Bubbly.
Your own coding agent, not a chatbot with autocomplete.
An AI engineering teammate your security team can actually approve. Bubbly plans the work, edits across files, runs the tests, and reviews its own changes: as a native desktop app or in the browser, on models you host yourself. Your source code never leaves the building, and a human holds the approval gate on every consequential action.
Control Plane
Desktop shell · CLI · Web · Bubble Room
Brain
Agent runtime · multi-agent mesh
Memory
Workspace index · spec store
Hands
Tool plane · sandbox · browser
The mental model: control plane → brain → memory → hands.
What your team gets
01
Whole features, delivered
From a plain-English request to planned, implemented, tested, and self-reviewed changes, across files, not one snippet at a time.
02
Spec mode for the big work
Requirements, design, and a task plan agreed with you before a line is written. Each task is executed by a focused worker and verified when done.
03
Sovereign by construction
Runs on your own models, on your own machines, inside your own perimeter. Full capability without a byte of source leaving the building.
Bubbly preview
Core axioms: five
A1
Artifacts are truth: conversations are just a view over state.
A2
Context engineering is the real product. Not the model, not the UI.
A3
Every tool call is a transaction: permissioned, logged, reversible.
A4
Agents propose. Policy decides. Humans approve.
A5
Long-term memory lives outside the chat window.
The trust model: four pillars
01
Visibility
The plan before execution. The live tool stream. Diff previews. Reasoning summaries for why decisions were made.
02
Interruptibility
Stop, redirect, or edit the plan at any point. The agent yields.
03
Determinism
The same task on the same codebase behaves consistently, enforced by steering rules and prompt versioning.
04
Recoverability
Everything undoable: snapshots for file changes, version history for specs, checkpoint restore for sessions.
Security architecture
- ◧Local sandboxing for shell commands: path whitelist, process limits
- ◧Separate process per MCP server; no shared memory
- ◧Secret scanning and redaction before anything reaches the model
- ◧Tool allowlists per workspace; approval prompts for rm, DROP, git push, prod URLs
- ◧Path sandboxing: the agent cannot escape the workspace
- ◧Network egress allowlisted by default; signed extension packages
Enterprise layer
- ⬡RBAC: developer, reviewer, admin, auditor
- ⬡Append-only, tamper-evident audit logs
- ⬡Air-gapped mode: no external API calls, local models only
- ⬡Local-only inference routing to on-prem endpoints
- ⬡Compliance packs. SOC2, HIPAA, PCI steering templates
- ⬡Model governance: approved list, version pinning · signed tool registry · SSO
Held to a benchmark
- ▸ Add auth to an app from scratch
- ▸ Fix a bug from a failing test
- ▸ Migrate a framework
- ▸ Generate tests for an untested module
- ▸ Rename a symbol safely across dozens of files
- ▸ Implement a full feature from a spec
Tracked on success rate, retries, token cost, latency, test pass rate, rollback frequency, and human corrections. Every prompt change triggers a full run: regressions block promotion.
The moat
Not the best base model. Context engineering, execution safety, memory for long-horizon work: and a human trust model built on visibility plus undo.
Next system · 07/07
Milkshake→Sovereign Education Ecosystem