Your codebase, changing under review.

Code is now written faster than anyone can read it. DNAgives a Hale codebase an organization that oversees it: a human Board at the top, a model-backed Leader under it with a grant the Board wrote, and a substrate that makes each change in a sandbox, proves it with the toolchain, shows it to whoever has the authority, applies exactly what was approved, expresses it on your machine or across a fleet, and watches. All of it is a branch of your repository.

What it is

An org chart, as a program. hale dna init generates it next to your code — the Board, the Leader and its grant, the models, the gateways, and a law the compiler holds against the wiring you actually built. You ask for something in a sentence, from a terminal, another clone, GitHub, or the page it serves. The substrate copies the repository, lets a model edit under a grant that is read, edit, format and check and nothing more, and commits the candidate there. The toolchain then checks, verifies and tests it, composes the fleet it would deploy, diffs it against the program's structure, rehearses rolling it back, and keeps every output under its own hash. One review, three views: the source diff, the structural diff, the evidence, pinned to one commit. Inside the grant, the Leader decides — a model, reading those views, leaving its reasoning on the record. Outside it, or when the law, an effect or the fleet's shape moves, the Board decides: you. Approval is a commit. It is expressed — restarted here, or redeployed by every node the plan assigns — and watched. It stays up: kept. One instance falls over: rolled back everywhere, with the instance named.

The record is refs/dna/journal: one commit per event, in the repository the code lives in. A teammate with a clone has the whole story, two people answering at once lose nothing, and a pull request can be the review. The organization grows the same way the code does — a proposal, a candidate commit, the Board's verdict, a restart.

Why, in 2026

More changes than you can read. Agents produce pull requests faster than reviewers can absorb them, so review degrades to skimming and CI becomes the only real check. DNA does not make reading unnecessary; it makes each change one thing, already verified, and explains it twice: the source diff, and what changed in the program's shape — who talks to whom, which effects are reached, whether a rule went from holding to violated. A rule that flips is one line in that view and a page of archaeology in the source. And it puts a first reader on every change whose reasoning you can audit: the Leader's verdict is a model call with its digests and its cost on the record, inside a grant only the Board can widen.

Autonomy as a checkbox. Today an agent's permissions are a toggle in a tool: edit files, run commands, auto-approve. Here the boundary is a constitution the compiler enforces — the editing position cannot reach git, the network, a deployment or the organization's memory; the Leader decides and never commits — and hale check holds it against the org chart you wrote. Hand the editor a git handle and the build fails, with the path that shows why. Widening the grant is a reviewed commit, like any other change.

Agents edit repositories; systems run. A change is usually judged by tests, in a checkout, with no idea what is running where. Hale programs are modeled by their compiler, so a candidate is measured on what it does to that model, and composed as the fleet it would deploy — a change to one service that breaks a claim over all of them is denied before a human sees a line. Every instance reports the model hash it expresses into the record, so hale dna fleet can say which replica runs which version.

Provenance is a chat log. Why a change happened is reconstructed from PR descriptions and transcripts. DNA's record has the ask, the sandbox, every model call with its cost and digests (never the prompt), each check with its receipt, the verdict with a name on it, the apply, the deploy, the outcome — as commits, next to the code, synced like code. hale dna history m1 is one change's whole story, from any clone.

Rollback is a hope. A change that breaks production is reverted by whoever notices. Here a change that crashes one instance inside the observation window is reset to the commit it started from, on every node it reached, mechanically; a change you reject after the fact goes the same way; a retried apply reads its own record and never commits twice.

And it runs where your code is: in the hale binary, on your workstation, with your model key or a local model, with git as the only shared service. No control plane.

How

Generate the organization for a program that already passes its checks, start it, ask. This is the demo application, with the editor on scripted models so the transcript is reproducible; a hosted model gives the same commands and the same record.

$ hale dna init .            # the organization, generated next to your code; the app untouched
$ hale dna dev               # the organization and the application on this machine
$ hale dna ask document the chat server in main.hl
task t1 born for intent i1a08c0786c5 [pending]

$ hale dna review m1
review m1 [pending]: apply m1 (docs): document the chat server in main.hl?
  needs leader · candidate bf94e503c1c002f277248b14b6afd1910bb8ce6f

source diff (git 232dc8f18dde .. bf94e503c1c0):
  +// documented by the organism: Echo answers every Ping

semantic diff (hale model diff, baseline .. candidate):
  classification: source-only  ·  no semantic differences

evidence (fmt=0 check=0 verify=0 test=0 diff=0 rollback=0 fleet=0):
  check      yes    0 e3b0c44298fc
  test       yes    0 184a3407ce31
  fleet      yes    0 b33b2e832b21
  rollback   yes    0 89978376be81

$ hale dna review m1 approve --as riley --comment "fine"
review m1 settled: approve by riley
hale dna dev: expression restarted (pid 1875137) as 3c9b9327e480d349 build 7a489ad3e72c
hale dna dev: m1 observed healthy for 5s as 3c9b9327e480d349

That is the daily surface: ask, review, status, history, board. For a team, git config dna.github turns every pending review into a pull request and every GitHub review into a verdict. For a fleet, a plan names each service's seed and node, hale node runs a node, and an approval redeploys the instances it touched. The rest is how much the Leader may decide and which models it uses — a grant and a router in a file you own.

What it doesn't claim

Every change waits for a verdict: the Leader's, inside a grant a person wrote, or the Board's. A restart is a restart, not a live state migration. And the structural view is blind to what a handler computes — a +1 becoming +100 is invisible to it — which is why the source diff is never optional, for people and for the Leader alike. The design was gated on a test of exactly that: reviewers deciding from the structural diff alone, the source alone, and both. The combined view is what shipped, and the structural view is credited with what it earned: it decides shape and rules, and it says when it cannot decide.

Start

The user guide is eight short chapters: getting started, working with it, the organization, operating the fleet, shaping it, what it will and won't do, troubleshooting. The deep dive — the record as a git branch, the gateways, the review's pin, the autonomy rules — starts at what init makes. The design it implements is the Hale DNA, Phase 3issue, on the RFC.