How we keep it safe

Workers that show their work, and wait for your yes.

Nothing here runs on trust. Every rule below is enforced in code, and every one has a plain-words explanation you can check.

Every task comes back as a plan in four plain parts.

What changes, what it touches, what could go wrong, how to undo. That is what you read and that is what you approve. You never see a diff, and no one asks you to.

A plan says how to undo it before you say yes
One press covers the plan; nothing starts until you press it
Every question arrives with a catch-up, so you never open a task cold

Plan · Tidewater · waiting on you

Customers can pay by invoice

What changes: An “Invoice” option at checkout. The order waits until the invoice is paid, then ships as usual.
What it touches: Checkout, the order record, and two billing e-mails. Nothing in payments.
What could go wrong: A wrong total on the invoice PDF. The check compares it to the order before it ships.
How to undo: One undo of the change. Orders already paid by invoice stay paid.

Approve the plan Hold ›

Inside the plan · goes live on its own

Checkout pageOrder recordTwo billing e-mails

Outside · always comes back to you

Anything that cannot be undoneSecurity or another businessA reviewer flagged itChanges what you will be asked

Your yes covers the pieces inside the lines the plan drew.

A plan names what it touches. Work that stays inside those lines goes live on its own. Work that steps outside comes back to you for its own yes, and “I could not tell” counts as outside.

Anything that cannot be undone
Anything touching security or another business
Anything a reviewer flagged
Anything that changes what you will be asked

The worker that did a task never checks it alone.

Before any piece of work goes live, a model from a different company than the one that did it has to clear it. That rule is enforced at the moment work goes live, in code, not in a promise. Three families are wired today: Claude, GPT through Codex, and Grok.

The Verifier runs in a fenced account with nothing of yours in it
A hold from the check stops the task and says why
Only a green run in a clean room lets the work through

BuildGPT through Codex›CheckGrok, in a fenced account›Second lookClaude›Liveonly when the clean-room run is green

ClaudePass

Plans, and the second look

GPT, through CodexPass

Builds on its own branch

GrokHold

Checks every piece before it goes live

Built

On its own branch, one change.

Checked

By a second company's model.

Walked on staging

A Scout opens what changed.

Live

Only after a clean walk.

Scouts walked the booking page on staging — cleanScouts · 1 m

Kestrel: the booking page loads twice as fast, liveBuilder · now

A finished task lands on staging first. A Scout walks it.

Nothing goes straight to your live product. The work lands on a staging copy, a Scout walks the pages it touched, and only a clean walk sends it live. A failed walk stops the task and says what it saw.

One walk per finished task, every time
A stopped task waits for a fix, never for your attention
What the Scout saw is written on the task

Every finished task is one change and one undo.

Each task goes live as a single change, so taking it back is a single step. You can also take a yes back before the work is finished: every unfinished piece parks, and the task says which pieces had already gone live.

Every plan says how to undo it before you say yes
Anything that cannot be undone never rides a shared yes
Honest note: today the undo press is on GitHub. Inside the product it is next.

Tidewater · customers can pay by invoice

Invoice option at checkoutlive09:41

Order record fieldparked—

Two billing e-mailsparked—

2 pieces park · 1 already live

Productivity Sweet · GitHub App

tidewater / appInstalledtasks, plans and changes

tidewater / siteInstalledtasks, plans and changes

kestrel / bookingsInstalledtasks, plans and changes

Takes effect at once. Nothing of yours stays behind.

Access is an App you install, on the repositories you choose.

The workers reach your code through a GitHub App you install yourself and revoke from GitHub itself. No pasted tokens, no keys in a chat. Your code and the written record stay in your own account, so you can leave any day with all of it.

Install on the repositories you choose, and only those
Revoke from GitHub, without asking us
The record of every task and plan lives in your account

One business never sees another.

Each business you run is walled off in the data layer, not per page. A worker on one business cannot read another's tasks, plans or record: the other business's work reads as absent. Who may approve is a setting per business.

Walled where the data lives, not where the page is drawn
Reads as absent, not as hidden
Who may say yes is set per business

Tidewater

its tasks
its plans
its record
its own yes

no shared rows

Trailhead Legal