The operating system for shipping

Stop filing tickets. Start shipping changes.

See every claim, flag and experiment that is actually live in your product. Then turn a plain-English request into a pull request your engineers review.

See it. Change it. Ship it.

Your code never leaves your machineRuns on your own Claude subscriptionYour engineers review every change

Free to start. Connected in an afternoon.

payments-apiillustrative example
Retry a failed charge five times before past_due, not three.Request ↵
Resolved against your code
Assertedcharge.ts:88Assertedcharge.ts:95
Back as a draft, on your remote
#478 fix/retry-limit6 files · awaiting your review
You wrote a sentence. An engineer got a diff.See how it runs →

Engineering is the only part of the company that can answer for the product. So everything queues behind it.

A founder asking what the refund policy actually is. A PM changing a limit. A support lead checking whether a flag is on. Every one of those is a ticket, a thread, and a wait.

One small change, from asked to shipped
1daywriting and reviewing
the actual change
+2daysworking out what the
code already does
+4dayswaiting for someone
to pick it up
=7daysbefore anything
reaches a customer

One day of work, six days of everything else. The queue and the archaeology are the whole problem, and they are the two parts a system can absorb.

The request used to cost a ticket and a sprint. Now it costs a sentence, and it comes back as a pull request.

The thing you actually came for

Write the change in your language. It arrives in theirs, as a pull request.

No translation step. No grooming session. An engineer gets a reviewable pull request instead of an interrupt.

1Claim

A failed charge is retried up to 3 times before past_due.

Assertedcharge.ts:88
2Change requested
working

Retry up to 5 times, not 3.

charge.ts:88charge.ts:95
3Implemented
/kanon:work --next
→ opens pull request #478
4Verified

After the merge the guide re-reads itself. The claim comes back proven, not stale.

Awaiting proof
Manage what is actually live

Nobody knows how many feature flags you have. Your codebase does. So do your events, experiments, and tests.

Every flag and what it gates. Every event and whether it still fires. Every experiment nobody cleaned up, each carrying the line that declares it.

FlagGatesStateSource
express_checkoutOne-click checkout pathoffflags.ts:12
new_pricingPricing table and tax linesonflags.ts:19
legacy_dunningOld retry cadence, no reads in 18modeadCreate ticket
audit_logWrite-ahead audit trailonflags.ts:31

Read straight out of the code. Ten seconds to answer “wait, are we even tracking that?”

47
feature flags
3
dead, no reads
128
analytics events
19
security findings, cited
Working with engineering

Not a way around your engineers. A way to stop being their interrupt.

Every tool that lets non-engineers ship code fails the same way: engineering cleans up after it. So the work arrives as a branch and a draft pull request. They review. You watch it move.

In flight4 changes · 1 awaiting review
PR openRefund window should follow the plan, not a constant#482 draft · ada-mbp
workingHide the one-click path for EU accounts#486 · 9 files touched
mergedRaise the failed-charge retry limit to five#478 · shipped Tue
queuedSend a dunning email on the second failurewaiting for a worker

It lands in their workflow

A real branch and a draft PR on your own remote, with the request in the description. No new tool for them to adopt.

GitHubLinearJiraSlack

Their review is the gate

Every change opens as a draft until a human approves it. There is no setting that turns this off.

Draft by default

You stop asking for status

The board above is the answer to “where is that at?”, without a standup or a nudge in anyone’s DMs.

Live from the worker
Why it is safe to act on

Every claim about your product comes with a receipt.

You are about to change things based on what this system says is true. So nothing it says arrives as an opinion.

Verified

A refund can never exceed the amount originally captured.

Payments · Refunds · one of 38 claims in this feature

Asked about 12 times this month
The receipt
Declared at
refund.ts:42
Proven by
refund.spec.ts:118passing 6 hrs ago
Read again
after every merge that touches the file
Last moved
PR #482re-anchored automatically
Confidence
Verified by your own test suite
No line behind itit never becomes a claim in the first place.
No test proving itit reads Asserted, and says so in amber.
The line moves in a refactorthe claim re-anchors, or flags itself as a contradiction.
Who operates it

Four jobs that stop waiting on a fifth.

Product

Raises the retry limit herself. It comes back as a draft pull request, not a ticket in someone’s queue.

Support

Answers why a charge failed from the cited behaviour, at the moment the customer asks.

Compliance

Exports the claim, the line, and the date a test last proved it. No screenshots, no interviews.

Engineer

Stops being the lookup service. Reviews a diff instead of answering the same question again.

How it runs

Three commands. Then the terminal is done, and your code never left the machine.

An engineer sets it up once. After that it is a button anyone on the team can press, and the reading still happens on your own hardware.

Kanona browser · anyone
/connectpayments-api
Bringing your codebase online
Signed in from your terminaldevice
Repository claimedpayments-api
Worker onlineada-mbp

heartbeatevery 5 seconds

Your machineonce · an engineer
~/src/payments-apiclaude code
$claude plugin install kanon@kanon
/kanon:setup · approved in browser
/kanon:worker
kanon worker listening · 1 repo, 0 tasks

Two installs, one sign-in, one worker. After that, nobody on the team opens a terminal for Kanon again.

runs as: you
pays with: your subscription
sees: nothing yet
01

The work runs on your hardware

A worker daemon on an engineer’s machine or your own CI box. It claims one task at a time and works in an isolated checkout. We run nothing.

02

It bills to your subscription

Your Claude Code plan does the reading. No third-party inference vendor sits between us and your source, because there is no path from us to your source.

03

The wire carries ids, not code

Out: {type, payload}. A task type and validated ids, never a free-text prompt. Back: claims, one-line activity labels, and file paths. No file contents, ever.

Read-only by defaultYou approve before any deep scan

The product side of engineering, finally operable.

See it. Change it. Ship it.

Requested in plain English. Reviewed by your engineers. Shipped as pull requests.