Quill
A desktop app that makes AI-written documentation reviewable by the people who own it, not just by engineers who can read a diff.
- permission tiers enforced, all resolved from the source-control platform
- 3permission tiers enforced, all resolved from the source-control platform
- isolated working trees, so concurrent reviews never collide
- 1 per branchisolated working trees, so concurrent reviews never collide
- application-managed access lists to keep in sync
- 0application-managed access lists to keep in sync
An agent that writes documentation is only useful if someone can check it. Quill is the review surface: it renders proposed changes in the real published theme, lets a non-engineer fix them in place, and delegates every permission decision to the systems that already hold them. It is what keeps AI-drafted documentation reviewed rather than published on trust.
The problem
The documentation agent proposes changes as pull requests, which meant reviewers had to judge rendered output by reading raw markup diffs. The people best qualified to catch an error — the documentation team — were the least equipped to read that format, and could not make a small correction without asking an engineer. The bottleneck was not authoring, it was review.
Constraints
- Several proposals are open at once, so editing one cannot disturb the working copy of another.
- Reviewers are not engineers; anything requiring command-line work would not be used.
- Access control must not become a second system to keep in sync with the source of truth.
- Reviewers need to see what customers will see, not an approximation of it.
Decisions
What I chose, why, and what I turned down to get there.
A separate working tree per proposal
Each open branch gets its own checkout, so the primary copy is never modified and parallel reviews cannot collide. Editing in place on a shared checkout is the obvious implementation and the one that corrupts state the first time two reviews overlap. Paths are validated to prevent traversal outside the intended directory.
Considered and rejected
- Editing directly in a single shared checkout — simpler until two people review at once, then wrong in ways that are hard to unwind
Delegate permissions entirely to the source-control platform
The app resolves the user's live permission tier and adapts: read-only reviewers can view but not edit or merge, write access unlocks editing, and full access unlocks merging. There is no in-app access list, so adding a collaborator in one place grants the right level everywhere. A duplicated permission model is a permission model that drifts, and drift in access control is a security bug.
Considered and rejected
- An application-managed access list — one more thing to maintain, and it would diverge
Render in the real published theme
The published styling is vendored so the side-by-side comparison shows what readers will actually get, with word-level highlighting. A reviewer approving documentation is approving how it reads in context, which a markup diff cannot show and which is exactly where errors of tone and structure hide.
Embed a real terminal, not a simulated one
A genuine terminal session opens in the active working tree so a reviewer can re-run the authoring agent on the spot rather than filing a request and waiting. The loop that matters is see a problem, fix the source of the problem, review again — and that loop only closes if the agent is reachable from where the review happens.
What shipped
A working desktop application covering the full review path: a filtered list of open proposals, rendered side-by-side comparison with inline and multi-line comments that post back to the real pull request, approve and merge as genuine actions, a searchable article browser with version preview, an in-place editor with image management committed atomically alongside the text, a command palette for jumping to any article, a conversation timeline, and automated builds attaching signed installers to releases.
- Inline suggestions are posted in the platform's native suggestion format, so a reviewer's fix becomes a one-click accept rather than a comment someone has to transcribe.
- Maturity, stated precisely: Quill is an internal release. The documentation-synchronization workflow it supports runs in production.
Stack
- Electron
- React
- TypeScript
- Git
- GitHub API
- TinyMCE
- node-pty
- GitHub Actions
What was mine
Designed and built solo, from the first proposal through release automation. The documentation team owns the review decisions the app exists to support.