The one copy of your code

• The copy running on the server

  What answers a request right now. It may not match anything saved anywhere else, if it was ever edited by hand after a deploy.

  Cannot be briefed against

• The archive someone emailed you

  A zip, a folder export, a download from a freelancer who moved on. It is a snapshot, not a history — one moment, frozen.

  Cannot be briefed against

• The repository

  Every change, in order, with who made it and why. This is the one a brief can be written against — a change is a diff from a known point, not a guess against a snapshot.

  Can be briefed against

• The account is yours

  Your code host account stays in your name and under your control, whether we work in it or set one up for you.

• We hold read access

  Enough to build and deploy what you already approved. The matrix below says exactly what that does and does not extend to.

• We never hold the only copy

  Your code host holds the repository. We build from it; we do not become the one place it lives.

1. 1

   A repository you already have

   What we do

   Ask for read access, then build and deploy straight from it. Nothing is copied out or re-created.

   Whose time it takes

   5 min of yours, to grant access.

   The honest limit

   None. This is the state every other page on this site assumes.

2. 2

   Code that only lives on the running server

   What we do

   Pull the files off the live instance and put them into a new repository, on your account.

   Whose time it takes

   Your time only to confirm server access. The import itself is ours.

   The honest limit

   A server pull has no history before the day it is imported. Every earlier change is gone — there was never a record of it to begin with.

3. 3

   An archive or export

   What we do

   Unpack it and commit it into a new repository as a single starting point.

   Whose time it takes

   Time to send the file, nothing more.

   The honest limit

   Same as a server pull: history starts on the day it is imported, not before.

4. 4

   No code yet

   What we do

   Set up an empty repository on your account before the first line is written.

   Whose time it takes

   None. There is nothing to hand over yet.

   The honest limit

   Nothing to import means nothing to lose — this is the one state with no honest limit attached.

• A runnable build

  One command turns the repository into a running app. Without it, every change needs guesswork before it can even be checked.

  Only your own code can supply this

• A lockfile

  Pins every dependency to the exact version it was built and tested against, so a build today matches a build next year.

  A briefed change can do this

• No committed secrets

  A key or password in the code is readable by anyone who can read the repository. A briefed change moves the value out into configuration. The commit that first held it still stays in the history.

  A briefed change can do this

• Conventions to follow

  A consistent file layout and naming pattern, so a change fits the existing shape instead of starting a second style next to it.

  Only your own code can supply this

• A README

  What the project is, and how to run it, in one place — the first thing a brief gets checked against.

  A briefed change can do this

• Some tests

  A way to tell a change did what it meant to before it ships. A briefed change can set up a first test harness. What to assert in it is yours — it needs your own knowledge of what correct looks like. Most small applications start with none, and that is honestly common.

  We brief the setup; the substance is yours

• A found secret is treated the same as a leaked one: rotated immediately, not left in place because it has not caused a problem yet.
• The commit that added it stays in the history — a repository cannot un-happen a past commit — but the value itself stops being valid the same day.

• A person leaves

  Anything they held a key to on our side is revoked the same day — the same rule joiners and leavers already sets. Access — joiners and leavers.

• A value leaks

  Treated as a live incident: the value is rotated, and the exposure is worked the way any leaked credential is. Under attack — password guessing.

• A scheduled rotation

  Send the replacement value whenever you choose — there is no console click, only the same quote channel as any other change. Access — secrets.

• We work in yours

  Most repositories already live with a code host you picked. We connect to that account rather than asking you to move.

• Or we set one up in your name

  If there is no account yet, one is created for you, under your name — see "no code yet" above.

A code host is a service we do not run, so the same limit applies to it as to anything else outside our stack. Third-party outages, we cannot fix. A dependency living in a service we do not run goes down on its own schedule, not ours. If your host is down, we cannot deploy from it until it is back. What is already live keeps serving.

• Nothing to hold a repository

  A repository itself carries no separate line on the rate card — it is not a resource we meter.

• The import is inside onboarding's minutes

  Granting access or sending an export is part of the 55-minute handover already counted on Onboarding, not a separate charge.

• Agentic iteration — CodeHerder

  $25/mo. This add-on is what pays for changes made in the repository, not for holding it. Brief a change in plain words. An agent opens a pull request, a person reviews it, and the same pipeline ships it.

• 132changes shipped, 2026-07-07 to 2026-10-03
• 87live routes on the site directory
• 1984file changes, every merge in this repository's history counted
• +106160 / −12108lines added and removed, across every merge

1. 1

   check:anchors

   Every hub page's "On this page" index still matches its own numbered bands, in order.

2. 2

   check:a11y

   Every route is crawled for accessibility faults, at two sizes, in both themes.

3. 3

   check:ledger

   The public build-history page still matches what this repository's own history says.

4. 4

   check:llms

   The machine-readable site directory lists every route exactly once, and every link actually resolves.

5. 5

   check:perf

   Every route stays inside its own published page-weight budget.

6. 6

   check:security-txt

   The security-contact file is present, and not expired.

7. 7

   check:supply-chain

   The dependency-safety rules — locked versions, no install scripts, a release cooldown — are still in place.

8. 8

   check:seo

   Every route carries one canonical URL, one title, one description, and valid structured data — and nothing meant to stay out of the index does.

9. 9

   check:forms

   The form page's own field caps, its POST-only check, its honeypot field, and its log retention still match the real contact-form terraform.

10. 10

    check:images

    Every image stays under its published weight ceiling, and every picture carries alt text, its dimensions, and a loading value.

11. 11

    check:limits

    Every module that publishes a limits array is collected on /limits, and its published count matches what the page actually renders.

12. 12

    check:logins

    No password input exists anywhere on the site, every form carries a known id with no off-site action, and /logins' own worked artifact still renders.

13. 13

    check:compliance

    No affirmative compliance or certification claim appears anywhere on the site, and /your-data's residency and deletion bands still render.

14. 14

    check:spacing

    No run-together word slipped past a stripped space next to a link or other inline element, on any route.

15. 15

    check:reveal

    Every section that fades in on scroll actually appears, on a phone-sized screen as well as a desktop one.

16. 16

    check:twins

    Every route's Markdown twin exists, starts with the page's real heading, carries no stray HTML, and is linked from the page exactly once.

17. 17

    check:quotes

    No published quote bills an add-on its plan already includes, and the estimator prices only through the same code as the quote form.

• Application repository

  Full git history — Every commit that ever touched it, not a snapshot.

• CodeHerder brief-and-pull-request history

  Already in the repo — The record of every change ever briefed and shipped, kept with the code it changed.

• No history before the import

  Code pulled off a running server starts its history on the day it is imported.

• We do not write your test coverage

  A briefed change can add a missing README, a lockfile, or a first test harness. It cannot decide what your tests should assert. That needs your own knowledge of the domain.

• A committed secret can't be un-committed

  Rotating the value stops it from working. The commit that once held it stays in the repository's history.