Softsensor product · Open source · Apache-2.0 core

The governed execution layer for AI coding agents.

Teams now run fleets of coding agents and production-facing MCP tools. Concord gives each task a governed harness — code, deploy, live investigation, bootstrap job, or data product — and records the proof in a single source of truthful intelligence.

✈️ Air-traffic control for code, runtime evidence, data contracts and deploy checks — across Claude · Codex · Gemini
Runs Softsensor's own delivery 15+ production AI projects 1,400+ governed changes 18 agents in parallel on one project This site's changes run as Concord tickets
Across the SDLC

From requirement to runtime, one governed record.

Concord follows agent work through every stage of delivery, not only the pull request.

The problem

Enterprises adopted agents faster than they can govern them.

Running parallel coding agents is now a commodity — four in five organizations adopted AI development tools faster than their governance policies could keep up. The unsolved part is proving what happened: before merge, after deploy, and inside production-facing work.

Provenance

No one can say who wrote it

43% of organizations can no longer reliably distinguish agent-written code from human code. When the audit comes, “which agent did what, under which policy, with whose approval” has no answer.

Controls

Change control collapses

An agent can request, write and act in seconds — collapsing segregation of duties into a single log line. SOC 2, SOX and GxP obligations don't care how the code was generated.

Blast radius

Agents touch production

Agents with MCP access read and change live systems — and the evidence of what they saw and did scatters across terminals and chat logs, gone by the time anyone asks.

Figures: GitLab AI Accountability Report (Harris Poll, June 2026). Gartner predicts over 40% of agentic AI projects will be cancelled by 2027 — cost, unclear value and inadequate risk controls; the projects that survive are the ones that can prove control.

The critical capability

One control plane for the whole engineering fleet.

The agents are the workforce; Concord is the control plane that coordinates them, gives each a role, and accounts for everything they do — across repos, providers, runtime tools, and proof types.

Coordinate

Parallel, without collisions

Every agent works in its own git worktree behind a per-ticket lock — so a fleet runs in parallel, across many repositories, with clear ownership and fewer collisions.

  • Own worktree + branch per ticket
  • One owner, one lock
  • Multi-repo by design
Orchestrate

A team, not a swarm

Governed roles take work from plan → build → review → test → land, in either topology: independent agents, or an orchestrator directing sub-agents.

  • Role skills: planner · coder · reviewer · QA · lander
  • Two governed topologies
  • Provider-agnostic: Claude · Codex · Gemini · Grok
Account

Who did what, on the record

Every lifecycle transition is attributed to a specific agent, under a specific reviewer, in an append-only journal — so multi-agent work can be replayed and audited.

  • Per-agent provenance
  • Append-only, tamper-evident journal
  • Source-vs-landed commit lineage
Multi-repoMulti-providerTrack-specific gatesRuntime receiptsApache-2.0 core
The governed lifecycle

Govern → Gate → Record → See.

Every unit of agent work runs the same path — and lands in a tamper-evident journal. The proof changes by track, so a live production read is not verified like a code diff.

01 · GOVERN

Isolated work

Worktree + branch + lock per ticket. Many agents, many repos — no collisions.

02 · GATE

Right proof

Tests for code, content checks for pages, receipts for live-MCP work, data contracts for analytics, deploy evidence for runtime work.

03 · RECORD

Append-only journal

Every transition recorded with actor and provenance — a verifiable history of who did what, under whose review.

04 · SEE

Operator cockpit

A read-only web view renders the board, traceability, gates, live-MCP receipts, bootstrap risk, runtime health and timeline.

To do
CASE-204
Evidence-gated closure
Doing
RISK-077
SLA auto-escalation
2 gates
Review
INTEL-006
Translation svc
4/4
Done
COORD-019
Evidence export
landed ✓
4182 {"event":"gate.passed","ticket":"RISK-077","actor":"agent:claude/s-9c4"}
4184 {"event":"landing.recorded","reviewer":"human:dchen","status":"complete ✓"}

The cockpit shows the evidence, live

  • Board & timeline — kanban plus the full event log
  • Traceability — requirement → implementation closure & feature proof
  • Gates & health — quality, runtime and deploy-gate artifacts
  • Live evidence — scoped MCP receipts, bootstrap-risk checks, waivers and config posture
  • Pipeline — landing & PR provenance (source vs landed commit)
What is new

One lifecycle. Different proof harnesses.

Concord now governs more than code diffs. It gives each work type the evidence standard it actually needs, while keeping one board, one journal and one recovery model.

Development

Code work proves tests and review

Per-ticket worktrees, locks, review cycles, feature proof, contract checks, quality dimensions and source-to-landed commit lineage.

  • Architecture, coverage and audit checks; mutation, SAST and supply-chain adapters once the tool is configured
  • Fail-closed review before landing
  • Recovery when an agent stalls or dies
Runtime

Live work proves receipts

Production-MCP investigations, deploy checks and bootstrap/backfill jobs record scoped, redacted, source-cited evidence instead of relying on "readyz returned 200".

