AI Products
Nereid
A delivery-control plane that turns coding-agent work into evidence a human can review before approving it.
2026 / AI Products / Next.js / TypeScript / Node.js / PostgreSQL / Drizzle / Zod / Codex CLI
Quick read
A clear breakdown of the product, the reasoning behind it, and the implementation choices that matter.
- Year
- 2026
- Category
- AI Products
- Status
- Hosted technical preview
Overview
Nereid is a hosted control plane with a customer-controlled runner. A reviewer starts with a GitHub issue; the runner works in an isolated Git worktree using the locally authenticated Codex CLI, records bounded lifecycle and verification evidence, pushes a branch, and opens a pull request. The control plane derives readiness from validated events rather than trusting an agent's completion claim.
Why it exists
Coding agents can produce changes faster than a reviewer can reconstruct what happened. A plausible diff is not enough to answer whether the task was followed, checks passed, credentials stayed bounded, or unresolved risks were hidden.
How it works
Nereid separates coordination from execution. The hosted control plane stores validated lifecycle events and presents the evidence packet; the customer runner keeps source code, tools, Git credentials, and Codex authentication in the customer's environment. Only an authorized human can approve or reject, and Nereid never merges.
Built with
Next.js / TypeScript / Node.js / PostgreSQL / Drizzle / Zod / Codex CLI
What I focused on
- Defined a versioned Zod protocol with strict sequencing, idempotent duplicate delivery, and derived review readiness.
- Built a Node 22 runner around disposable worktrees, ephemeral workspace-write Codex execution, bounded output, and secret-pattern redaction.
- Added GitHub issue ingestion, one-use runner enrollment, branch push and PR creation without a merge command.
- Covered prompt injection, event replay, failed verification, secret-like output, and approval bypass with deterministic tests and evals.
Architecture
GitHub issue -> Nereid control plane -> enrolled customer runner
|
disposable worktree + Codex CLI
|
branch + PR <- validated evidence events
|
human approve / reject -> GitHub checkThe runner polls for a typed job and emits ordered lifecycle events. The control plane rejects out-of-order or mismatched events, treats identical retries as idempotent, and derives readiness only after a PR exists and every recorded verification passes.
Evidence packet
- The agent plan and completion summary.
- Branch, commit, pull request, and changed-file references.
- Exact verification commands, exit status, and bounded redacted output.
- Risks, unresolved items, failures, and the immutable event sequence.
Security boundaries and non-goals
Repository contents and Codex credentials stay with the runner. Enrollment tokens are one-use, runner credentials are stored as hashes by the control plane, and reviewer access is allow-listed to a configured GitHub identity. Agent output cannot approve a run or weaken readiness rules.
- Nereid is not an autonomous merge bot.
- The current workspace-write sandbox and worktree boundary are not a hardened production container.
- The hosted preview still uses an in-memory control-plane store while the Postgres schema is integrated into the live path.
- GitHub reviewer sign-in is live, but a complete runner-to-PR-to-check smoke test is not yet published.
Where to look
Repository snapshot
- Repo
- Nereid
- Language
- TypeScript
- Updated
- Jul 19, 2026