How the search works
Your models propose changes.
{{ howLive1 }}
Tests run first. Failures drop out here.
{{ howLive2 }}
Only passing candidates are benchmarked.
{{ howLive3 }}
Faster and still correct wins.
{{ howLive4 }}
Owns authenticated policy, scheduling, leases, quotas, and source-free lifecycle state.
Owns source-bearing work, model invocation, evaluation, raw evidence, recovery state, and final apply authority.
Scope note: The MCP protocol no longer has a sampling capability, and the service constructs no sampling requests. Source-bearing runs from the retired MCP-sampling era are quarantined and export-only. This page describes the canonical provider-neutral executor/job path.
Eval integrity
A search that writes its own code will eventually try to game its own test. Most of Sleepy's engineering went into making the admitted evaluator boundary detect that behavior and fail closed.
tl;drCandidates run in disposable, no-network containers against tests they can't touch; timing is preregistered and paired; every verdict carries an auditable hash chain. Eight controls, all fail-closed.
In the guarded evaluator profiles, each candidate command runs in its own container from an image pinned by digest - never pulled at run time - and the whole container, workspace and all, is destroyed afterward.
golang@sha256:ea341baa… · --pull=never
No external network, zero Linux capabilities, private PID/mount/IPC namespaces, and an irreversible seccomp filter installed before any candidate instruction executes.
caps: 0 · net: none · no_new_privs · seccomp first
Your tests and benchmarks run from an immutable snapshot; the live tree is never mounted writable. Benchmark names are locked at seed discovery behind a private receipt - a candidate can inspect the allowlist, but can never acquire fitness authority.
authority snapshot · read-only · sha-256 receipts
Every passing run is re-run through a deliberately broken harness overlay that must fail with a random marker. A candidate that forges stdout, exits 0 early, or rewrites testing flags cannot satisfy both runs.
negative control · unpredictable marker · must fail
Before any run, a capability probe verifies the sandbox from inside - user maps, read-only mounts, zero capabilities, active seccomp, memory and process ceilings. One missing property and Sleepy refuses to run at all.
probe verified in the candidate process itself
The decision policy is fixed before anything is timed: measurement schedule, warmup and measured blocks, minimum win ratio. Baseline and candidate are measured paired - same session, same hardware - and scored on the median of repeated samples. No cherry-picking, by construction.
policy first · paired runs · median of n
Every verdict is bound to digests of the source snapshot, baseline and candidate bytes, evaluator contract, sandbox policy, toolchain, hardware, and environment. Execution receipts form a custody sequence - one gap invalidates the run.
8 digests per verdict · custody, not trust
Final verification never reuses the search session: fresh containment, a fresh baseline measurement, the exact champion bytes re-verified - only then is the verified output finalized. Tampering between verify and apply fails closed.
fresh baseline · exact bytes · then commit
per candidate: 1 cpu · 60 cpu-seconds · 2 GiB, no swap · 128 processes · 4 MiB output · 15 min wall · then the container is gone
These ceilings bound each candidate's cell, not your project or your machine. Configurable limits are on the roadmap; the fail-closed defaults are not.
The primary execution authorities are stated, not hidden: your host kernel, container runtime, pinned image and toolchain, evaluator authority snapshot, and the Sleepy binary. A written audit guide lets a reviewer verify the admitted boundary.
Trust boundary
The hosted control plane is code-blind: it coordinates source-free jobs. Your client-owned executor invokes your chosen model provider, runs the exact evaluator contract locally, and retains raw evidence. Start that path with sleepy worker. MCP sampling is EOL and sits outside this canonical boundary.
The platform
The current shipping surface. Qualify a project, point a worker at a hot function, and stream the search from your terminal.
Your dashboard for runs, schedules, and the public proof ledger. It coordinates the search - it never sees your code.
Log in →Inspect, apply, decline, and guarded-revert winners before they touch your tree. The macOS build is signed with Developer ID and notarized by Apple.
Requires an Apple silicon Mac running macOS 12 or later. Intel Macs are not supported by the desktop build — use the CLI instead. Automatic updates are not enabled in this beta; download a newer build here when one is published.
The search runs overnight. The proof is waiting in the morning.