One compiled policy
The managed build compiles its configuration in. No environment variable, flag, user setting or repository file turns it off. Plugins and MCP servers come only from that compiled list.
Built
For teams that build inside an enclave
Badger
A coding agent.
Inside your boundary.
Badger is TestifySec’s hardened build of OpenCode for enclave and air-gapped networks. The agent, its model gateway and its audit records stay inside the boundary you approve.
Development preview. No binary release yet.
WHAT IS BUILT TODAYDevelopment preview
One compiled policyBuilt
One model routeBuilt
Signed profilesBuilt
Connectors to enclave servicesIn development
A classification banner on every resultIn development
A session high-water markIn development
Built means merged. In development means in review.
Badger
Prompt approval is not isolation.
Repository content, tool output and model responses are untrusted input. Badger keeps the upstream agent and terminal UI and moves the controls out of the agent’s reach: a compiled policy, a gateway that holds the credential, and a profile only the administrator can sign.
One model route
Every model request goes to a gateway your administrator runs. The gateway holds the provider credential, so the workstation holds none. Badger exports no telemetry of its own.
Built
Signed profiles
An administrator signs a profile that says what a deployment may run. The gateway and the broker check its signature, assignment, validity window and minimum sequence on every request.
Built
Connectors to enclave services
Jira, Confluence and GitLab, self-managed. Each connector reaches one service, acts with the developer’s own short-lived credential, and is read-only unless the profile allows writes.
In development
A classification banner on every result
Each connector result carries the administrator’s marking for that service as its first and last line. A higher marking found in the content raises the banner. Nothing lowers it.
In development
A session high-water mark
Whatever a session has read sets its label. Badger refuses to send that session’s content to a model gateway or a connector whose marking does not cover it.
In development
Badger broker
The broker decides what a device may run.
- 01
Admit the profile
The broker verifies the signed profile on every request and requires its digest to match the one the administrator selected. Repository code runs only in a worker with no network and a read-only root.
Built
- 02
Check the certificate chain
A profile signer can be a certificate that chains to a pinned root, with an exact identity. A profile whose validity window falls outside the signer’s certificate is refused.
In development
- 03
Follow the activation record
A signed activation record names the profile version a device should run. The broker admits that version and refuses one older than it has already seen.
In development
- 04
Keep the high-water mark
Each device stores its highest activation and profile sequence durably. If that state is deleted, the broker fails closed until a signed reset record for that device arrives.
In development
Trust you can explain
A marking is a label. The boundary is your accreditation.
A banner tells a person and a policy engine what the content is. It stops nothing by itself, and a connector configured with too low a marking under-reports. Enforcement comes from the accreditation of the gateway and model the session talks to, the session high-water check, and your network’s own accreditation.
Understand the trust boundaryHow does Badger relate to OpenCode?
Badger is TestifySec’s maintained fork of OpenCode, which is MIT-licensed. The TestifySec changes are a small patch series on a pinned upstream commit, and the upstream license and attribution are kept.
Can a developer add a plugin or an MCP server?
No. The managed build refuses the routes that add or connect an MCP server and does not load plugins from disk. Connectors, now in development, are turned on only by the administrator in the signed profile.
Is Badger certified or authorized?
No. Badger is a development preview with no binary release. The source alone does not establish runtime isolation or a compliance qualification. Authorization belongs to your system and your authorizing official.
Your next step
Run a coding agent inside your enclave.
Walk through your network, your model gateway and the services your developers use with us.