FactoryOps · Issue → validated PR · Prompt → running app
The repo that ships
its own factory.
Olympus is a repository-local AI software factory — deterministic issue → validated pull request automation that lives inside the repo it automates. One clone, one command, and a coding agent is wired to your OmniRoute gateway, ready to run gated factory workflows with a cold CPU — and Studio puts the same gateway in the browser: describe an app, watch it build, iterate in plain language.
$ git clone https://github.com/innotelinc/olympus.git && cd olympus && bash scripts/bootstrap.sh
Deterministic — and visibly so.
The factory enforces what it reports and reports what it enforces — until a human has watched a real lap, nothing runs unattended.
Gated, not hopeful
Required markers, non-zero evidence counts, ratchet floors, and stop controls. Missing evidence is a failure, not a silent pass.
Protected by default
Governance files, the factory, the harness, locks, and the holdout are protected paths — agents that touch them as ordinary work are blocked.
Independent validation
The validator never reads builder reasoning or artifacts — it judges the issue, the base-branch governance, the diff, and the checks it runs itself.
Cold CPU, hot cloud
Heavy inference lives behind the OmniRoute gateway (Codex auto/coding + Hermes 3 via OpenRouter Free). Your CPU runs the gate and the factory workflows — not the model.
Observable
factory/doctor.py and factory/trigger.py --status tell you what is ready, what is blocked, and what is held — every rung.
Human-owned judgment
Value, product language, scope, and irreversible actions stay human. The factory owns the mechanically checkable layer.
A factory, not a feature.
Five Archon workflows, a harness-as-contract, the machinery that enforces it, and the installer that wires it up.
factory/ · the machinery
gate.py · guard.py · merge.py · state.py · doctor.py · trigger.py — the state machine, safety gates, and visibility.
harness/ · the contract
ci.py · harness.config.json · journeys and the holdout — the definition of “working”, never edited to make a check pass.
.archon/workflows/factory/ · the workflows
Five YAML DAGs: prime → implement → validate, plus regress and triage.
scripts/bootstrap.sh · clone → ready
Installs the CLIs, mints the OmniRoute key, and wires both agents to the gateway in one command.
Cerulean Vault · SecretOps
KV v2 secrets with per-stack token scoping. Credentials are referenced as vault://<name> and resolved at startup — make setup bootstraps the store, scripts/secret-scan.py keeps secrets out of git.
# clone → ready $ git clone https://github.com/innotelinc/olympus && cd olympus $ bash scripts/bootstrap.sh # run the factory manually at L0 $ python3 factory/doctor.py doctor: ready $ archon workflow run factory-implement \ --branch factory/impl-42 "implement gh:issue:42" $ archon workflow run factory-validate \ --branch factory/val-42 "validate gh:pr:43" # Studio — prompt → files → live preview $ make studio-install && make studio-dev listening on http://localhost:3001 # SecretOps via Cerulean Vault (KV v2) $ docker compose -f compose.vault.yml up -d $ python3 scripts/vault-bootstrap.py
One factory, five paths.
Each path is a separate workflow — independent, auditable, and fail-closed.
Describe it, and it builds.
Studio is the browser front door to the same gateway — prompt in, a running app out, iterated in plain language.
Prompt → preview · live
The model answers with complete files as <file path="…"> blocks. Studio parses them as they stream and renders the result immediately — partial blocks are simply ignored until they close.
Sandboxed · untrusted output
App output runs in an iframe with allow-scripts and no same-origin, so it cannot reach Studio's DOM, cookies, or storage. It has no network access either.
Authentik OIDC · identity
Authorization Code + PKCE, id_token verified against the provider JWKS, signed session cookie — no server-side session store. Auth stays off until it is configured.
Key stays server-side · by construction
The gateway credential is read inside the route handler only. It is never sent to, or bundled for, the browser.
# run Studio $ make studio-install && make studio-dev listening on http://localhost:3001 # or bring up the stack $ docker compose up -d studio # prove it still works $ make studio-test 100 passing
Roadmap.
Autonomy is earned — each rung needs a watched lap and explicit evidence before it is configured.
Everything manual — nothing unattended until a human has watched a real implement + validate lap.
currentDispatcher armed only after a watched lap — queued accepted issues → watched implement runs.
nextIndependent validation on a separate branch + deterministic merge after gate agreement.
laterHidden holdout + mutation ratchet as the auto-merge contract.
later