Copy
Import the real repository and its design system. The agent reads the code and writes the project's memory: the architecture, the conventions, the sensitive map.
Nº 01 · Autumn 2026The Governance IssueFree for macOS
Inside: the loop that takes an idea to production, the night a smoke test said no, and why a prompt box is not a company.
- p. 4 The people with the ideas cannot ship them
- p. 8 The screens draw themselves, then one loop to production
- p. 18 The night the smoke test said no
v6.7.2macOS on Apple siliconfree to downloadInstall notes
Works with Claude CodeWorks with GitHubWorks with VS CodeWorks with CursorWorks with Claude DesktopWorks with CodexWorks with GitHub PagesWorks with AndroidWorks with Your SSOWorks with Your reviewers
Contents
Every company is full of people who know exactly what to build and cannot build it. AI made the prototype cheap and left the hard part where it was: shipping a change to a real product, safely, more than once. This issue is about that part.
The editors
- 01The prototype trapThe people with the ideas cannot ship them.
- 02One loopThe screens draw themselves, then five steps to production.
- 03Two films, no cutsA feature ships itself. An idea becomes an app.
- 04The night the smoke test said noSecure by default, enforced in the routes.
- 05The studioNine views of one product, Ledger, on a Mac.
- 06Why a prompt box is not a companyFour things a weekend cannot copy.
- 07Meera, and the product managerOne product across the whole spectrum.
- 08Two ways inA demo for your company. A deck for investors.
01The prototype trapNerfedLab · Nº 01 · p. 4
The people with the ideas cannot ship them.
The gap between an idea and shipped software is where the value dies. Three groups are stuck at the same wall.
- 1
Bottlenecked teams
Business and product people have ideas daily, and every change waits on a scarce, overloaded tech team. The queue is the product.
- 2
No team at all
Solo founders and small companies cannot afford, or do not want, an in house tech team. The idea stays in the notebook.
- 3
Not built for a company
Today's AI builders are made for prototypes and personal projects. None is built for a real company to ship production grade software: reviewed, secure, auditable, reversible.
02One loopNerfedLab · Nº 01 · p. 8
From an idea to production, by the person who had the idea.
The whole AI stack, run for you. Under the friendly surface: a real coding agent in a real git repository, safe on your actual apps. Five steps, and the same five every time.
The screens draw themselves.
A brief in the chat, the few questions on one card, and then each screen is written onto the canvas element by element while you watch. The design is a file you own, versioned with the rest.
Ledger, from one screen to seven, as recorded in the studio. Played a little faster than life.
Build with AI
Describe the change the way you would tell a colleague. The screens are drawn first, then the code, on a draft of its own, refined in the chat.
Test on a phone
The real app on a real device. The smoke test walks every screen: the build, the console, Back, and every control that must do something.
Approve
A manager or a stakeholder signs off. The pull request carries code review and the automated security pass; a blocking finding holds the merge.
Merge to production
Your tech team merges, or ours. A version is tagged and rolls out by percentage, with a guardrail that halts a bad ramp on its own.
03Two films, no cutsNerfedLab · Nº 01 · p. 14
Watch it happen, start to finish.
Two recordings of the product, unedited. The first is the everyday loop on a real repository. The second is day one: no repository, no team, one sentence.
04The night the smoke test said noNerfedLab · Nº 01 · p. 18
Fast, because it is governed.
Ledger's new screen looked finished. The smoke test walked it and found a chip that did nothing on tap; the security pass found the Partner key riding a URL. Both stayed out of main until they were fixed. An agent that can write code to your product needs the same guardrails an engineer does, and they have to be enforced where a client cannot talk around them.
- 01
The security pass, on every pull request
Send for approval posts an automated pass over the draft's diff against main: a credential in a URL, a secret behind a public build variable, a hardcoded credential, and every path the project's sensitive map calls risky. A blocking finding holds Ship until the draft is clean. Each finding names the file, the line, the reason and the fix.
- 02
A sensitive map of your own
The agent writes the sensitive map on import: auth, payments, keys, personal data, the paths that need a second look. The risk badge on every draft and the security pass read it, so a flag is explained, never magic.
- 03
Secrets the model never sees
When a build needs a key, the agent asks on a masked card. The value goes to the workspace's own env file, owner read and write only, and the model receives only that it was stored. Nothing reaches the chat history, the transcript or a commit.