  • Operation classes and approval posture
  • Deploy identity and verify/falsify records
  • Cleanup proof for temporary access
Data & memory

Data products prove contracts

Analytical products certify data contracts, row-count reconciliation, lineage and quality gates. The same journal feeds governed memory: cited decisions, summaries and recall.

  • Certified-only-feeds-certified lineage
  • Before/after row-count proof
  • Decision memory and execution insights
What ships

Nine capability pillars, labelled by edition.

Everything below ships in the open-source Community edition except Enterprise visibility. As of v0.1.16.

1 · Coordinate agentsCommunity

Parallel agents, clear ownership

Each agent works in its own git worktree and branch behind a per-ticket lock, which reduces collisions between parallel agents.

  • Owner leases, with resume, rebind and takeover for stalled agents
  • Independent or orchestrated topologies: Claude, Codex, Gemini, Grok
  • gov doctor and recover, plus governed landing

Worktrees separate repositories; they are not a sandbox.

2 · Record and verifyCommunity

Every ticket closes with its evidence

Plan records capture what was asked, built, not built and deferred, with the exact verification commands.

  • Structured self-review cycles, each with a lens, risks and findings
  • Feature proof checked against the canonical branch at landing
  • Hash-chained journal of lifecycle operations; one ed25519 attestation signs the chain head

The journal covers Concord lifecycle operations, not every agent tool call.

3 · Requirements assuranceCommunity

Traceability from URS to evidence

Import the URS or PRD you already have, with stable IDs and source anchors, then trace each requirement to tickets and evidence.

  • Baseline gate for missing or unstable requirements
  • Requirement → ticket → evidence matrix, with change impact
  • Conformance states, including Defect for implemented-but-wrong
4 · Knowledge and decisionsCommunity

Memory agents can trust

Business discovery maps an existing repo with confidence levels, so current behaviour is not mistaken for intended behaviour.

  • Knowledge compiler rejects prompt injection and quarantines secrets
  • Cited recall and prework context packs
  • High-impact changes need an accepted ADR or waiver before review
5 · Verify qualityCommunity

Gates sized to risk

Every ticket gets a risk class from R0 to R4 and a computed gate plan; high-risk work without proof cannot enter review.

  • default, full and ci gate lanes
  • 12 testing dimensions, including mutation testing
  • SAST, supply-chain, accessibility and performance adapters run once the tool is configured
6 · Runtime evidenceCommunity

Proof for live work, not only code

Five governed tracks, each with its own evidence: development, content, devops, live operations and data.

  • Live-MCP operation classes, approval, redaction and receipts
  • Deploy identity checked against the landed commit; verify and falsify
  • Data contracts with row-count reconciliation and lineage
7 · See and exportCommunity

Evidence you can hand over

A read-only cockpit shows the board, gates, requirements, decisions and runtime evidence. It shows commands; it never runs them.

  • OpenTelemetry export of journal events
  • Audit evidence export mapped to EU AI Act and NIST AI RMF, gaps flagged
  • Cost recorded per change
8 · Adopt and upgradeCommunity

A reviewed install, new or existing

npx create-concord plans the install and applies only the digest you reviewed, for a new project or an existing workspace.

  • Track presets and workflow packs (site SEO, daily analytics)
  • Pinned upgrades that roll back on failure
  • Standalone Linux binary for machines without Node
9 · Enterprise visibilityEnterprise

One view across many teams

Read-only collection from many repositories into one warehouse, with per-repo throughput, cost, staleness and gate health.

  • Central re-hash verification and a signed org bundle
  • Discovery of boards teams started on their own
  • Deny-by-default RBAC broker

SSO, SIEM export and KMS-backed signing are a defined path, not live controls.

Proven, not theoretical

Concord runs Softsensor's own delivery.

This isn't a framework we hope you'll try — it's the governed execution layer behind our production AI. Our delivery teams run their agent work through it — the “single source of truthful intelligence” we named in 2020, now the system we run on.

PORTFOLIO

15+

Production AI projects governed end-to-end — pharma, clinical, claims, education, hospitality, logistics and data.

THROUGHPUT

1,400+

Governed, evidence-backed changes shipped — each attributed, gated and journaled.

CONCURRENCY

18 in parallel

Peak concurrent agents on a single project — dozens a day — coordinated through per-ticket locks.

DOGFOOD

Runs this site

Since September 2026 every softsensor.ai change is a Concord ticket: planned, gated in CI and landed through a reviewed pull request.

Across these projects Concord has coordinated 500+ agent identities over 1,200+ sessions and 17,000+ governed events — both orchestrated sub-agents and independent terminal agents, governed identically. Figures reflect Softsensor's own governed delivery; client names are withheld for confidentiality.

Lineage: Concord grew out of AI Agent Setup — our open-source, skill-aware tooling for standing up Claude, Codex and Gemini on any repo (2025, Apache-2.0). First we made agents easy to set up; then we made them accountable.

Why Concord

Rulesets tell you a check ran. Auditors need more.

The question has moved from “did a check run?” to “which agent did what, under which policy — and can you prove it?” Branch protection governs the pull request. Concord governs the agent work before the PR — and turns it into a record an auditor can use.

