Comparison
Claude Code: Terminal agent vs. self-hosted overnight desk.
Claude Code runs as a coding agent in the developer’s terminal or inside a hosted cloud session and applies edits on behalf of the user against the host repository. Driftlock runs offline inside the customer’s VPC and reads overnight engineering signals — a CI failure, a Dependabot alert, a CVE, an on-call page — producing one signed pull request per signal. Where Claude Code optimises for terminal-driven pair work against the developer’s checkout, Driftlock optimises for the audit-linked PR: the seven-column record a regulator replays on the customer’s storage tier, with trigger, sandbox hash, SBOM hash, signature, approver chain, diff bytes, and triage verdict kept distinct so a replay does not have to re-derive one column from another.
Posture
Driftlock runs self-hosted in your VPC; no third-party LLM is ever called at the test step.
Identity
Commits sign with your cosign key in your KMS or HSM. Keys rotate on your schedule.
Audit
Seven per-PR columns — alert id, sandbox run hash, SBOM hash, approver chain, signature, diff bytes, triage verdict — replayable on your storage tier.
What they do
Claude Code in one paragraph.
Claude Code is a coding agent that the developer invokes from their shell or inside a hosted cloud session, working against the host repository checkout and applying edits on the user’s behalf; the unit of work is a developer’s terminal session or a hosted Claude Code session, and the agent runs against the host repository in the user’s git workspace.
Where Driftlock differs
Eight dimensions where the posture diverges.
Each row names one axis — autonomy, hosting, audit, signing, SBOM, sandbox, monorepo scale, CI touch — and states both sides on that axis. No feature checklist, no marketing re-framing.
Axis · autonomy scope
Them
Operates at the developer’s terminal or inside a hosted cloud session; the user drives what to build or fix and approves or rejects the agent’s edits.
Driftlock
Acts only on overnight signals already in your stack (CI failure, Dependabot alert, CVE, on-call page); no goal, no run.
Axis · self-hosting
Them
Runs in a terminal on the developer’s machine or inside a hosted Claude Code session; the agent is not deployed inside the customer’s VPC.
Driftlock
Single Helm + Terraform deployment inside your VPC, behind your egress policy.
Axis · audit trail
Them
Audit does not natively separate the trigger, the sandbox hash, the SBOM hash, and the signature into discrete replayable columns; replay requires the host Claude Code control plane as the intermediary.
Driftlock
Records seven per-PR columns (alert id, sandbox run hash, SBOM hash, approver chain, signature, diff bytes, triage verdict) replayable on your storage tier.
Axis · commit-signing
Them
Does not natively sign commits with a cosign key held in a customer KMS; commit identity follows the developer’s local git configuration.
Driftlock
Commits sign with your cosign key kept in your KMS or HSM; key rotation happens on your schedule.
Axis · SBOM
Them
Does not emit an SBOM hash per PR as a first-class artifact; dependency review is delegated to the host repository’s tooling.
Driftlock
Emits an SBOM hash per PR, recorded alongside the diff and the signature so reviewers can diff two SBOMs without re-running the build.
Axis · sandbox execution
Them
Operates against the developer’s checkout in the terminal session or hosted session; there is no hermetic sandbox that pins the toolchain or replays the original regression before opening a PR.
Driftlock
Runs inside a hermetic sandbox that mounts the existing monorepo’s toolchain and test cache, and replays the original regression before opening the PR.
Axis · monorepo scale
Them
Optimised for terminal-driven pair work across many repositories and languages; large monorepos work but the host shell does not share the team’s existing build cache.
Driftlock
Built for one large monorepo per deployment; the sandbox mounts the monorepo’s existing caches so a CI rerun is bounded by what CI itself already proves.
Axis · CI touch
Them
May run the project’s tests as a developer-driven command but does not read CI failures as a primary engineering-signal trigger.
Driftlock
Treats CI as the source of truth — the agent reads CI failures as triggers and reruns the original regression inside the sandbox before opening the PR.
8 axes · posture-level · no feature checklist
FAQ
Questions comparison-stage buyers ask.
See it on your stack
Compare on a real monorepo, not a slide deck.
The architecture page names the four signal sources the watcher reads; the governance page enumerates the seven per-PR columns a regulator replays. Run the comparison against one of your real monorepos on a ten-day scoped trial — you'll see the diffs Driftlock ships and the audit trail your reviewers sign.