Agent-native, Git-compatible version control

One deterministic gatekeeper

Agents never write to the repository. They propose; a daemon decides with a pure function of the log, the request, recorded evidence, time and the repository’s policy. No AI, no network, no randomness in the decision.

Capabilities, not accounts

A session gets narrow, expiring rights: paths, symbols, operations, size limits. Rights only narrow when handed to sub-agents, and revoking a session revokes everything derived from it. Agents hold no long-lived keys.

Symbol leases and a structural merge queue

Agents lease the functions and types they edit, so twenty agents can change twenty functions of one file in parallel. Every merged state is built and tested in a sandbox before it becomes trunk.

A signed log anyone can replay

Every operation, allowed, denied or escalated, is in a hash-chained, signed log that travels with git push. An independent auditor replays every decision and recomputes every fact and merge, and catches forgeries even when signed with the daemon’s own key.

Plain Git underneath

Content stays Git: GitHub and every Git tool keep working. Humans can work in a Lonca workspace or in their own Git checkout; Lonca’s records live in refs/lonca/*.

Humans approve, with presence when it matters

People review, approve, undo and revert. Approvals are signed with a file key or a Secure Enclave key with Touch ID; a hardened install runs the daemon as its own system user, out of the agents’ reach.

Works with Claude Code

Every hook, every tool, every release

Claude Code is the harness Lonca is built and checked against. Name it when you start a session and Lonca writes its MCP entry and hooks into the workspace; start claude there and every tool call goes through the gatekeeper.

SessionStart

The rules from the first turn

The session is bound to the daemon; the repository, the level and the rules are in the context before the agent does anything.

PreToolUse

Writes stay in the workspace

A write outside the workspace, to .lonca/ or to Lonca’s own files is denied before it happens. Fetches and shell commands are observed.

PostToolUse

Every write on the record

Writes are recorded as they happen, and news from other agents arrives mid-turn: a lease handed over, a change integrated.

Stop

No “done” with work left over

An agent that stops with unproposed changes is sent back to propose them, a bounded number of times.

lonca mcp

Leases, proposals, sync

Lonca’s tools are approved for the agent. While it runs, heartbeats go out and its leases renew themselves.

onFailure: block

Fails closed, proves it ran

A hook that can not reach the daemon blocks the tool. A call to Lonca that skipped its hook marks the session.

Claude Code's hook events and Lonca's MCP tools, each carried to the daemon by lonca hook or lonca mcp, with what the daemon does with them

lonca session start --repo demo --agent claude --paths 'src/**' \
      --workspace ~/ws/claude-1 --harness claude-code
cd ~/ws/claude-1 && claude           # hooks and lonca mcp are already set up

Lonca with Claude Code

Harnesses

Claude Code today, the others on the way

Lonca knows no harness in its code: each is a profile of data. Full support means its hooks can be shown to hold, so its sessions are trusted without a person approving every change. Every harness can already reach the highest level, isolated, inside lonca run.

Claude Code

Full support

Every hook event, the MCP server, managed settings for the hardened level, lonca run for isolated. Run live before every release.

Codex

Full support coming

Profile included: rules, MCP and hooks set up for you. Sessions are unobserved until its hooks can be shown to hold; isolated under lonca run.

Gemini CLI

Full support coming

Profile included, same as Codex: everything set up, changes wait for a person, isolated under lonca run.

OpenCode

Full support coming

Profile and plugin included, stop event through its idle hook. Isolated under lonca run.

IDE agents

Planned

GitHub Copilot, Cursor, JetBrains AI: any MCP client can use lonca mcp today, unobserved. Profiles and live runs to come.

Your harness

Data, not code

A harness is a table in the signed policy: its events, its tools, its setup. A new one needs no new Lonca.

Observation levels from unobserved to isolated; Claude Code reaches all four, other harnesses unobserved with hooks and isolated under lonca run

A session, start to end

A terminal recording: two agents lease different methods of one file, a lease that is held and a write outside a session's paths are refused, a human approves both changes, they merge, and lonca-audit verifies the log

Two agents on one file, recorded from the released binaries by docs/demo/demo.sh. The same steps, to type:

lonca daemon &                       # the gatekeeper (~/.lonca)
lonca human keygen ayse              # or: --secure-enclave
lonca init demo --import ~/src/myproject

# Give an agent a session and a workspace.
lonca session start --repo demo --agent claude --paths 'src/**' \
      --task T-142 --ttl 2h --workspace ~/ws/claude-1

# In the workspace, the agent (directly or through `lonca mcp`):
lonca lease acquire 'src/billing.rs#Client.charge' -i "rate limiting"
lonca propose -i "rate limit charge" --edits 'src/billing.rs#Client.charge'

# You review and operate:
lonca pending --repo demo
lonca approve 17 --repo demo
lonca-audit verify ~/.lonca/repos/demo.git

Other ways to install

brew tap selcukgural/lonca                    # Homebrew (macOS, Linux)
brew trust --formula selcukgural/lonca/lonca  # Homebrew 7 and newer
brew install lonca
cargo install --locked lonca lonca-audit      # crates.io, Rust 1.90+

Every release archive has checksums and a build provenance attestation (gh attestation verify lonca-<target>.tar.gz --repo selcukgural/lonca). See Install for hardened mode.