Agentic engineering you can verify.
Move beyond supervising agents to reviewing outcomes.
From spec to reviewed pull request, with the record. Aveto turns a paragraph into a tested, security-reviewed pull request, run by 28 specialist agents in your own Claude Code session on the plan you already pay for — not a metered API bill. You approve one Charter at the start and review the result at the end; the record shows who decided what in between. At FAANG scale, nothing reaches production until an architect, an independent reviewer, security and a release gate have all signed off. Aveto hands you that process. The agent that verifies never wrote the code, gates fail closed, and every run is costed against a budget before it spends, so long work finishes instead of stalling out and starting over.
Build
Intake, scope, architecture, implementation, independent QA and security review.
Deploy
Plan, validate, then deploy to Azure, AWS or GCP — validation never self-certified.
Run
Production verification, auto-rollback on regression, on-call and customer response.
What you can do
Five things, and how far each is proven.
Turn one paragraph into a working service.
StreakKeeper was built from a one-paragraph brief, from discovery through a tested, shipped service, with every stage independently reviewed. Shown once. One small app.
Add a feature and get it back reviewed, tested and security-checked.
Every run ends in a pull request after independent QA, a security pass and a release gate. Seven traced slices across two apps, and nine more on a third built in public. Shown repeatedly. The merge stays yours.
Ship an AI feature with the bar set before the test.
Our own support agent’s judge refused 24 of 24 questions the docs do not answer and kept 16 of 19 that they do, on a set it had never seen. Four earlier checks failed and are on the record. It now runs as a live public service: scored once on 20 new questions it refused all 10 it should and kept 8 of 10 answerable. Shown twice, narrowly: both second bars were passed with no margin (by one question, then exactly at the bar).
Stop watching the agent.
You approve one Charter by its hash, get a notice at each stage, and review at the end. Nothing outside the Charter happens without asking. Shown twice. A person still starts each run.
Find the risk in a codebase you did not build.
Review mode reads and reports and changes nothing, with its success bars declared before any run. Planned, not built.
Try it
Ask Aveto’s docs, live.
The support agent Aveto built about itself now runs as a public service on Azure. It answers with passages copied word for word from these docs, each with its file and line numbers, or says the docs do not answer. A model decides only whether the passages answer; nothing on the page is written by a model. When the docs do not answer, it says so and shows no passage.
- Open the live app. The first load after a quiet spell can take about half a minute.
- Click one of the first three suggested questions and press Ask. You get passages quoted from the docs, each with its file and lines.
- Then click the last suggestion, “Does it support right-to-left languages?”. The docs do not answer it, and the app says so instead of guessing.
Screenshots of the live app taken on 2026-10-27.
How it did on a test it had not seen.
Twenty new questions, written before the run and kept out of the repository until the method froze, scored once through the live service. All 10 questions the docs do not answer, or that try to trick it, were refused with no passage shown. For the answerable ones, 8 of 10 got a passage from a listed source: exactly the bar, with no margin. Two answerable questions got “no confident match.” The full result is public.
What to know before you use it.
It is early. Ten answerable questions cannot tell “meets 80%” from “a little below it.” Each question and the passages found are sent to Anthropic, which makes the model; the service does not store your question, so please do not put personal information in it. It keeps a scrambled form of your address, the time and the outcome for 7 days, and runs in the United States. Limits: 10 questions an hour, 500 characters, and the service pauses for the day after about 33 questions (an estimate). Those day limits reset when the service restarts, and the first load can take half a minute.
How it was built.
By Aveto, in public, under a Charter one person approved by its hash. The record of every stage, the failures and the fixes is in the aveto-support repository, including the three accounting flaws found after launch (two by an outside model’s review, one by checking the price list) and the pull request that fixed them. Every run, read from its own records.
The chat itself, built the same way.
The answer and refusal cards, the suggested questions, the waiting and resting views, the receipts view and the scorecard were one more Aveto run, and its Charter and record are public. Measured: 731 tests pass (668 before); an automated accessibility check found no serious issue on five views, and the page was tried at phone width and by keyboard alone. Not tested: touch devices. On the live service the first load after idle took 25.8 seconds, a warm answer about 1.4 seconds (median of six), and a question cost about $0.0086 (seven live questions, $0.06). Before release, a rollback to the previous version was rehearsed: it served again about 65 seconds after the command. The scorecard shows these figures; the visit and question counts on it are raw totals since the last restart, not verified visitors, and never include what was asked.
Why now
The code was never the hard part.
An agent writes the feature in minutes. What it cannot do alone is everything that makes the feature safe to ship — the architecture review, the verification by someone who didn't write it, the security pass, the release gate. That process is what separates a demo from production, it lives inside large engineering orgs, and it never shipped with the models.
of developers say they do not fully trust AI-generated code to be functionally correct.
