, credential broker and built-in tools (plan) | ✅ Done |
| M3 - Model plane | Gemini, OpenAI-compatible local and Codex delegate providers, tested hermetically (plan) | ✅ Done |
| M4 - Context plane | Context budgets, provenance, freshness, handoffs and verifier-backed completion (plan) | ✅ Done |
| M5 - Sessions | Steering, questions, approvals, fork/resume, continuation, child runs and workers (plan) | ✅ Done |
| M6 - Protocol and baseline | Protocol v1 with version negotiation, generated bindings, the assembly lock and a CLI baseline on Windows and Linux (exit review) | ✅ Done |
| M7 - Desktop and Plan mode | The desktop work loop: Plan mode, steering, review of changes and evidence, checkpoint restore (plan) | Implemented; qualification pending |
| M8 - Context inspection | Inspecting what the model saw, bounded context controls, trust and rule editing (plan) | Planned |
| M9–M13 - MVP capabilities | Parallel worktrees, extensions (skills, hooks, MCP), code intelligence, workflow orchestrators | Planned |
| M14 - Live models | First real-model acceptance campaign; the MVP | Planned |
| M15–M22 - Beyond the MVP | Self-use evidence and UX, packaging and release, then evidence-gated research features | Planned |
Keywords
- Languages:
Rust·TypeScript·SQL - Architecture:
Event Sourcing·Deterministic Replay·Daemon + Thin Clients·Versioned Protocol·Generated Bindings·Multi-Repository - Agent runtime:
Context Budgeting·Verifier-Backed Completion·Plan Mode·Steering and Approvals·Checkpoint and Restore - Security:
Capability Policy·Platform Containment·Deny-by-Default Egress·OS Keychain - Quality:
Hermetic Testing·Mutation Testing·Reproducible Evidence·Real-WebView Journeys