Start with a project.
Workbench has four profiles (Software Studio, AI Lab, Production Ops and Creative AI) and states disk, network, account and accelerator consequences before it installs anything. Projects live directly inside ~/Workspaces, so each request has a clear location for its inputs, changes and results. Open the same folder in ShadowCode or give it to a Mission Control mission.
shadowfetch-workbench plan software-studio
shadowfetch-workbench create software-studio demo-project
shadowfetch-control --workspace ~/Workspaces/demo-project --kind codeChoose the connection deliberately.
shadowfetch-agent-network decides whether Firebreak agent sessions start with network access. online is the default; offline starts every session without network until you grant it, and pauses Grok Bot, Hermes and OpenClaw. Either way the project is the only path on your disk a session can write, the sandbox environment starts empty rather than having known secrets removed from it, and every session takes a checkpoint and leaves a receipt.
shadowfetch-agent-network status
shadowfetch-agent-network set offlineCode and source-report missions choose a provider per mission: the cloud providers codex and claude, which require network approval, or the on-device localmodel, which needs a model service you supply. Where more than one provider is ready, --provider is required. ShadowCode keeps its own network setting; its Offline mode runs only models on this computer. Local files, creative tools and deterministic media exports stay useful with no network at all.
Review what changed.
Mission Control keeps activity, files and validation results beside the task, and ShadowCode shows each task's changes with Keep and Undo. Accept the result or restore its local checkpoint. Restoration checks for newer edits and cannot reverse effects outside the computer.