Plans that cite real code.

Every file the engine sees passes through the workspace broker — a trust boundary scoped to the root you chose. It confines reads to that root, denies .env, .git, and secret paths, and redacts secret tokens in-file rather than refusing the whole file, so config-heavy files still inform the plan without leaking credentials. Reads are byte-capped and can't escape the workspace.

A repo map plus a local embeddings index seed the planner with the structurally relevant code before any agentic reads. The model then pulls in specific files as it drafts — retrieval is scoped and purposeful, not a blind dump of the tree. Pass --semantic to add an on-device embeddings search, and --lsp to use an installed language server for compiler-exact references.

Each plan step references the files and symbols it touches, so a reader — or an agent — follows the plan straight into the codebase. A deterministic plan-lint checks every path:line citation against the real tree and flags any that don't resolve. An evidence manifest records what was read, and at what trust tier.

Link more than one repo when the work spans services; the broker routes reads by alias, each repo confined to its own root. As the code evolves, re-ground a plan to re-validate its citations — stale references get flagged.

Retrieval and embeddings run on your machine; nothing leaves unless you opt into an outbound call. What can leave is governed by the egress gate — see Egress & trust.