Skip to content
PatchArc

patcharc 0.2.0 · macOS, Linux, Windows

The verified story behind every change.

PatchArc records how a change happened: commits, test runs, decisions, risks. It seals that record into a signed .parc capsule you can verify offline, and turns it into a review link when you choose to share.

$ brew install patcharc
Read the docsHow it works
~/src/your-repozsh
$ patcharc init
initialized .patcharc/  signing key created
$ patcharc start "Rework session storage"
observer recording  arc_8f2c1d  main@a1b2c3d
# commits, test runs, notes, decisions
$ patcharc stop
redaction: 2 rules fired, 0 secrets sealed
sealed .patcharc/capsules/arc_8f2c1d.parc
$ patcharc verify
ok  signature valid  12 files  hashes match
$ patcharc share --visibility team
https://patcharc.dev/a/X9kQ2mN4vR7s
signature on every capsule
Ed25519
signature on every capsule
built-in secret detectors
13
built-in secret detectors
workspace detectors for monorepos
12
workspace detectors for monorepos
review sections, computed deterministically
6
review sections, computed deterministically
verification steps before a link goes live
15
verification steps before a link goes live
accounts needed for the local loop
0
accounts needed for the local loop

Four commands between you and a review that checks out.

The loop runs on your machine. The cloud only enters when you decide to share.

  1. 1.0init

    Initialize the repository

    patcharc init creates .patcharc/ in your repo: a local SQLite session store, a config file, and an Ed25519 signing key that never leaves the directory. No account, no network.

    patcharc init

    stage 1.0init
    $ patcharc init
    created .patcharc/config.yaml
    created .patcharc/sessions.db
    created .patcharc/keys/ed25519 (0600)
    ok  repository initialized

  2. 2.0record

    Record the Arc while you work

    patcharc start forks a detached observer that watches Git plumbing, file changes, and test runs across branches and worktrees. Notes, decisions, risks, and checkpoints are one command each, so the reasoning is captured while it is fresh.

    patcharc start "what you are building"

    stage 2.0record
    $ patcharc start "Rework session storage"
    arc_8f2c1d  observer pid 41822  main@a1b2c3d
    $ patcharc note 'WAL mode avoids the lock storm'
    $ patcharc decision 'keep SQLite, no Postgres yet'
    $ patcharc risk 'migration on existing dbs'
    $ patcharc checkpoint
    checkpoint 3  +418 -122  7 files  tests: 41 pass

  3. 3.0seal

    Stop, redact, seal, verify

    patcharc stop builds the six-section review from the recorded evidence, runs 13 secret detectors plus entropy scanning, and seals everything into a signed .parc capsule. patcharc verify checks the signature and every per-file hash offline.

    patcharc stop && patcharc verify

    stage 3.0seal
    $ patcharc stop
    review: goal, 3 phases, 2 scopes, verification, 1 decision, 1 risk
    redaction: aws-access-key in .env.example (withheld)
    sealed .patcharc/capsules/arc_8f2c1d.parc  (Ed25519)
    $ patcharc verify
    ok  signature valid  manifest consistent  12/12 hashes match

  4. 4.0share

    Share a link anyone can check

    patcharc share uploads the sealed capsule. The cloud re-verifies the signature and hashes server-side, runs a 15-step pipeline, and returns a short ArcLink with public, private, team, or capability visibility. Revoke or rotate it any time.

    patcharc share --visibility team

    stage 4.0share
    $ patcharc login
    open https://patcharc.dev/device  code KQ7P-MX2A
    ok  signed in with GitHub
    $ patcharc share --visibility team
    upload 214 KB  server verify ok  pipeline 15/15
    https://patcharc.dev/a/X9kQ2mN4vR7s

What a capsule holds

A .parc is a ZIP. Open it with any tool, verify it with patcharc verify, render it with patcharc serve. Nothing inside depends on us.

