Creator Engine turns your computer into a governed software factory. You frame the idea and ratify one gate — agents do the work, an external grader checks the evidence, station by station.
Point your coding agent at our , or copy-paste our one-liner into your Linux terminal. On Windows, use WSL2/Ubuntu and run the existing Linux installer inside WSL2; native Windows one-liner remediation is pending signed installer release if needed.
Install Creator Engine for me. First fetch https://creator-engine.dev/llms-install.md and follow its own §0 to confirm it's really from Creator Engine (do that verification quietly — don't narrate the crypto to me, just report "verified" with a one-line confirmation, or stop and tell me plainly if it fails). If I am on Windows, use WSL2/Ubuntu and stay inside WSL2. Then follow the verified spec to install CE and onboard my project.
curl --proto '=https' --tlsv1.2 -fsSL https://creator-engine.dev/install.sh | bash
CE never asks you to trust agent confidence. You ratify a Scope before work starts; an external grader checks the evidence after.
"Make a booking app for my workshop"
ce fanin inspect --packet PATH · ce ledger verify --side-effect-ledger-root PATH · ce checkThe same five words name every piece of work, from a one-line idea to a full feature. Each phase lands a ratifiable artifact anyone can replay from the repository alone.
Understand the idea, the risk, and what done should mean.
Turn it into a Scope: Goal, Done-when, Change-type.
The agent runs inside the ratified envelope, side effects captured.
The external grader checks evidence against Done-when.
A merged PR or ratified outcome — with the trail intact.
Runtime isolation contains an agent — but isolation doesn't decide whether the work was right, what it cost, or whether a human approved it. That's the layer we build.
An open, sandboxed place for a personal agent to execute. Contains the blast radius of a single run.
Bounds the task, caps the spend, routes risk to a human gate, grades the result from outside the agent, lands a repo-visible record.
"It'll spend a fortune looping."
Optional lane-aware caps can stop or split a run — bounded when your lane requires it.
"It'll change something dangerous."
Risk-tiered Change-type escalates deploy/secrets to the human gate.
"It'll leak my code or secrets."
Boxed isolation + a credential broker + a redaction gate — nothing leaks by default.
"How do I know it actually worked?"
An external grader checks Done-when — evidence, not the agent's say-so.
"What did it change, exactly?"
Every effect on a tamper-evident ledger — replayable from git clone.
"Who said it could ship?"
A named ratifier binds to the change — the privileged floor stays human.
CE is independent, repo-native, and inspectable. It can align with OpenShell-native machines without becoming a closed runtime or hiding governance behind a hosted service.
Work traces through spec, plan, tasks, Scope, and acceptance evidence.
Each run binds identity, permissions, Change-type, and a ratifier taxonomy.
docs, code, schema, deploy, governance, identity, security, attestation, redaction — plus a privileged floor. (The conserved mutation_class.)
The grader lives outside the agent. Done is a verdict, not a self-claim.
CE wraps your own coding agent instead of replacing the tool you already like.
Ledger, fan-in, validator output, and the report are replayable from a clone.
Start with the canonical Quickstart, then read the concepts, walkthrough, pilot path, contributor rules, and security model.
A rendered public overview of the governed agent-native delivery loop, with the architecture at a glance.
Open page -> InstallThe agent-native bootstrap spec with SSHSIG metadata, pinned artifacts, trust-root verification, and installer contract references.
Open doc -> QuickstartThe canonical copy-paste path: initialize CE brain, launch on the host backend, Shape, ratify, drive, report, and Ship.
Open page -> ConceptsThe enforced loop: Frame, Shape, Build, Review, and Ship through Scope records, evidence, and human touchpoints.
Open page -> User guideA plain-language guide to the five stages, Scope records, change types, and the outside-the-agent grader.
Open page -> WalkthroughThe full install-to-ship journey: Frame, Shape, Build, Review, and Ship one realistic Scope with CE.
Open page -> PilotThe end-to-end pilot path: install, inventory, repo provisioning, GitHub App authorization, and governed PR flow.
Open page -> ContributeThe human contributor on-ramp with trust tiers, authority boundaries, local setup, and review expectations.
Open page -> GuideFor developers in Dev mode: drive the pipeline yourself with ce commands — scope, ratify, drive, review, and gate the merge.
For developers in CEO mode: frame intent, let the agent run the pipeline, and ratify each gate — no slash commands required.
Open page -> SecurityThe security and redaction posture: privileged mutation classes, Source-only security ratification, and incident handling.
Open page ->Clone the open-source project, inspect the governance model, and build toward a world where every person can be a Creator — without handing unlimited authority to an agent. Open source, independent, runs anywhere; built for security with OpenShell.