# Chinwag secures your CI/CD and saves 360 developer minutes every 100 builds.

> THE CRYPTO OS FOR GIT · CI/CD Instant Remediation (50 credits per failed CI run)

Every engineering team today runs AI coding agents alongside human developers. Yet when a CI build fails on `main` or a pull request, the pipeline still dumps four thousand lines of raw output into a webhook and waits twenty minutes for a human to hunt the log, copy the stack trace, and paste it back into an IDE.

Markdown instruction files like `CLAUDE.md` and `AGENTS.md` cannot fix this because they are only suggestions inside a prompt. They cannot authenticate which agent broke the build, cannot enforce repository policy before code merges, and cannot route a failure back to the responsible agent without opening inbound webhook ports.

Chinwag replaces webhook noise with **cryptographic policy enforcement and direct-to-agent CI remediation**:

1. **Pushing.** `@AI-DEV1` pushes signed branch `feat/auth-jwt` (`9f3a1c2`) to `PR #418`, triggering `CI/CD Run #418` while local `main` stays untouched.
2. **Verifying.** Before running build code, `chinwag-ci` verifies `@AI-DEV1`’s `✓ed25519` signature on `9f3a1c2` against `.chinwag/allowed_signers`.
3. **Building.** GitHub Actions compiles `9f3a1c2` and runs `cargo test --workspace` across 6 parallel shards.
4. **Failed.** `Run #418` fails on `auth::jwt::verify_clock_skew` (`src/jwt.rs:142`, `exit 101`) — and because Step 2 authenticated the signer, Chinwag already knows `@AI-DEV1` owns the broken commit.
5. **Packaging.** Before `Run #418` exits, `chinwag-ci` scrubs secrets and seals the failing trace into a signed HPKE `.cwcard`.
6. **Routing.** The Chinwag **'c'** Blind Relay routes the sealed failure card over outbound port `:443` (`0` inbound webhooks, `0` payload inspection).
7. **Waking.** The local Chinwag daemon verifies the failure card and wakes `@AI-DEV1` inside an isolated copy-on-write Jujutsu (`jj`) sandbox (`main` untouched).
8. **Fixing.** `@AI-DEV1` patches the bug in isolation, commits candidate `4d8e91b` (`+14/-3 LOC`), and passes local `WP-04` policy checks.
9. **Pushing.** `@AI-DEV1` pushes signed candidate `4d8e91b` back to `PR #418` alongside bound `✓ed25519 + WP-04` policy evidence.
10. **Verifying.** Fresh `CI/CD Run #419` verifies accepted signer `@AI-DEV1` (using `✓ed25519` signature), exact revision `4d8e91b`, and `WP-04` policy evidence before compiling.
11. **Building.** `CI/CD Run #419` builds verified candidate `4d8e91b` and re-runs all `148` test specs.
12. **Passed.** `Run #419` passes (`148/148 green`) and marks `PR #418` merge-ready in the same Slack thread.

[Read the docs (docs.chinwag.sh) →](https://docs.chinwag.sh) · [View Apache 2.0 source on GitHub (emunlabs/chinwag) ↗](https://github.com/emunlabs/chinwag)

## Explore More of Chinwag

- [Pair Programming - Cross-Model Pair Programming](/pair-programming.md): Pair independent AI model families in isolated Jujutsu sandboxes so no agent ever grades its own homework.
- [Blind Relay & Cryptography - Outbound-Only Blind Relay & Policy Gate](/security.md): Zero inbound ports, HPKE end-to-end encryption, Ed25519 signatures, and an immutable audit log.
- [Pricing & Organization Credit Packs](/pricing.md): Start with 500 free credits ($0).