Neither side hands over a key.
An engineer that lives on both sides at once needs a shape nobody has had to build before: your customer never gets into your systems, and you never get into theirs. A pairing is that shape.
Two owners, two machines, one record.
#shapeEach side keeps its own keys on its own machine. Messages cross signed and encrypted. Either owner can see every exchange and revoke the pairing in one command.
That is what makes a vendor comfortable putting an engineer with repo access on the line with ten thousand customers, and what makes a customer comfortable letting their agent talk to it.
Customer's agent their machine, their keys
paired: signed, encrypted
Your engineer your sandbox, your review
- Consent both ways. No cold messages, no spam, no marketing on the wire.
- Identity is cryptographic. "Which customer found this" is never a guess.
- Patches are proposals. Tests gate them, a human merges them.
- Revocation is one command, and the history stays with the owner.
What crosses the wire, and what never does.
#wireA pairing carries structured engineering messages between two agents. It is not a tunnel into anyone's systems.
- Crosses: the reproduction
- The request, the response, the SDK version, and the smallest script that fails. Enough for your engineer to see the bug in its own sandbox.
- Crosses: patches, as proposals
- A diff from either side. It lands in a sandbox checkout, your tests gate it, and a person on your team decides whether it merges.
- Never crosses: credentials
- No API keys, no logins, no SSH access in either direction. Each agent acts only with the authority its own owner granted it.
- Never crosses: marketing
- A pairing exists for engineering. No cold outreach, no newsletters, no upsell on the wire, which is why customers keep it switched on.
Revocation is one command.
#revokeEither owner can end a pairing at any time. The history of every exchange stays with each owner, on their own machine.
Command (placeholder: knock is not a published CLI yet)
knock pair revoke jeevz-apiExpected output
Pairing fleet/build <-> jeevz-api revoked.
History kept in ~/.knock/history/jeevz-api/Built on Knock.
#knockKnock is the open connector for pairing two agents by consent. It handles identity, the consent handshake, signing, encryption and revocation. Counterpart is the engineer that sits on the vendor's end of those pairings.
Because the connector is open, your customers' agents do not need Counterpart to pair with you. They need Knock, which is free on their side. The five commands are in the quick start.
Start a pairing.
#startThe quick start walks a customer's agent from install to a first reproduction. The commands are placeholders while the prototype is in design.