The Boundary Is the Product

Codewhale is best understood as a local execution system for model-mediated work, not merely as a chat interface that happens to edit files. The final judgment of this series is therefore a boundary judgment: who supplies inference, what Runtime path executes, which policies and sandboxes apply, what evidence is produced, and where the source snapshot leaves uncertainty. Those questions connect Codewhale’s route selection, turn loop, authorization, persistence, extensions, and orchestration without collapsing them into one vague idea of “agent capability.”

From a task to an accountable result

Consider the task that has appeared in different forms throughout this series: change a repository configuration, run the relevant checks, and report whether the change is safe to keep. Codewhale begins with a provider and model route, but the route is only the first decision. The Runtime then carries the request through a compact tool surface and a bounded turn loop. A proposed edit enters the authorization chain. The selected mode and posture matter, but so do typed permissions, repository law, worker authority, and the actual command backend. A successful edit may trigger diagnostics. The resulting tool calls, events, checkpoints, and receipts create a record that is richer than the model’s final paragraph.

The full path can be represented as a sequence of questions rather than a feature list:

flowchart LR A["Task goal"] --> B["Choose mode"] B --> C["Select exact model route"] C --> D["Inspect authority and repository law"] D --> E["Choose tools, extensions, or Workflow"] E --> F["Execute through Runtime and actual sandbox"] F --> G["Collect tool, diagnostic, event, and receipt evidence"] G --> H{"Conditional conclusion"} H -->|verified enough| I["Keep or synthesize result"] H -->|unknown or incomplete| J["Narrow claim, inspect, recover, or ask"]

The order is useful because later choices should not hide earlier ones. A provider route should be selected before the operator claims to know which context window or capability applies. A mode and authority check should happen before a write is described as possible. An extension should be enabled with its ownership and transport understood before its result is treated as trusted context. A recovery path should be chosen from the records that exist, not from a guess based on the last visible sentence.

This is what it means to say that the model route does not replace the Runtime boundary. A local model, a hosted model, and a gateway can all sit at the beginning of the same path. Their inference behavior and capability evidence may differ, but the selected route still enters Codewhale’s turn loop and the same broad authority model. The operator can change where reasoning comes from without silently granting a new kind of filesystem or shell authority.

The architecture also clarifies why the TUI, headless exec, local API, Fleet, Workflow, and Lane are not six competing definitions of work. They are different ways to launch, select, order, execute, or observe a Runtime lifecycle. The TUI serves a person watching a turn. exec serves a script or worker process. The API serves a local application that needs durable lifecycle operations. Fleet selects identity. Workflow orders phases. Runtime owns execution. When those relationships hold, a receipt can retain meaning across surfaces.

What the design makes possible—and what it costs

The first strength of this design is inspectability. A tool call is not hidden inside model prose; it has an admission path, an execution result, and, where applicable, a diagnostic or artifact. A durable event is not a replacement for the transcript; it is a lifecycle projection that lets a client reconnect and understand whether a turn is running, completed, interrupted, or failed. A workspace snapshot can restore files without pretending that conversation history never happened.

The second strength is controlled autonomy. Auto-Review, background workers, and Workflow can reduce interruptions, but they do not need to become blanket permission systems.