Cadence

configure branch protection + required checks if you need to enforce

Install & requirements

npm install -g @delegance/cadence

Migrating from the old name? npm uninstall -g @delegance/claude-autopilot && npm install -g @delegance/cadence. The legacy claude-autopilot CLI continues to work as an alias through v8.x.

• Node 22+
• gh CLI (for PR phases)
• One of: ANTHROPIC_API_KEY (recommended), OPENAI_API_KEY, GEMINI_API_KEY, or GROQ_API_KEY
• Claude Code CLI (for skill-based phases — pipeline falls back to direct CLI invocations without it, but loses interactive checkpoints)
• superpowers Claude Code plugin (required for pipeline phases — cadence doctor will remediation-hint if missing)

---

---

Install

npm install -g @delegance/cadence

One-shot setup — detects stack, writes config, installs skills, sets hooks

cadence init

Deploy phase

Configure your deploy target in guardrail.config.yaml under a deploy: block. Four adapters ship in 5.6:

• vercel — Vercel v13 deployments API. SSE+NDJSON log streaming, native rollback via /promote. Auth: VERCEL_TOKEN.
• fly — Fly.io Machines API. WebSocket log streaming, native rollback with simulated fallback. Auth: FLY_API_TOKEN. Requires the image to be pre-pushed (fly deploy --build-only --push).
• render — Render REST API. Polling-based log stream with (timestamp, logId) cursor dedup, simulated rollback (re-deploys prior commit). Auth: RENDER_API_KEY.
• generic — runs any shell deployCommand (vercel --prod, kubectl apply, make deploy, etc). No platform integration; --watch and rollback aren't supported.

Each adapter speaks the same DeployAdapter contract: deploy(), optional status() / rollback() / streamLogs(), plus a capabilities block (streamMode: 'websocket' | 'polling' | 'none', nativeRollback: boolean) so the CLI can degrade UX honestly (polling adapters print a one-line stderr notice under --watch). Auto-rollback is bounded: max one rollback per deploy attempt, with runHealthCheck capped at 5×6s. Log lines emitted into PR comments run through a redaction pass (AKIA…, sk-…, eyJ…, ghp_, xoxb-, plus configurable patterns) so build output can't leak secrets.

Example (Fly):

deploy:
  adapter: fly
  app: my-app
  image: registry.fly.io/my-app:latest
  region: ord
  watchBuildLogs: true
  healthCheckUrl: https://my-app.fly.dev/health
  rollbackOn: [healthCheckFailure]

cadence doctor checks for the relevant auth env var when an adapter is configured. See docs/specs/v5.6-fly-render-adapters.md for the full adapter contract.

Setup Profiles

guardrail setup --profile <name> overlays a pre-baked rule + policy configuration on top of the detected stack preset:

— set AWS_REGION explicitly for non-us-east-1 Bedrock deployments where

Install: npm install @aws-sdk/client-bedrock-runtime

**Azure OpenAI:**

AZURE_OPENAI_DEPLOYMENT_NAME (deployment name, not model name).

Install: npm install cohere-ai

**Mistral:**

(Reuses the OpenAI SDK — no separate install required.)

```

---

2. CI — only new findings block the build

npx guardrail ci --new-only --fail-on critical

1. Install the CLI

npm install -g @delegance/cadence

30-second quickstart

```bash

→ merges with your configured permissions (default is admin-squash;

guardrail.config.yaml

engine: enabled: true # default in v6.1+; explicit false is deprecated and removed in v7 budgets: perRunUSD: 10 # hard stop; mandatory runtime guard perPhaseUSD: 5

Every state transition appends a typed event to .guardrail-cache/runs/<ulid>/events.ndjson; every CLI verb supports --json with strict stdout-envelope / stderr-NDJSON channel discipline. Side-effect phase replay consults persisted externalRefs plus a live provider read-back so resume is safe by construction.

v6.1+ ships with the engine ON by default (flipped from v6.0's off-by-default after the stabilization criteria in docs/specs/v6.1-default-flip.md were met). Users who want the legacy v5.x output shape can opt out for one minor version via --no-engine, CLAUDE_AUTOPILOT_ENGINE=off, or engine.enabled: false — each prints a deprecation warning and is removed in v7.

