Models think.
Ghloo governs.
Models drift, overclaim and can be talked into anything. So every action runs through an engine that isn’t a model, and can’t be talked out of its rules.
Models think.
Ghloo governs.
Every action passes four checks before it happens, with Sentinel trying to break it. Nothing drifts, nothing is faked, nothing runs twice.
Animated diagram of the Ghloo engine. Each action from a seat passes four gates: scope, evidence, authority and ledger, while Sentinel probes it. It shows an off-plan task blocked, an unproven claim rejected then verified, a production delete escalated and denied, and work resuming from a checkpoint after a power loss without repeating an email.
Nova gives each task to the seat with the best record for it.
Governance in code
Rules live in the engine, not in a prompt. A model can be talked into anything. The engine can’t.
Claims need proof
Sentinel, an adversarial checker on a different model family, tries to break every claim. Work is done when a test, a source or a reviewer proves it.
Nothing drifts
Every action is checked against the plan and PROJECT.md. Off-plan work is stopped before it starts, not discovered after.
It keeps going
Jobs survive restarts, crashes and closed laptops. Every step is saved, and nothing with a side effect runs twice.
Every action passes all four, or it doesn’t happen.
Is it in the plan?
Each action is checked against the approved plan and PROJECT.md, the brief every seat must read. Off-plan work is stopped before it starts.
Is it proven?
“Done” and “tests pass” need a test run, a source or a check attached. Claims without evidence are marked unverified, never done.
Is it allowed?
Deny by default. Anything that sends, buys, publishes, deletes or changes access needs your approval of that exact action, or a timed permission you granted.
Is it recorded?
Every action writes a receipt: who asked, what ran, what it cost and what came back. You can open any step and see exactly what happened.
“A model can be talked into anything. The engine can’t.”
The rules live in code that isn’t a model, so no prompt, page or email can argue its way past them.
A built-in adversary.
Sentinel’s only job is to find what’s wrong. It runs on a different model family and reads the real files and test runs, not a summary.
- Flags drift away from the plan.
- Challenges claims that have no evidence.
- Escalates risky actions to you.
- Can never approve anything itself.
Work that outlives the session
Every step is saved as it happens. After a crash, Ghloo checks what already ran before it does anything again.
After a power loss mid-deploy, Nova resumes at step 14 and confirms a migration already ran.
Real orchestration, not a group chat
Work goes to the seat with the best reviewed record, on the model that suits it, inside a hard budget.
How we protect your keys and dataNova assigns seven tasks to six seats on four model families, with status and spend.
Save your seat
at the table.
We’re inviting people in waves. Everyone who joins with your link moves you up.
Share your link. Each person who joins with it moves you up 50 places.
By joining you agree to the terms and privacy notice.