Bubbly.
Agentic engineering, under containment.
Bubbly holds a plan, edits across files, runs the suite, and reviews its own diff before it asks for anything. It runs on models you host: Ollama on the engineer's own machine, or Cordon where the work has to be attested and logged. The source never leaves the perimeter, and every destructive action stops at a human gate.
Control Plane
Desktop shell · CLI · Web · Bubble Room
Brain
Agent runtime · multi-agent mesh
Memory
Workspace index · spec store
Hands
Tool plane · sandbox · browser
Identification
- Designation
- RGN-07 · Bubbly
- District
- Engineering
- Function
- Self-Hosted Coding Agent
- Source
- Open
Answers
“Our engineers want AI coding agents. The code can't leave.”
- Plan, build, test and review in one loop, with the diff reviewed before it is offered
- Spec mode: requirements, design, and tasks agreed with you before a line is written
- The Bubble Room: mission control over every agent run, with undo on everything
- Runs on Ollama locally or on Cordon for attested inference. No external API calls
What your team gets
01
Whole features, delivered
From a plain-English request to planned, implemented, tested, and self-reviewed changes, across files, not one snippet at a time.
02
Spec mode for the big work
Requirements, design, and a task plan agreed with you before a line is written. Each task is executed by a focused worker and verified when done.
03
Sovereign by construction
Runs on your own models, on your own machines, inside your own perimeter. Full capability without a byte of source leaving the building.
Core axioms: five
A1
Artifacts are truth: conversations are just a view over state.
A2
Context engineering is the real product. Not the model, not the UI.
A3
Every tool call is a transaction: permissioned, logged, reversible.
A4
Agents propose. Policy decides. Humans approve.
A5
Long-term memory lives outside the chat window.
The trust model: four pillars
01
Visibility
The plan before execution. The live tool stream. Diff previews. Reasoning summaries for why decisions were made.
02
Interruptibility
Stop, redirect, or edit the plan at any point. The agent yields.
03
Determinism
The same task on the same codebase behaves consistently, enforced by steering rules and prompt versioning.
04
Recoverability
Everything undoable: snapshots for file changes, version history for specs, checkpoint restore for sessions.
Security architecture
- ◧Local sandboxing for shell commands: path whitelist, process limits
- ◧Separate process per MCP server; no shared memory
- ◧Secret scanning and redaction before anything reaches the model
- ◧Tool allowlists per workspace; approval prompts for rm, DROP, git push, prod URLs
- ◧Path sandboxing: the agent cannot escape the workspace
- ◧Network egress allowlisted by default; signed extension packages
Enterprise layer
- ⬡RBAC: developer, reviewer, admin, auditor
- ⬡Append-only, tamper-evident audit logs
- ⬡Air-gapped mode: no external API calls, local models only
- ⬡Local-only inference routing to on-prem endpoints
- ⬡Compliance packs. SOC2, HIPAA, PCI steering templates
- ⬡Model governance: approved list, version pinning · signed tool registry · SSO
Held to a benchmark
- ▸ Add auth to an app from scratch
- ▸ Fix a bug from a failing test
- ▸ Migrate a framework
- ▸ Generate tests for an untested module
- ▸ Rename a symbol safely across dozens of files
- ▸ Implement a full feature from a spec
Tracked on success rate, retries, token cost, latency, test pass rate, rollback frequency, and human corrections. Every prompt change triggers a full run: regressions block promotion.
The moat
Not the best base model. Context engineering, execution safety, memory for long-horizon work: and a human trust model built on visibility plus undo.
Next system
08 / 08