Careers
Work where “trust me”
isn't an argument.
Kirra doesn't maintain a list of open roles on this site. What we can show you — verifiably — is how the engineering actually works here, because all of it is public. If that culture reads like home, the door is the repository.
How we work
The culture is in the commit history
Deny by default — in code review too
The security invariants exist because people tried to violate them and were reverted. A change that weakens attestation, bypasses the admin gate, or removes the Unknown-command denial is rejected outright, no matter how convenient. Guardrails are scripted, not vibes.
Evidence over assertion
“It works” means a test, a proof, a drill, or a measurement — with its scope stated. Draft artifacts say Draft. Host benchmarks say host. The README's certification claim includes the sentence most companies leave out.
Proofs where they pay
We reach for Kani, Loom, and Miri when the property deserves it, and say plainly where the proofs end (the trig path is excluded, and documented as such). Formal methods as a tool, not a religion.
Real hardware, real humility
First governed motion on a physical robot happened in July 2026 — and the hardware findings doc records exactly what doesn't work yet (steering + drive together awaits a vendor image). We write down the failures with the same care as the wins.
robot/install/README.mddocs/hardware/HARDWARE_FINDINGS_R2X3.md
Getting involved
The interview is a pull request
The fastest way to work with us is to work with us: pick an issue, survive the 27 CI lanes, and defend your change against reviewers who will try to break it. Security researchers: the disclosure policy in SECURITY.md is the front door, and we respond within 48 hours.