PartContentsNote
manifest.jsonCanonical JSON, format v0.2, per-file SHA-256Ed25519-signed at seal time
git/Commits, rewrites, branches, worktree hopsRead from Git plumbing, not the final diff
tests/JUnit, go test, and SARIF resultsParsed by the local engine
review.jsonGoal, phases, scopes, verification, decisions, risksDeterministic; AI is optional on top
redaction.jsonWhich rule fired on which pathReviewers see what was withheld, not what it was
scopes.jsonWorkspace packages the change touched12 detectors: pnpm, npm, yarn, turbo, nx, and more

Built like a tool, not a platform you rent

Verifiable offline
A capsule is a ZIP with a signed manifest. Anyone holding the file can run patcharc verify with no account and no network. The cloud runs the same check before it publishes anything.
Review without AI
The six-section review is computed from recorded evidence. AI summaries layer on top when you ask for them; they are never the fallback the review depends on.
Redaction before seal
Thirteen detectors, env-file rules, and high-entropy scanning run before anything is written. Your own regex rules go in .patcharc/config.yaml.
Monorepo-native
Twelve workspace detectors map changes to packages and services, so a review reads as scopes rather than a flat diff.
Links with real access control
Public, private, team, or capability visibility. Revoke or rotate the slug; expired and revoked links stop resolving.
Your keys stay yours
BYOK provider keys are envelope-encrypted with a per-connection DEK wrapped by a KEK and decrypted only inside the key-broker worker. Managed AI goes through the AI Gateway with content logging off.
Device-flow sign-in
patcharc login opens the browser, you approve with GitHub or Google, and the CLI polls for its token. Refresh tokens are hashed at rest and rotated on use.
Cloudflare-native cloud
Workers, D1, R2, KV, Queues, and a per-capsule Durable Object pipeline. Per-tenant isolation is enforced on every query.

Two planes, one contract

A local engine you can audit, and a cloud that has to prove a capsule before it publishes it. The format is open today; the hosted service is not.

Read the security page

Local · Apache-2.0

  • .parc format specification
  • JSON Schemas (claim, manifest)
  • Local engine: capture, seal, verify, inspect, serve
  • Deterministic six-section review

Cloud · proprietary

  • 15-step verification pipeline
  • ArcLinks with access control
  • Managed AI and the BYOK key broker
  • Team collaboration surface
Local Arc Engine (Apache-2.0)
The CLI, the .parc format, and the JSON Schemas are Apache-2.0. The format spec is public, so your review artifacts are never locked into us.
PatchArc Cloud (proprietary)
The hosted pipeline, sharing, and AI orchestration run on Cloudflare Workers. Upload is optional; the cloud re-verifies every capsule before it publishes anything.
Fifteen-step pipeline
Validation, signature and hash verification, policy enforcement, evidence extraction, review synthesis, and publishing run as tracked steps inside a per-capsule Durable Object.
Keys never leave the broker
Provider keys are encrypted with a per-connection DEK, wrapped by a KEK, and decrypted only inside the key-broker worker. Never logged, never returned, never sent to the AI Gateway.

Questions people ask before installing

Do I need an account?
No. init, start, note, decision, risk, checkpoint, stop, verify, inspect, and serve all run with no account and no network. You sign in only when you run patcharc share.
When does my code leave my machine?
Only when you run patcharc share. What uploads is the sealed capsule, after redaction. The cloud re-verifies the signature and every file hash before it publishes a link; a capsule that fails verification is marked failed and nothing is published.
Does the review need AI?
No. The six sections (goal, phases, scopes, verification, decisions, risks) are computed from the recorded evidence. AI summaries are optional, either through your own provider key or managed models.
Is the format open?
Yes. The .parc specification, its JSON Schemas, and the local engine are Apache-2.0. A capsule is a ZIP you can open, verify, and render without us. The hosted cloud is proprietary.
What about monorepos?
Twelve workspace detectors (pnpm, npm, yarn, turbo, nx, and more) map a change to the packages it touched, so the review is organised by scope rather than by file path.
How are provider keys stored?
Envelope-encrypted. Each connection gets its own data-encryption key, wrapped by a key-encryption key that only the key-broker worker holds. Plaintext exists in memory for one resolution call and is never logged or returned.

Seal your next change.

Install the CLI, record an Arc in any Git repository, verify it offline. Share it when you are ready.

Install the CLI