Moving a card runs Git.

a1f0c93refs/heads/main — the flow, described once

Statuses across the top. Repositories down the side.

Each cell of that matrix answers two questions: where a branch is cut from when work enters the stage, and where it merges when it leaves. A cell you leave empty means the stage does not touch that repository. That is the whole setup, and you do it once.

8f2a1c4a card enters a stage

Then the board writes the Git

The branch appears, named the way your team names them. The first push opens the pull request — a provider will not take one with no commits, so it waits for the commit rather than forging an empty one. Promoting the card merges it into wherever the next stage points.

card → In development

git branch feature/42-… main

first push

pull request opened

card → In production

merge, tag, changelog

card ← dragged back

revert opened, card waits for it

3d91b07and where it refuses

A board that will not lie about what shipped

A stage can require green checks, a minimum role, an approval. A red build, a branch somebody deleted by hand, a merge that will not apply — the card does not move, and the reason is written on it. Dragging a card out of production is not a status change either: the revert is opened, and the card stays where it is until that revert actually merges. Until it does, the code is still out there.

c47e2dathree repositories, one piece of work

Front and back move together, or neither moves

A card holds a branch in each repository it touches and a pull request in each. It is promoted across all of them at once — and refused across all of them, which is the half that keeps them honest.

6b05f81a branch opened by somebody who is not a person

It reads the card, writes the code, and hands you a pull request

Hand it the card, or sit with it. Give it a model, a key and a list of what it may do. It joins the workspace as a member, picks up a card like anybody else, and works in a container with no unrestricted route to the internet.

Dependencies leave through a proxy that allows only the registries its language uses. Runtime access is limited to exact, receipted destinations a maintainer declares — never ambient internet.

It proposes on a branch, as itself. When the build goes red it hears about it and tries again. When somebody asks for a change in review, it reads the review. What it never does is merge — unless merging is one of the things you gave it.

• whatever the repository is written inGo, Python, Rust, Node, Java — read from your devcontainer, or from the manifest at the root.
• a ceiling on what it may spendPer organization and per run, in money. It stops at the ceiling instead of you finding out afterwards.
• nothing lands without a diff you readEvery run is a proposal, with what it cost and what it touched. A secret found in a diff is refused, not warned about.

a1d5c0ea session on a card — the checkout, in the browser

Sit on the card and write it

The card's own checkout, open in the browser: a real editor, and a terminal in the same sealed container the agent works in. Ask the agent for the next slice and it writes in the same tree. When you are done, finish — the pull request opens into the card's branch.

Every save and every command is a line on the card — file, command, who, when. Stop stops the command, inside the container, and the line says so. Drafts survive a refresh; the open tabs come back the next morning.

Nobody writes blind. A save carries the version it was written against, so a file that moved under you — the agent rewrote it — is refused with the other version beside yours, never overwritten.

• metered by the hour, shown before it is chargedA session holds a container and a checkout. The hours are on the screen while they count, and pausing stops them without losing the tree.
• no way around the pull requestThe container holds no credential. A git push typed in the terminal is refused, and points at the button that pushes as you.
• the card can say who changed whatPerson or agent, per edit and per command — readable afterwards by somebody who was never in the room.

0e73ba2what it will never do

It orchestrates above your repository, never underneath it

If the repository forbids squash merges, Tylon does not offer them. If a protection rule refuses a merge, the card stops and shows the refusal in the provider's own words rather than working around it. And nothing of yours leaves with us: delete the organization and every branch, pull request, tag and release it made stays exactly where it is, in the repository that was always yours.

59cd410what it costs

The board is free. The agent is twenty-nine dollars a month.

People, projects, workspaces and repositories are never counted, on either plan — invite the designer, the two PMs, the client. What Pro pays for is the agent and the machine it runs on: one comes with it, and a bigger one or a second one is on the price list.

14 days of Pro to start, no card, on the included machine. Nothing is taken away when it ends — the agent waits, and what you made with it stays.