rook has to prove it to something that cannot be talked around.
An agentic engineering CLI built on a verifier-gated loop: dispatch, apply, verify, repair. The gate — your real build, your real tests — is the only authority on "done". The model's opinion is not admissible.
Every turn ends by running your project's own gate. Green is green. Red sends it back around the loop to repair its own work. The exit code is the gate's verdict, not a summary the model wrote about itself.
The core is a pure kernel that physically cannot cheat: no network, no
Process, no dart:io. It cannot run itself. All the
dangerous machinery — the HTTP transport, the path-constrained file writer, the
git actuator that stays dark unless you turn it on — lives in a separate outer
shell that the kernel never touches.
--archive keeps the bodies verbatim.# three different agent CLIs, same task, isolated worktrees rook --race claude,agy,rook --allow-external-agents "make the flaky test deterministic"
The gate doesn't care which vendor produced the diff. That is the entire point of having one.
A model can weaken a test and earn a real green.
The gate is the only authority on done. The tests it runs are files the agent is allowed to write. Both of those are deliberate — changing behaviour means moving the tests that pin it — and together they leave exactly one hole: an agent that quietly softens an assertion gets a genuine pass from a genuine verifier, and nothing looks wrong.
rook cannot close that hole without refusing test edits, which would refuse most real work. So it makes it visible instead. Every turn fingerprints, by SHA-256, exactly what the gate's test leg would run. If the thing that judged the work changed underneath you, you can see it.
We would rather ship the honest limit than the comfortable claim. If a tool has never told you where it can be fooled, it has not looked.
A runaway agent is a runaway bill. rook ships a circuit breaker on calls and
on tokens, and when it trips, stop means stop — no gate run, no merge
proposal, the tree left exactly where the turn left it. Turning it off is a
deliberate sentence in a script (--no-breaker), never a default
nobody chose. A non-integer threshold refuses the run rather than silently
falling back to one its author didn't believe was in force.
Agentic loops are token-hungry by construction. A single task is many turns;
--race 3 is three of those at once. Rate limit is what actually
bites — a race that queues is a race that isn't racing.
| Tier | Rate | Tokens / month | What it's for |
|---|---|---|---|
| Dev | 300 rpm | 250M 600 rpm · 500M annual |
Daily driver. Races run genuinely in parallel instead of politely queueing behind each other. |
| Freedom | no limit | 1B 2B annual |
CI that runs rook on every PR, wide races, long autonomous sittings. Nothing throttles. |
Every allowance is per calendar month and resets on the 1st, UTC — annual doubles it and gives you a month free. Pro exists too, at 60 rpm and 30M tokens a month. It's a fine key for a chat client. It is the wrong key for an agent that dispatches in a loop, and we'd rather say so here than let you find out through timeouts.
Your key arrives by email the moment payment clears — Pro, Dev or Freedom. Paste it into rook and go:
# one export, then it's yours export ROOKERY_API_KEY=sk-ht-… rook init # writes a starter ROOK.md for this project rook doctor # checks key, model, gate, SDKs, git, PATH rook "make the failing integration test pass"
Come find us. Demo keys are handed out in person — 100 million tokens, no card,
no form. They start with intdev- so we can tell demo traffic from
paid traffic at a glance, and so can you.