CTO Office · Betopia Limited

Writes code. Asks first.Never touches your cha.

Mando lives in your terminal and works inside your repository. It plans before it edits, shows every change as a diff, asks before it runs anything, and guards your API keys the way your mother guards the good dinner plates.

$ curl -fsSL https://mando.betopia.dev/install | sh

macOS · Linux · WSL Company sign-in, with MFA Every call through the Betopia AI Gateway

plan3 steps · tests first

secret guard0 leaks, 0 drama

Mando-Session 7f3a2creceipts kept

Real sessions, Betopia repos

See exactly what it's doing. Or don't. Your call.

Three levels of nosiness. Simple tells you what happened. Steps shows the plan and every yes you gave. Trace shows every file it read, every model it called and every rule it checked.

~/work/company-os-sync

Scripted replays of the behaviour in the Mando requirements. Names and repos are made up; the rules are not.

House rules

Six rules it won't bend. We asked nicely. Still no.

Nothing changes without you

Every edit arrives as a diff you apply hunk by hunk. Commands ask first. Tests and lint may run on their own, but only because you said so.

ask · allowlist · never

⌀

Secrets stay home

Outgoing context is scanned with gitleaks rules. One AWS key and the request stops cold. Mando doesn't read .env files. It's not curious like that.

target: 0 secret incidents

◐

Client code stays in-house

Client-Restricted repos use only our own GPU or a zero-retention provider. There is no "just this once".

policy by data class

⇄

One gateway, every call counted

No provider keys on laptops. Mando gets a 15-minute key, and every request lands in the ledger with your team and its cost. Finance says hi.

mando usage

⏻

Leavers lose access fast

Disable an account and Mando, its keys and its sessions are gone within 15 minutes. We rehearse it monthly, like a fire drill with fewer stairs.

monthly leaver drill

◎

Reviews, never approvals

mando review comments on merge requests. It never approves and never merges. Some decisions still need a human with opinions.

mando review !482

Under the hood

One harness. Three agents. Zero drama.

Mando shares its brain stem with Pia and Beto: one Betopia-owned harness for identity, policy, gateway access, tools, memory, knowledge, audit and evaluation. Here it is, orbiting.

move your pointer to tilt the orbit

01Sign in once. Device code and MFA in the browser. Tokens go to your OS keychain, never a file named tokens_final_v2.txt.
02Know your class. MANDO.md records the repo's data class. Policy picks the model and names its version every time.
03Only approved tools. Skills from the AI Coach catalogue, MCP servers from a reviewed allowlist.
04No release without evals. 50 tasks from our own Django, Node, React and Flutter code.

Five journeys

From curl to your first merge.

Install and sign in

One line, one device code, one MFA tap. Then init in your repo.

mando login · mando init

Code every day

Ask in plain words. Approve the plan, apply the diffs, commit with a session trailer.

mando

Review together

Point Mando at a merge request. Comments land on GitLab for the author to argue with.

mando review !482

Learn on the job

Your Academy track, the next lesson, a capped sandbox and the capstone.

mando academy

Leave gracefully

When an account is disabled, every session and key ends within 15 minutes. Farewell cake not included.

HAR-02

Hands on a keyboard with a code review on screen, warm desk light

Built for review

Changes you can explain to your lead.

Small planned steps instead of a 2,000-line surprise. Every commit Mando touched carries a Mando-Session trailer, so git blame finally tells the whole truth.

Per-hunk applyPlan before editGitLab first

AI Academy

Learn on the job. Literally.

Your Academy track lives inside Mando: next lesson, capped sandbox, capstone, and a place to show off your AWS, Microsoft, Google Cloud or Claude certificates. Every developer gets Foundation-certified. Yes, including the senior who "doesn't need it".

F1How Mando works: harness, gateway and model aliases
F5Secrets, data classes and the restricted alias
F8Capstone: ship a feature with a Mando-Session trailer

Developers in a bright Dhaka training room during an AI coding workshop

AI Foundation for Betopia Engineers6 / 8

F1F2F3F4F5F6F7F8

Mando helpSetup · step 4 of 5

set up mando

What data class is the repo you'll work in first?

Client-Restricted

In-house onlyClient-Restricted repository

Allowed: restricted
Default: restricted
Policy: v1

Run mando init in the repo. It writes MANDO.md with the class.

What's my next lesson?Show my usageWhich skills can I add?

Help, in chat

Ask Mando, not the group chat.

Stuck on setup? Wondering how much of today's budget you've burned? Mando's help desk answers in chat with live cards: your Academy progress, your usage, the models your repo may use, and the skills and tools approved for your role.

Rollout

Four steps. No surprises.

Step 1

AI Summit

Live demos of Mando, Beto and Pia. Applause encouraged, not required.

Step 2

First cohort

Coding agent, approvals, secret guard, GitLab and the Academy track.

Step 3

Every developer

Sandboxes, capstones, mando review and self-update.

Step 4

Foundation-certified

Every Betopia developer. Every single one.

Almost ready

Your repo. Your approval. Mando does the typing.

The installer opens with the first cohort. Ask your lead to save you a seat, and maybe a cha.

$ curl -fsSL https://mando.betopia.dev/install | sh