Open source · self-hosted · v0.2.0
An agent that writes down what it did.
Copilot beyond the IDE, and the reference client for governed access. Every model call and tool invocation is written to an audit log the owner reads back.
Copilot beyond the IDE: an agent an organisation runs itself, driving the workflows an editor cannot reach (CI hooks, chat commands, scheduled triage) against its own internal systems. It keeps the record its work deserves: every model call and every tool invocation is written to an audit log the owner reads back, in the app as well as on disk.
The first thing to ask Cistern for something
It earns its place here by being the first thing to ask Cistern for something. An agent that wants a file has to present an identity of its own, receive only what was granted, be refused the rest, and leave a receipt behind. The shape of that exchange is the same whether the agent is writing code, reading a case file, or doing something nobody has built yet. Proving it on an agent we run ourselves is how the pattern gets settled before anyone else has to depend on it.
So there are two things in one repository, on purpose. An agent worth running, and the reference implementation of how a client should ask for someone else's data. Neither would prove much alone.
Every model call and every tool invocation, attributed to the authenticated user. What the agent did, in its own words, on the record.
What it was allowed to read, under which rule, recorded by Cistern rather than by the agent. The half an agent cannot write for itself, and the half that stays true if the agent is wrong about what happened.
On your own machine, for now
The release carries a signed jar, a bill of materials and a multi-architecture image. Until it clears the stranger test, treat it as something to run locally rather than expose.
# the signed jar and its bill of materials are release assetsjava -jar penstock-0.2.0.jar# or the multi-architecture image, bound to loopbackdocker run --rm -p 127.0.0.1:8080:8080 \ghcr.io/enrichmeai/penstock:0.2.0
Since v0.2.0 the published image requires a login by default: set AGENT_AUTH_PASSWORD, read the generated one from the container logs, or opt out deliberately with AGENT_AUTH_ENABLED=false. Exact coordinates, configuration and the model options are in the release notes and the shipped docs: v0.2.0 →.
Three surfaces, one log
However the work arrives, it is written down the same way and attributed to the authenticated user.
| Surface | What it is for | Written to the audit log |
|---|---|---|
| Web | A person working with the agent directly | Every model call and tool invocation |
| REST | CI hooks and scheduled triage | Every model call and tool invocation |
| Streaming | Chat commands and long-running work | Every model call and tool invocation |
| Models | Pluggable, including a local one | The call is logged whichever model served it |
Where it stands
This project has a rule: nothing is announced before it has run on real infrastructure. So here is the honest state, not the roadmap in disguise.
- Today
- Open source: three surfaces (web, REST, streaming), pluggable models including a local one, and an audit log of every model and tool call, attributed to the authenticated user and readable from the app itself. live
- Release
- v0.2.0: a signed jar, a bill of materials, and a multi-architecture image. live
- Governed access
- The pod tool has shipped. Penstock asks a Cistern pod for a file over plain HTTPS as its own principal, is refused outside its grant, and what it read is receipted on the owner's side. That is application-level consent: the receipt names the application, not the person who asked it. Per-user credentials are available by configuration for deployments that want attribution per person. live
- Later
- The stranger test: deploy and use it from the published artifacts alone, following only the shipped docs. Cistern is held to it; Penstock has not cleared it yet, which is why this page says to run it locally. later
- Licence
- Apache 2.0, free for any use including commercial.
Yours to read, not ours to claim
Everything with a fix available has been fixed: across four releases, 138 findings down to 85 and the criticals from fourteen to one. That one is waiting on an upstream release that does not exist yet, so there is nothing to apply rather than something left undone.
Every scan is attached to its release, so the whole series is yours to read rather than ours to claim.
Total findings.
The remaining one waits on an upstream release that does not exist yet.
Can I put this on a network?
Not yet. It has not cleared the stranger test that Cistern is held to, so it is a thing to run on your own machine for now.
How is this different from an IDE copilot?
An organisation runs it itself, and it drives the workflows an editor cannot reach: CI hooks, chat commands, scheduled triage, against its own internal systems.
Do I have to send anything to a model provider?
Models are pluggable and one of them is local. Whichever serves the call, the call is written to the audit log.
Do I need Cistern to use it?
No. It is an agent in its own right. The pod tool is what makes what the agent read receipted on the owner's side, and it is what turns the audit log into two records that can be checked against each other. See Cistern →
Why publish a critical finding rather than close it quietly?
Because there is no fix to apply. It waits on an upstream release that does not exist yet, and saying so is more useful than a clean dashboard.
Is any of it held back for a paid tier?
No. Apache 2.0, free for commercial use. Support, integration and hosting are how the company earns. COMMERCIAL.md →