UNO
IN DEVELOPMENT

Python · Claude Code · Git · Application security · 2026

UNO is a local orchestrator for git repositories. I describe a task, a planner splits it into steps with roles (developer, code reviewer, tester, validation reviewer…) and I approve the plan before anything runs. Every agent works in isolation, its changes are reviewed and checked automatically, and nothing reaches my code without my final approval. I use it every day on my own projects.

The challenge

Giving AI agents autonomy without losing control. The design principle: every agent is an untrusted worker.

How it works

Approved plan: the planner proposes steps with a role, allowed files, dependencies, model and effort, and justifies each choice. I can change anything before approving.
Isolated execution: each step runs in its own git worktree and branch; independent steps run in parallel.
Review and corrections: reviewers return findings classified by severity and kind (defect or evidence). Medium and high defects go back to the developer automatically, within a round limit.
Deterministic checks: UNO itself runs the project's verification commands (build, tests) after each step and on the integration branch; the result is the evidence the reviewers see.
Human merge: everything is integrated on a separate branch. I see the consolidated diff, the findings and the checks, and only I merge.

Security controls

Least privilege: agents can only read and edit files — no shell, network or MCP servers.
Deterministic gate: each step declares which files it may touch; changes out of scope, on protected paths (CI, configuration, dependencies) or with possible secrets wait for my review.
Commands out of the model's reach: checks are defined by the user and run by UNO as an argument list, without a shell, in an environment with no keys or tokens, with a process-group timeout and redacted output.
Prompt injection: artifacts between agents travel as data labelled untrusted, and roles proposed by the planner can never widen the permissions of confirmed roles.
Configuration trust: roles, context and checks are hash-verified before every run (TOCTOU protection); any change requires a new confirmation.
Local-only interface: per-launch token, Origin/Host validation (CSRF and DNS rebinding) and a strict CSP.

Features

Prompt Studio: turns a short idea into a structured prompt (objective, scope, tasks, tests, acceptance criteria) with a deterministic linter and a versioned library.
Configurable roles: each project defines its roles, protected paths and checks in a .uno/ folder reviewed like code.
Spanish and English interface: chat with the orchestrator, live agents, review panel and event log.

Verification

Tests: 200+ unit tests plus a smoke test that attacks the live server.
Adversarial runs: with real agents: an out-of-scope agent was blocked and an injection attempt had no effect.
Real use: pilots on a Python/Next.js application and on this site, with changes merged after passing UNO's checks.
Threat model: documented, including residual risks.

Process

I designed the architecture, the threat model and the controls, and built it by directing Claude Code through PRs reviewed one by one. It is a private project in active development.