Olympus.

FactoryOps · Issue → validated PR · Plan → running app

The repo that ships
its own factory.

Olympus is a repository-local AI software factory — deterministic issue → validated pull request automation that lives inside the repo it automates. One clone, one command, and a coding agent is wired to your OmniRoute gateway, ready to run gated factory workflows with a cold CPU — and Studio puts the same gateway in the browser: agree a plan, describe an app, watch it build, run it, iterate in plain language.

Get started Stack doc
$ git clone https://github.com/innotelinc/olympus.git && cd olympus && bash scripts/bootstrap.sh
5 workflowsprime · implement · validate · regress · triage
~35 minIssue → Fix PR (fast lane)
Plan firstthe stack is agreed before code is written
Preview Itpackage, run, frame — under its own name
/adminthe deployment's own state, read-only
L0 by defaultmanual until a lap is watched

Deterministic — and visibly so.

The factory enforces what it reports and reports what it enforces — until a human has watched a real lap, nothing runs unattended.

Gated, not hopeful

Required markers, non-zero evidence counts, ratchet floors, and stop controls. Missing evidence is a failure, not a silent pass.

Protected by default

Governance files, the factory, the harness, locks, and the holdout are protected paths — agents that touch them as ordinary work are blocked.

Independent validation

The validator never reads builder reasoning or artifacts — it judges the issue, the base-branch governance, the diff, and the checks it runs itself.

Cold CPU, hot cloud

Heavy inference lives behind the OmniRoute gateway (Codex auto/coding + Hermes 3 via OpenRouter Free). Your CPU runs the gate and the factory workflows — not the model.

Observable

factory/doctor.py, factory/trigger.py --status, and Studio's read-only /admin panel tell you what is ready, what is blocked, and what is held — each check naming its own fix.

Human-owned judgment

Value, product language, scope, and irreversible actions stay human. The factory owns the mechanically checkable layer.

A factory, not a feature.

Five Archon workflows, a harness-as-contract, the machinery that enforces it, and the installer that wires it up.

factory/ · the machinery

gate.py · guard.py · merge.py · state.py · doctor.py · trigger.py — the state machine, safety gates, and visibility.

harness/ · the contract

ci.py · harness.config.json · journeys and the holdout — the definition of “working”, never edited to make a check pass.

.archon/workflows/factory/ · the workflows

Five YAML DAGs: prime → implement → validate, plus regress and triage.

scripts/bootstrap.sh · clone → ready

Installs the CLIs, mints the OmniRoute key, and wires both agents to the gateway in one command.

Cerulean Vault · SecretOps

KV v2 secrets with per-stack token scoping. Credentials are referenced as vault://<name> and resolved at startup — make setup bootstraps the store, scripts/secret-scan.py keeps secrets out of git.

# clone → ready
$ git clone https://github.com/innotelinc/olympus && cd olympus
$ bash scripts/bootstrap.sh

# run the factory manually at L0
$ python3 factory/doctor.py
doctor: ready
$ archon workflow run factory-implement \
  --branch factory/impl-42 "implement gh:issue:42"

$ archon workflow run factory-validate \
  --branch factory/val-42 "validate gh:pr:43"

# Studio — prompt → files → live preview
$ make studio-install && make studio-dev
listening on http://localhost:3001

# SecretOps via Cerulean Vault (KV v2)
$ docker compose -f compose.vault.yml up -d
$ python3 scripts/vault-bootstrap.py

One factory, five paths.

Each path is a separate workflow — independent, auditable, and fail-closed.

Primeinventory the repo + wire agents
Implementaccepted issue → open PR (watched)
Validateindependent judge of the PR + gate
Regressholdout + mutation checks for auto-merge quality
Triageclassify and route incoming issues
Doctorchecklist + blockers + autonomy at a glance
/adminthe deployment's state, one read-only page

Plan it, then it builds.

Studio is the browser front door to the same gateway — a plan you confirm, then a running app out, iterated in plain language.

Plan first · nothing is guessed

A planning turn decides the language, the install / build / start commands, the port and the files, and names the data target — its own container's database, or the self-hosted Convex Atlas runs. Confirm it and the code is written against it.

Prompt → preview · live

The model answers with complete files as <file path="…"> blocks. Studio parses them as they stream and renders the result immediately — partial blocks are simply ignored until they close.

Preview It · a real runtime

Packages what is on screen, runs it and frames it on <slug>-preview.<suffix> — a real container, seconds to serve, under a name of its own. The project's own name is never registered by a preview.

Sandboxed · untrusted output

App output runs in an iframe with allow-scripts and no same-origin, so it cannot reach Studio's DOM, cookies, or storage. It has no network access either.

Authentik OIDC · identity

Authorization Code + PKCE, id_token verified against the provider JWKS, signed session cookie — no server-side session store. Auth stays off until it is configured.

Key stays server-side · by construction

The gateway credential is read inside the route handler only. It is never sent to, or bundled for, the browser.

# run Studio
$ make studio-install && make studio-dev
listening on http://localhost:3001

# or bring up the stack
$ docker compose up -d studio

# the deployment's own state, read-only
$ open https://studio.olympus.innotel.us/admin
checks · gateway · runner · queue · builds

# prove it still works
$ make studio-test
all passing

Roadmap.

Shipped, in development, and next. The full list lives in docs/roadmap.md — and autonomy is earned: each rung needs a watched lap and explicit evidence before it is configured.

0.1“The builder”

Studio, the Olympus TUI, and the plan → stream → package → run → publish engine, with the build runner and the saved-app store.

shipped
0.2“Operator surface”

/admin, plan-before-build, Preview It, one gateway door, tenancy through Distro's control plane, and build-runner hardening. Open: the gateway / model-chain convergence.

in development
0.3“Dispatch”

Arm the dispatcher after a watched lap, and fold publish-time observability into the job record and the panel.

next
Later“Validate · holdout”

Independent validation on its own branch and deterministic merge; the hidden holdout + mutation ratchet as the auto-merge contract. ONYX storage stays on hold.

later

Autonomy ladder

L0 “Manual”

Everything manual — nothing unattended until a human has watched a real implement + validate lap.

current
L1 “Dispatch”

Dispatcher armed only after a watched lap — queued accepted issues → watched implement runs.

0.3
L2 “Validate”

Independent validation on a separate branch + deterministic merge after gate agreement.

later
L3 “Holdout”

Hidden holdout + mutation ratchet as the auto-merge contract.

later