A plan you can read. A diff you can step through. An apply you authorize. Composer is the AI pair built for engineers who don't click “accept all”.
Composer returns a file-by-file plan before it touches code. Hunks stream in over SSE. Cancel mid-stream and partially apply what you've already accepted. The router picks across claude-opus-4, gpt-5, gemini-2.5-pro, and an on-prem llama-4-405b on cost, latency, and capability — and fails closed if a provider degrades.
Composer never writes ahead of you. The plan is the contract, the diff is the negotiation, the apply is the signature. Senior engineers run the loop with j/k/a/x. Reviewers see one commit with a message Composer drafted from the plan it just executed.
Composer lists every file it intends to touch, every hunk it intends to add, every test it intends to run — before any byte is written.
Every hunk renders with full surrounding context, syntax-aware. You step through with j/k. You reject, edit, or accept on the spot. Nothing is committed yet.
Accepted hunks land as a single working-tree write with a commit message Composer drafted from the plan. Rejected hunks vanish. Your editor stays in sync.
Composer routes each request across Anthropic, OpenAI, Google, and a self-hosted Meta deployment based on a policy you write. Capability score, latency budget, cost ceiling, residency. The gateway fails closed when fewer than two providers are healthy — no degraded mode, no silent fallback.
Every Composer call carries a typed RouteHint. The router scores live providers, picks a winner, and emits a receipt the workspace stores against the session. Reviewers can audit exactly which model wrote which hunk.
Every routing decision lands in the audit log with model, tokens, latency, and cost. Exportable to your SIEM. Queryable from your reviewer's commit page.
Composer treats the model the way you treat a contractor with shell access on day one — capable, watched, sandboxed. Four controls are wired into every session, enforced at the kernel, the gateway, and the prompt boundary. None of them are toggles you forget to flip.
External repositories — pulled-in dependencies, third-party clones, anything not on your tenant's allow-list — open in a read-only Composer session. No writes, no shell, no network egress. Reviewer trust is the default state, not the opt-in.
Every shell tool call routes through a per-tenant allow-list compiled from your security policy. Commands outside the list fail closed with a structured error the reviewer sees. No silent escalation, no implicit sudo.
Before any prompt leaves the workspace VM, a deterministic scrubber walks the payload against tenant-supplied secret patterns and 142 default rules. Matches are replaced with stable placeholders. The redaction map never reaches the model.
Each Composer microVM ships with a per-VM egress allowlist enforced at the kernel boundary. The model gateway is on it. Your private registry is on it. Everything else is denied — including DNS — and logged with the calling agent's typed identity.
The model writes character-by-character into a hunk that opens and closes around it. You can stop it mid-paragraph. Already- accepted hunks land. Pending hunks vanish. No half-applied state ever reaches your working tree.
Composer streams over Server-Sent Events. Tokens land first, then hunk-readyevents fire as soon as a hunk parses cleanly. You can accept hunks the moment they appear — you don't wait for the whole plan to finish.
Mid-stream cancel sends one byte upstream. The gateway acks within the next event boundary, the model billing stops, and the session moves to partial=true. Any hunks you already accepted commit as a single working-tree write. Any pending hunks are discarded. No retries you didn't ask for.
The protocol is open: every event has a stable shape, an id, and a typed payload. The workspace, the CLI, and your CI all replay the same stream.
Plan-diff-apply review. Multi-model router with fail-closed policy. Guardrails enforced at the kernel, the gateway, and the prompt boundary. The AI pair built for the engineer who reads every line before it lands.