→ docs/v6/quickstart.md — five-minute setup → docs/v6/migration-guide.md — full v5.x → v6 walkthrough with precedence matrix, per-phase idempotency rules, and troubleshooting

Config (`guardrail.config.yaml`)

```yaml configVersion: 1 reviewEngine: adapter: auto # auto-selects best available key at runtime testCommand: npm test # null to disable; used by fix verified mode

protectedPaths: - data/deltas/ - .github/workflows/

staticRules: - hardcoded-secrets # Anthropic, OpenAI, Stripe, GitHub, Supabase, Twilio, SendGrid - npm-audit - sql-injection # template literals / concatenation in SQL context - missing-auth # Next.js/pages API routes with POST/PUT/DELETE, no auth pattern - ssrf # HTTP calls with user-controlled URL - insecure-redirect # redirect() with user-controlled target - console-log - todo-fixme - large-file - missing-tests - package-lock-sync - brand-tokens # opt-in: requires brand: block below

config / env vars (AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, optionally

task role and NOT set static keys in env.

Region: resolved from options.region → AWS_REGION env → us-east-1 default.

The AWS SDK's own profile/SSO-config region resolution is NOT consulted

Env: AZURE_OPENAI_API_KEY, AZURE_OPENAI_ENDPOINT

Optional: AZURE_OPENAI_API_VERSION (default 2024-10-21).

**Cohere:**

Env: COHERE_API_KEY

Env: MISTRAL_API_KEY

Credentials: resolved via the AWS SDK default credential provider chain —

The pipeline, phase by phase

Each phase is a Claude Code skill (.claude/skills/<name>/SKILL.md). You can invoke any phase directly (/brainstorm, /plan, /migrate, /validate) without running the full pipeline. You can also rewire the pipeline by editing the autopilot skill.

Typical Team Workflow

```bash

Why this vs the alternatives

Four things only this product gives you:

1. No hosted workspace or remote sandbox. Your repo stays on your machine. No third-party agent runtime, no SaaS-side orchestration, no per-seat markup. Model prompts (diffs, file context, design questions) are sent to whichever LLM providers you've configured (Anthropic / OpenAI / Google / Groq / Ollama-local). For a truly local-only setup, you must point every model used by the entire execution path at a local endpoint: that includes the Claude Code agent runtime itself (configure a local Claude Code provider) AND the autopilot review adapter (openai-compatible pointed at Ollama). Pointing only the review adapter at Ollama still ships prompts/diffs to Anthropic via Claude Code. For most teams, local-only isn't the goal; "no hosted orchestration + your existing provider keys" is.
2. Risk-tiered review depth (policy-driven). Specs declare risk: low | medium | high in frontmatter. The autopilot skill runs 1 / 2 / 3 sequential Codex passes accordingly, each with a remediation cycle in between. Enforcement is encoded in the skill (an LLM-driven instruction set, not a hard CLI gate) so it's auditable and editable: read .claude/skills/autopilot/SKILL.md, swap the tier rules for your codebase, expand the auto-escalation keyword list. Designed for teams that want review depth to scale with change risk instead of running forensic-grade review on every typo.
3. Ships as a Claude Code skill, not a competing IDE. /brainstorm, /autopilot, /migrate, /validate are first-class Claude Code commands. As Claude Code grows, autopilot rides that adoption. You don't switch tools to use it; it's already there.
4. Multi-model council, available as a verb. cadence council dispatches the same diff or design question to Claude + Codex + Gemini in parallel and synthesizes the consensus. Wire it into the autopilot pipeline by editing .claude/skills/autopilot/SKILL.md Step 7, or invoke standalone for one-off design decisions. The default pipeline uses sequential Codex review (cheaper, faster, often sufficient for routine changes); council is the higher-rigor option when you want broader model diversity.

Plus the four practical differences:

• Multi-model by role. Claude writes code, Codex reviews the plan, bugbot triages PR findings. Swap any of them.
• Your stack, not a sandbox. Runs your npm test, your prisma migrate, your gh pr create. If it works in your terminal, it works in the pipeline.
• Phase artifacts on disk, editable. Every phase writes to a file you can open — docs/specs/*.md, docs/plans/*.md, a branch, a PR. Stop, edit by hand, resume, or re-run any phase in isolation.
• Test-gated auto-revert. cadence fix --verify patches a file, runs your tests, reverts on failure. Built into the CLI, not a wrapper.

Real numbers from a real run: DEMO.md — autonomous multi-file change on a Python codebase, 12 minutes, $2.20, zero manual intervention.

Answer ~5 questions. Spec written. Codex reviews it. You approve.