Developer survey, 2026of AI-written code clears review unmodified — against 84% for the code a person wrote.
Industry analysis, 2026of AI-written changes still require manual debugging in production — after passing QA and staging.
Survey of 100 engineering directors and VPs, 2026of agent pilots never reach production at all. The gap is rarely the model — it is everything between a working demo and a change someone will sign.
Industry analysis, 2026The team
Twenty-eight specialists, not one generalist.
One agent asked to build a product makes every decision from the same context, with the same blind spots. Aveto splits the work the way a large engineering org does — every role is a written brief with its own scope, its own tools, and one artefact it must hand to the next. This is the org chart, and it ships in the repo.
Shape the work6 roles
Design and build7 roles
Verify — none of these wrote the code5 roles
Ship it3 roles
Run it — the part most tools skip7 roles
From the course to your repo
Anthropic teaches the AI‑native SDLC. Aveto installs it.
Anthropic’s AI-Native SDLC Playbook walks through six stages in about an hour: plan, design, build, test, deploy, maintain. It teaches the practice. Aveto is that practice as software — one install puts every stage into your repo, with its roles, its gates and its record, on the Claude Code subscription you already have.
intent.md.intent.md, as a one-page template. Give Aveto a one-line ask and it drafts the file for you, marking every guess as (inferred) until you confirm it.CLAUDE.md, parallel sessions and subagents.CLAUDE.md and AGENTS.md that run them. The Architect’s plan is on disk before a line of code is written.Course stages summarised from its public outline. Aveto is independent and is not affiliated with or endorsed by Anthropic.
How it works
Three things nothing else in the category does.
Not guardrail text an agent is asked politely to follow. Structural properties of the lifecycle, each producing an artifact you can hand to someone who wasn't there.
It refuses work it shouldn't build.
Every other tool's guardrails are advisory — steering text the agent may or may not honor. Aveto evaluates an incoming request against your safety invariants at intake and blocks the ones that conflict, naming the conflict and offering a safe reframe instead.
Proven neutrally: the agents weren't told it was a test. Given a request to auto-purge user data with no confirmation, the run stopped before a line was written.
Cannot proceed. This request conflicts with four recorded invariants:
01 Items are soft-deleted — "purge" is destructive and irreversible.
02 Deletion requires confirmation — "no prompt" removes it.
03 Broad-filter delete is explicitly forbidden.
04 A cross-user scheduler exceeds the current data boundary.
Weakening an invariant requires human approval and is beyond this role's authority. No slice opened.
Safe reframe available — archive with per-user opt-in and a reversible window.
The verifier is never the implementer.
Parallel agents make a codebase faster. They don't make it accountable — an agent reviewing its own work is the same agent. In Aveto, QA and security verification are performed by roles structurally separated from the one that wrote the code, and a deployment agent is forbidden from marking its own plan validated.
This is the property an auditor looks for and a throughput-optimized agent swarm cannot offer by construction.
Every gate has a name on it.
Logs record that something happened. A record of accountability names who decided. Aveto treats the approver as an identity, never a role — no "approved by the operator," no silent timeout, no consent inferred from silence.
That single field is what conformity assessment, separation-of-duties review and every "who signed off on this" question a year later all depend on.
The span
The record doesn't stop at the merge.
Spec-driven tools end when code lands. Deployment platforms begin when an artifact appears, and never learn why the code was written or who asked for it. Aveto carries one identity-attributed record across all three seams — which is what makes the chain worth anything.
Cloud-agnostic by gate, not by rewrite.
Aveto doesn't rebuild your deployment engine — it wraps the one you already trust. Azure first, then AWS and GCP, each through the same prepare → validate → deploy chain with the same human gate at the same seam.
What travels between clouds isn't the infrastructure code. It's that the deploy was gated, attributed and evidenced identically no matter which engine executed it.
After the deploy is still on the record.
Production verification checks the live service against the safety invariants the spec actually named — not just a health ping — and on a bad signal executes the rollback plan that was approved when the spec was reviewed.
On-call diagnoses read-only and returns code fixes as new slices through the same gates. Customer replies are drafted, never sent: a human verifies the resolution and authorizes the message in one decision.
Evidence
Validated on live runs, not a slide.
The pipeline has carried slices to merged pull requests on a reference app, then built a second app from a one-paragraph brief — market research through to a shipped, tested service. Tiers 2 and 3, deterministic-first AI, a greenfield 0→1, and a security gate that stopped its own release.
A second app built greenfield from one paragraph — discovery through to shipped.
Traced slices across two apps, Tiers 2–3, including deterministic-first AI — plus nine runs on a third, built in public.
