Org-wide deployment

One approval. The whole fleet.

The platform admin installs Rosentic once at the org level. Every repo, every developer, and every agent inherits it through the merge path. Nothing to install on a laptop. Repos created next quarter are covered the day they exist.

Layer 1 · The control point
Platform admin
Install Rosentic across the org
Approve
No procurement queue. No per-team rollout plan. No endpoint agent.
🌹
Rosentic App
Reading the repo list
Detecting languages
Writing workflows
Requiring the check
The org
0/24 repos covered
payments
web
ios
android
search
gateway
auth
orders
catalog
feed
notify
loyalty
promo
shipping
identity
cms
data-lake
ml-rank
edge
media
pos
b2b
geo
q3-experiment
One decision
The admin approves the org install. That is the entire deployment project.
The merge path enforces it
An org ruleset requires the cross-branch check on every repo. Teams cannot quietly opt out, and no team had to opt in.
Coverage is the default
New repos inherit the ruleset automatically. The fleet stays covered as it grows.
↓ what travels with the code ↓
Layer 2 · The repo carries the config
Any repo, freshly cloned
Three files, committed once by the App
rosentic.ymlthe cross-branch check in CI
.mcp.jsonin-loop tools for any agent that opens the repo
AGENTS.mdhouse rules: validate before you write, check before you push
â—†Claude Code
Connected
â–²Cursor
Connected
⚙Codex
Connected
â›­CI runner
Check required
Every clone carries the config. A new hire, a new laptop, or a new agent gets the same verdicts on day one. There is no endpoint to manage.
↓ where the data boundary sits ↓
Layer 3 · You choose what travels
Anonymous CI
Verdicts land in the PR. Branch names and commit IDs are hashed on your runner before anything is sent.
Dashboard
Itemized findings for the team. Metadata travels. Source never does.
VPC
The engine runs inside your network. Nothing leaves. Built for the strictest rooms.
The engine goes to the code.
The code never goes to the engine unless you send it.
Not on GitHub?
â—†Agents, anywhere
pip install rosentic-mcp and one config snippet. Any MCP-capable agent, any forge, works offline against the local checkout.
â›­Any CI
The same container behind the GitHub check runs in GitLab, Bitbucket, or Jenkins with a template we hand you.
â–£Local CLI
Run it against any checkout, air-gapped included. Same verdicts, no network required.
Deployment is not a rollout project.
It is one decision, enforced by the merge path.
Install the GitHub App Other CI & docs
In the IDE

It just shows up.

One PR merged by the App. The config rides every git pull after that.

the repo
git pull
Cursor · priya's laptop
checkout-svc
rosentic.yml
.mcp.json
AGENTS.md
.mcp.json
checkout-svc
🌹 rosentic tools Enable✓
runs silent
check_file🌹
cross-branch conflicta sibling branch changes create_order()
✓ plan adjusted before the write
⌥ priya/discount-flow rosentic · loaded
every clone, same pull
Nobody installed anything.
The repo carried it to every machine.