how it works
A task is a loop. The agent does the work, the gate decides whether that work earns a merge, and the gate can send it back as many times as it takes. Here is what happens at each step, and what the model can’t get around.
the loop
workThe agent works inside a throwaway container with just the one repository mounted. A bad shell command can't wander into your other projects or your secrets. When it needs help it hands off to two helpers: one that can only read and investigate, and one that writes tests and has to actually run them before it's allowed to say it's done.
verify_and_shipThe gate doesn't take the agent's word for it. It re-runs your project's real typecheck, lint and tests itself, the same commands you'd run. Only a pass with an actual diff becomes a commit, on the task's own branch. If the agent left items on its todo list, the commit is held and the task goes back to finish them.
reviewA different model reviews the branch against the exact point it forked from, runs the checks again in its own sandbox, and says READY or NEEDS_FIXES with findings. Then it waits for your look. What merges is the exact commit that was reviewed, and on GitHub main only moves when Actions is green on it too.
“The agent saying done doesn’t mean it’s done.”
before it builds
Planning is its own agent with web search, a real browser, your Connections and read-only access to your projects, but no way to change anything. When the plan is right, one click hands it to the build pipeline, and what planning cost is carried onto the task.
It picks the model per turn: an everyday one, a stronger one when the question gets hard, and a frontend seat for UI work, so the plan is written by the model that will build it.
memory
Most agents start every task from scratch. This one keeps notes, on each project and on its own mistakes, so the tenth task on a repository goes better than the first.
reflectWhen the tests fail or the reviewer sends it back, the agent doesn't just try again. It writes down what failed, why, and the one thing to do differently, and starts the next attempt from that. It also sees what it already tried, so it doesn't repeat itself.
memoryEvery finished task leaves a short record: what was asked, what happened, what it cost, what the reviewer said. Once a day the agent reads the recent ones and keeps what held up, like how this repo runs its tests or which mistake keeps coming back, and drops the noise.
recallMonths of tasks, transcripts and errors are searchable. When an error looks familiar, the agent can find the time it already solved it instead of starting from zero.
freshnessA remembered fact points at the files it came from. When those files change, the fact gets flagged as possibly out of date, so old knowledge doesn't quietly steer new work.
“A lesson is only trusted once the task that learned it ships.”
costs and models
Every model call goes through your own OpenRouter key, billed to you at cost, and every one of them is on the record.
Every role's real usage, from the router's own per-call ledger: calls, tokens, latency, cost and how much came from cache. A role burning money shows up here, not on the bill.
Some roles need strict tool calling and a forced response shape, and most models can't do both. Each role says which models passed its probes and which failed.
Classifying a task or summarising a log doesn't need the model that writes your code. Every support role is pinned on its own, and profiles switch whole sets of models at once.
Auto mode lets a task finish without you, project by project. It still stops for a delete that would lose work and for a question only you can answer.
guardrails
This thing writes and runs code against your repositories. The guardrails aren’t an afterthought; they’re most of the work.
Checked after every model call, on the main agent and every helper, so a loop that goes sideways costs a number you picked, not whatever it wants.
Its shell has no SSH key, no git credentials and no token. Only the gate pushes, after review, with a token you create for just the repositories it should touch, handed to that one push and never to the agent.
The inbox picks up Dependabot pull requests, security and code-scanning alerts, review comments and failing checks. Propose sends you an approve link; Auto just starts it. Either way it goes through the review gate.
When it hits something gated, or it's genuinely unsure, the question shows up in the task stream, and your answer goes right back into the paused run.
Projects can only come from folders you allowed, checked after symlinks resolve. The commands the gate runs are the ones the server proposed, so nobody can slip a new one in through a request.
Escalated, stopped, out of budget or cut off by a restart, the whole state is saved, so resume picks up the same run instead of starting over.
Your own DJG Agent on a private server, set up and kept updated for you. The console, the apps, djg and every connection are included.