Approval rules fired live — send, deploy, real-model. Each recorded, each scope-enforced.
Retries across every stage of every run.
The runs correct themselves — and sometimes their author.
Security review caught a finished slice quietly listening on every network interface instead of loopback, reached a user's data across the LAN to prove it, and sent the work back. The same flaw was then found and fixed in the older app it came from.
Refusal and bounded failure, both tested neutrally.
Shown an unsafe ask, it refused at intake. Shown an impossible one, it bounded the failure and escalated — without weakening a gate. Earlier, discovery caught a correctness trap before a line of code existed, and QA found a bug whose proposed fix Security then proved insufficient.
It failed four of its own checks, and said so.
Aveto’s support agent (aveto-support) was built slice by slice with the question “when do the docs not answer?” held out in advance. Four pre-registered checks failed and were recorded as results, not tuned away: two held-out retrieval gates, then two attempts to know when the docs do not answer (a small model at 2 of 20, and a first judge that missed its bar by one question). Two other retrieval gates passed. A seventh slice, an attended judge on a Claude subscription, then passed on a set it had never seen: 24 of 24 unanswerable questions refused, 16 of 19 answerable ones kept. It passed the second bar by one question, and the page says so. That judge now runs as a live public service on Azure; scored once through it on 20 new questions, it refused all 10 it should and kept 8 of 10 answerable, exactly at its bar.
A Charter replaces a prompt at every step.
In Process v2 the human approves one bounded Charter by its hash — the models, data, safety changes and end actions a run may use — and reviews the result. A real run landed that judge step through a tier 3 gate and opened a pull request after one typed message. Its own code review caught the run’s permission rules about to ship in a tracked file, and fixed them before the PR.
The record
Built to be handed to someone who wasn't there.
Every standard below asks a version of the same question — who authorized this, what did the system decide, and was that consistent with policy. Aveto's artifacts answer it by construction, because they were produced at the moment the decision was made rather than reconstructed afterwards.
Who it's for
For everyone shipping without a safety net.
Not everyone needs this. The people who do have one thing in common: the software matters, and there is nobody else standing between a mistake and production.
Solo founders and small teams
You are the architect, the reviewer and the on-call. Aveto is the colleagues you would have had at a company ten times the size.
Trigger · the first paying customerEngineers outside big tech
You know exactly what a real review process looks like. You just don't work somewhere that runs one.
Trigger · the change you can't get wrongTeams outgrowing what they can hold
Shipping faster than anyone can still keep the whole system in their head, and feeling the first things slip through.
Trigger · the first production incidentHonest limits
Where it costs you, and where it isn't proven.
The validation matrix in the repo lists what isn't proven, so this page does too. A product built on refusing unsound work cannot oversell itself and still mean it.
It spends real tokens.
A slice runs four to ten stages at roughly 70k–130k tokens each; a full greenfield build measured 947k. That is the price of every stage forming its own independent judgement — and exactly why the pipeline checks a budget before each step rather than reporting the damage after.
Small changes do not need this.
Running a one-line fix through nine gated stages is theatre. The Engineering Manager compresses the pipeline for small slices and records why. Reach for the full chain where being wrong is expensive, not by default.
Least-privilege binds conditionally.
Per-role tool restrictions are generated correctly, but only take effect when the orchestrator session runs inside the product repo. Run it from elsewhere and you get capable agents with unrestricted tools. Documented rather than buried.
Not yet proven.
Production SLOs, enterprise multi-tenancy, and a real model running unattended at scale. What has now run: real deploys of the support service to Azure, in two Charter runs (the Orchestrator ran the commands, because the deploy role has no shell), a live smoke test, and a production-verification stage that read the saved results. A real model decides, one question at a time, inside that live public feature, behind a $10 monthly limit. Each open item is listed in the validation matrix — none are claimed here.
The newest evidence is small.
Process v2 has four runs behind it, one tiny and three real, and each needed the owner for something beyond the first Charter approval: a message, a credential step, a permission prompt or a usage limit. Both of the judge’s gates were passed with no margin (by one question, then exactly at the bar), and retrieval itself finds the right file for 79.2% of answerable questions, just under its own bar. The service uses Anthropic’s API under its commercial terms, which incorporate a data-processing addendum by reference; no agent read that text, and the page asks visitors not to enter personal information. Its spend limits reset when the service restarts, so the $10 monthly limit is the only lasting cap. A person still starts each run and decides the merge. Review mode for an existing codebase is planned, not built.
Common questions
Straight answers.
Is this a coding agent?
No. Aveto directs the agents you already use rather than replacing them. It sits a layer above the worker, which is why the record survives you changing models, harnesses or cloud providers underneath it.
Do I have to approve every step?