GitHub / GitLab rulesets + CIThe pull request is governed

Required checks, protected branches, CODEOWNERS, approvals. Strong process enforcement — but no record of which agent did what before the PR, no runtime proof after deploy, and no governed memory of the decision trail.

ConcordThe work is governed — and on the record

Task locks, per-ticket worktrees, requirement closure, agent provenance, track-specific proof, runtime receipts, fail-closed review and governed memory — across providers, repositories and live engineering workflows.

Built for the audits you already have

Evidence your existing controls can use.

AI coding agents and MCP-powered runtime work don't remove SDLC, CSV or change-control expectations. Concord is built for the regimes you already answer to — producing review evidence, traceability, runtime receipts and change history as a by-product of the workflow.

Change control

SOC 2 · SOX ITGC · ISO 42001

Per-change closure, review cycles and an attributable audit trail — the records these regimes ask for.

Regulated SDLC

GxP · FDA CSA (building toward)

Traceability and fail-closed, control-mapped export — aligned to the direction of the FDA's Computer Software Assurance guidance (records over screenshots).

AI governance

EU AI Act · NIST AI RMF

Indicative control maps included; the evidence export fails closed if anything required is missing.

We describe Concord as designed for / building toward these regimes — it produces evidence and indicative maps, not a certification, validation, or claim of conformity.

Cost of control

Governed fleets can cost less than ungoverned ones.

73% of enterprises report AI costs exceeding projections — agent spend is now a governance question too. Governance adds structure, but it removes waste: Concord holds the context, decisions and evidence agents otherwise re-pay to rediscover.

Avoid

No redundant runs

Cheap pre-checks classify already-satisfied work before an agent is ever dispatched.

Reuse

Shared memory

Decision records, summary tiers, recall and graph context let agents retrieve the relevant slice instead of replaying the whole history.

Right-size

Proof to risk

Evidence depth follows the track — lighter for mechanical edits, stricter for production reads, data products, deploys and bootstrap jobs.

A cost-ledger records spend per change in the same journal that proves the controls — so savings are measured, not estimated. Blended figures will be published from design-partner pilots. Cost figure: FinOps Foundation, State of FinOps 2026.

Get started

Install Concord in two steps.

Concord installs as a coord/ directory beside your code. The installer shows its plan before it writes anything.

# 1 · install into a new project, or overlay an existing repository
npx create-concord my-project
npx create-concord . --from-existing

# 2 · open the read-only cockpit
npm run coord-ui

Governance commands need Node.js 22.8 or later. No Node on the machine? The standalone Linux binary installs with concord init .. Full steps in the quickstart.

Editions

Open core for teams. Enterprise layer for your trust boundary.

The repo-local governed workflow is open source. Enterprise packaging adds org-wide collection, policy and deployment patterns for customers who need central command-center evidence.

Community

Free · Apache-2.0 · self-hosted
  • Governed lifecycle engine + CLI
  • Multi-agent coordination & per-ticket worktrees
  • Track-specific gates for code, content, infra, live-MCP and data work
  • Runtime receipts, deploy checks and data-contract certification
  • Read-only local cockpit + governed memory scripts
View GitHub repo
ENTERPRISE

Command Center

Customer-cloud package · design-partner deployment
  • Org collector, warehouse and rollups across many coord instances
  • Central re-hash verification and signed conformance bundles
  • Deny-by-default RBAC broker; SSO and KMS integration is a defined path, not yet a live control
  • Read-only adapter contract for Jira, GitHub and CI facts (no write-back)
  • Reference deploy scaffold, audit export and support path
Talk enterprise
FAQ

Questions teams ask about Concord.

What is Concord?

An open-source (Apache-2.0) governance engine for AI coding agents. Each piece of work gets its own worktree and lock, a risk-sized gate plan and a recorded closure, written to a hash-chained journal.

Does Concord replace GitHub rulesets or our CI?

No. Rulesets govern the pull request; Concord governs the agent work before it and records runtime evidence after it. Its gates call your existing test and build commands.

Which AI agents does it work with?

It is provider-agnostic. Session identity is built in for Claude, Codex, Gemini and Grok, with agents working independently or under an orchestrator.

Can we adopt it on an existing codebase?

Yes. npx create-concord . --from-existing plans an overlay you review before anything is written, and business discovery maps the repository without treating current behaviour as intended behaviour.

Can an agent bypass Concord?

Yes. Concord coordinates the work that goes through it; an agent or person with local access can act outside it. The design makes that detectable, not impossible, and worktrees separate repositories rather than sandboxing processes.

What is in Enterprise and not Community?

Org-wide collection and rollups, central re-hash verification with signed bundles, discovery of team boards, and the RBAC broker. Everything else is in the open-source edition.

Does Concord make us SOC 2 or EU AI Act compliant?

No. It produces evidence and indicative control maps that your existing programme can use. It is not a certification, validation or conformity claim.

Where does the evidence live?

In your repositories. The board, plan records, gate artifacts and journal are files you own; Enterprise reads them and does not write back.

Make agentic delivery accountable.

Run coding agents, production-MCP investigations, bootstrap jobs and data products through one governed execution record.