- 04
Gates that cannot be talked around
The routes refuse what the strip would not offer: no pull request without a green smoke verdict about the tip, no Ship with a failing or stale smoke test, a blocking finding or an open change request. An approval is about a diff, so any commit after it resets it.
- 05
Your keys stay in your keychain
GitHub connects through the device flow; the token lives encrypted in the macOS keychain and never reaches our servers. The MCP token is one per install, travels as a header, never in a URL, and rotates from the Connect dialog. The served app binds to this machine only until you choose Preview on phone.
- 06
A rollout that halts itself
A shipped version arms at zero percent. Ramping is a config commit; devices flip live by sticky bucket. The running app beacons sessions and errors, and three cohort errors against a quiet baseline halt a live ramp on their own. Going down is the only automatic move.
Self-serve
You hold the gate.
Download it, sign in, connect your subscription. Your own GitHub, your own reviewers, your own call on every Ship. Crash reports carry diagnostics with paths and usernames scrubbed, never your work.
For companies
We set it up for you.
NerfedLab becomes whatever your organisation needs: the subscriptions you choose behind the engine, sign in through your SSO so the whole company is in by email domain, your products, repositories, reviewers, review gates and sensitive paths mapped out before the first draft, and NerfedLab’s engineers reviewing and merging when you have none. The mode is decided on the server, never by the app.
Your subscription
Every AI turn runs on your Mac through the subscription you connect; for a company, the subscriptions it chooses. There is no NerfedLab key and no server side generation.
Your machine
Projects live under a folder in your home directory. Designs, code, prompts and chat history never leave it.
Your repository
Every workspace is a real git repository with a commit per turn. Publish it to your own GitHub, back it up with its drafts and history, carry on from another Mac.
05The studioNerfedLab · Nº 01 · p. 24
Nine views of one product.
Ledger, a fitness app, from its first brief to its twelfth version. Every frame is the studio as it runs on a Mac today.
06Why a prompt box is not a companyNerfedLab · Nº 01 · p. 28
A real engineering substrate, under a friendly surface.
- 01
Governance that ships
Every change runs on an isolated draft through separate approvals: product review, code review, and a security pass that catches real vulnerabilities. Staged rollout, one click rollback, a full audit trail in git.
- 02
A real git substrate
Real repositories, branches and pull requests underneath, so the output is senior grade engineering, not a toy. Import any existing repository and design system.
- 03
The models you choose
For a company we set up the subscriptions behind the engine and route work to the best or cheapest model per task, a moving target we own so you do not have to.
- 04
Engineers as a service
For teams without their own, NerfedLab's engineers hold the merge gate: review, merge, and a monthly health report. Optional, and the natural next step.
A prompt box is copyable in a weekend. This stack is not.
07Meera, and the product managerNerfedLab · Nº 01 · p. 32
One product across the whole spectrum.
Managed · we are your tech team
Meera, a twelve person brand
Runs her storefront, her operations tool and her customer app on NerfedLab. No engineers of her own: ours review and merge, with a daily turnaround and a monthly health report.
Their engineers · they merge
A product manager inside a five hundred person company
Builds and tests a change on the company’s own app; their engineers hold the merge gate and review it like any other pull request. The tech team stops being the bottleneck.
A company signs once: security review passed, git access granted, governance set to its rules, sign in through its SSO. Then everyone with an idea can ship. Request a demo
08Two ways inNerfedLab · Nº 01 · p. 36
For your company, or for your fund.
For companies
Bring NerfedLab to your team.
A forty minute demo on a repository like yours, and the setup for your company: the subscriptions you choose, your SSO, your reviewers and gates mapped out.
For investors
We are raising a seed round.
The product is built, self funded and installable today. Write to hello@nerfedlab.com or ask for the deck.
“Vibe coding makes demos. We ship governed changes to real products, by the people who had the idea.”Rishabh Srivastava, founder. Previously Eternal.
Also from NerfedLab
Zocri
Your app, one sentence away. A working app or website on a link today, with bookings, orders, sign in, messages, campaigns and insights behind it. Free to start, in the browser.
Tertin
Presentations with AI. Describe the deck, answer a question or two, get a first draft, then shape every slide on the canvas and export to PowerPoint, PDF or the web.
Get NerfedLab
Your next product starts with a sentence.
Free to download for macOS on Apple silicon. For a company, we set it up: the subscriptions you choose, your SSO, your repositories and reviewers mapped out.
Nº 01 · The Governance IssuePhotographs and films made for this issuehello@nerfedlab.com