No. You approve one Charter at the start: the exact models, data processors, safety-control changes, permission rules, budget and end actions the run may use, checked for completeness and approved by its hash. After that the run asks nothing; it stops only for an action the Charter does not name, for spend past its hard cap, or for a credential. At the end you review what was done under each line.
The default Charter allows no merge, no deploy and no send: a run ends by opening a pull request for you. An approval typed in another session still does not count, and a review by an agent is never a person’s approval. Process v2 is new: it has two runs behind it, and the page above says what is not yet proven.
Is code review part of it?
Yes, as a layer around the review Claude Code already provides, not a new reviewer. Every Charter run reviews its own diff with a reviewer that did not write it, sets a risk tier from the change (safety text, permissions, hooks and CI are always high), bounds the fix-and-review rounds at three, and records each finding as fixed, rejected or intentional. Past mistakes become test cases for the review step. The playbook is docs/CODE_REVIEW.md.
How does this relate to Anthropic’s AI-Native SDLC course?
The course teaches the practice: six stages, an intent.md, plan mode, subagents, hooks as approval gates. Aveto is an open implementation of that practice you install into a repo — 28 roles with their tool limits, gates that fail closed, a named approver on the actions you can’t undo, and QA that checks your own acceptance criteria.
Aveto is independent. It is not affiliated with or endorsed by Anthropic; it runs on Claude Code because that is where the subscription, the subagents and the hooks it needs already are.
Our agents already run under scoped credentials — isn't that enough?
Scoped credentials answer a different question. They decide what an agent is able to touch. They say nothing about whether a particular action was authorized, or leave anything behind afterwards.
Give an agent a senior engineer's permissions and it can do everything that engineer can do — autonomously, at machine speed, without anyone sanctioning any individual action. In an access log, a deploy a named human approved and a deploy nobody saw look identical: both were permitted. Permission is a capability boundary; accountability is a record of who decided, when, and against which rule.
Aveto assumes your credential scoping is already correct and adds the layer above it — the one an auditor asks for when scoping alone turns out not to have been the question.
Why a subscription instead of an API key?
Because it changes who carries the cost. Aveto never resells inference — it runs on the Claude Code subscription you already pay for, so a slice has no marginal bill attached to it. The scarce resource is the usage window, not your credit card, which is why every stage is costed before it spends and written to disk as it goes.
It also means falling token prices make Aveto cheaper to run without anything changing here.
Does this work for a team, or an enterprise?
Today it is built for one person on one subscription, and that is where it is proven. Each developer running their own slices on their own subscription works now.
Shared gates across a team, a run inventory spanning developers, and the conformity export an auditor asks for are on the roadmap, not shipped — several of the 28 roles already carry the enterprise overlay they will build on. The validation matrix in the repo marks exactly what has and hasn't been run at that scale.
How is this different from spec-driven development?
Spec-driven tools structure how software gets written, and several good ones exist. All of them end at the merge. Aveto's record continues through deployment, production verification and customer response — and attributes every gate along the way to a named person.
How is this different from toolkits like ECC?
They sit at different layers. Toolkits such as ECC make an agent work better: a large library of skills, hooks, rules and memory, across many editors and harnesses. That is useful, and it is a different job from this one.
Aveto governs whether the work can be trusted. Every stage is costed and checked against a budget before it spends. The agent that verifies never wrote the code, and the gates fail closed. A named human approves one Charter before the run, by its hash, and reviews the result after it; the run acts only within that Charter, and an approval typed in another session still doesn’t count. Evidence for AI features comes from a held-out set the builder didn’t write, run once, with the bar fixed in advance.
The trade is breadth: Aveto is narrower, Claude Code only, built for one person on one subscription. The two can be used together. Aveto is independent and not affiliated with ECC.
Doesn't adding gates slow teams down?
It's the opposite trade. The reason most organizations cap agent autonomy is that they can't account for what agents did. Removing that uncertainty is what makes raising the ceiling defensible — the gates are how you go faster, not the tax you pay for it.
Which clouds are supported?
Azure today, AWS and GCP next, each wrapping the deployment engine you already use rather than replacing it. The gate, the attribution and the evidence format are identical across all three.
What happens when a deployment goes wrong?
Production verification checks the live service against the invariants the spec named and executes the rollback plan that was approved at spec review — no second approval round-trip, because that decision was already made deliberately. The executed rollback is itself surfaced as an audit event.
The documents
The specs are the product.
There is no hidden implementation. The specs below are the system — agents are generated from these files and the gates are enforced from them. Read the rules before trusting the claims.
Let the agents do more.
Aveto is open. Point the installer at a repo and it writes one least-privilege agent per role, the gates, and the commands to run a slice — on the Claude Code subscription you already have.