Supervised node
A per-user daemon owns device authentication, supervision, local policy, and the outbound tunnel.
Built for accountable production
Run agents where your code already lives.
Bernato coordinates isolated agent work across trusted machines through one authenticated outbound WebSocket per node. Local policy—not a cloud prompt—retains authority over paths, executables, terminals, and memory.
Repository-backed product facts · reviewed 26 August 2026
Architecture and value
Keep the browser workflow central while execution, credentials, repositories, and process authority stay at the selected node.
Typed WSS broker
The broker multiplexes typed control, terminal, diff, and decision frames; it is not a generic TCP proxy.
Detached workspaces
Every repository task receives a detached Git worktree; non-repository work receives a private scratch space.
Compare operating models
Expand the matrix. Choose by boundary and workflow, not slogans.
Bernato ↔ Devin · official deployment docs reviewed 2026-08-26
| This system | Alternative · Devin | |
|---|---|---|
| Primary job | Distributed agent runs on operator-trusted machines | Cloud-brain coding agent with an isolated Devbox |
| Deployment boundary | One authenticated outbound WSS connection per node | Brain in Cognition Cloud; cloud or customer-dedicated Devbox |
| Evidence model | Sequenced protocol events and Git-tracked reviewed receipts | Use the vendor documentation for current session-record features |
| Operator control | Target-owned policy resolves paths, projects, and executables | Workspace operates under the cloud brain’s control |
| Integration surface | CLI, hosted app, and authenticated numeric-loopback IDE | Web, Slack, and API entry points |
Technical invariants
Default deny
Cloud input never grants filesystem or executable authority.
Cloud input never grants filesystem or executable authority.
No inbound node port
The node opens no Bernato inbound port; the local IDE binds numeric loopback only.
The node opens no Bernato inbound port; the local IDE binds numeric loopback only.
Bounded execution
Subprocesses have explicit executables, bounded lifecycles, and fail-closed admission.
Subprocesses have explicit executables, bounded lifecycles, and fail-closed admission.
Non-executable memory
Git-tracked Markdown is untrusted reference material and never executable instruction.
Git-tracked Markdown is untrusted reference material and never executable instruction.
Transparent access
Source
€0 · target
The intended license is MIT; the release gate is not complete.
Local runtime
Not sold
Build from the repository for evaluation; no qualified binary artifact is advertised.
Hosted broker
Not offered
Hosted pricing will be published only after broker and support qualification.
Current status. There is no active commercial offer. The runtime is implemented, but release and platform qualification remain fail-closed.
Frequently asked questions
What is the safest way to evaluate it?
Start with the architecture, reproduce the documented workflow, and verify the boundary against your own threat model.
Does the comparison include live third-party pricing?
No. Mutable vendor pricing is deliberately excluded. Verify current vendor terms before a purchase decision.
Where are limitations documented?
The status note, architecture page, and engineering articles state the current boundary and failure behaviour.