What the fleet answers to.

Two records, one commit.

Git records that a change happened. It cannot record which agent made it, which review cleared it, what it cost, or which rule it was judged against, because none of that is in the commit. The right-hand record is not a nicer log of the same events. It is a different set of facts, captured while the work happened rather than reconstructed afterwards.

Worktrees are table stakes.

The pool is installed and built before work arrives. A claim is atomic, dispatch takes seconds, and spend lands on the run that spent it, held branches included.

Every session, live.

The console sees every session on the machine as it runs. Type into one to steer it mid-turn; an idle session parks and resumes where it stopped.

One console, machine-wide.

session discovery across every project root, live and past

Steer without killing the run.

the composer lands your message inside the running turn

Idle parks, never vanishes.

durable runner record keeps parked sessions visible and resumable

The board derives itself.

A tracker goes stale because keeping it current is a second job somebody has to remember. Here it is not a second job. Opening the item, binding the branch, stamping the PR and closing on merge are steps the agent already takes to do the work, and the board is the projection of those steps. Nothing is reported, so nothing can be reported late.

A commit cannot land untracked.

pre-commit refuses a commit with no active work item

A new branch is born tracked.

post-checkout opens the item from the branch itself

Stages only move forward.

the spine refuses a backward advance

One dial, three breakers.

The dial is the part you set. The breakers are the part you cannot unset, and they are why turning the dial up is a decision rather than a gamble: at full autonomy the fleet still cannot widen its own limits, clear its own review, or run unattended forever.

Refute by default.

Every finding meets a verifier that did not write the fix and starts from no. A resolved thread carries the evidence that closed it, whichever way it closed.

The fixer never clears its own fix.

resolution requires an independent verifier

A dismissal carries its proof.

justify-and-resolve records the refutation on the thread

Reviewers are pluggable.

provider adapters behind one review contract

Append only, actor named.

Two properties do the work here, and both are structural rather than promised. Every event names the actor that caused it, so “who decided this” is a field and not an investigation. And the store only ever appends: there is no update path and no delete path, so the record of a decision cannot be tidied up afterwards by the thing being judged.

Teach it once.

Finished sessions are distilled into rules the whole fleet is judged against. Contradictions are arbitrated, the loser is held for you, and the winner keeps its receipt.

1. ingest->
2. extract->
3. reconcile->
4. curate->
5. gate->
6. render

Contradictions do not both survive.

conflict detection with source-rank arbitration

A lesson learned twice stays one rule.

bounded-similarity dedup with a judge confirm pass

A contested rule waits for you.

the gate holds duplicate and conflict losers

One call crosses the line.

Local-first is easy to claim and hard to verify, so here is the verifiable version: there is no API SDK anywhere in the codebase. The model call goes out through the Claude Code CLI you are already logged into, under your own Anthropic agreement. We do not hold a key, run a relay, or operate a cloud for this product, which means there is no configuration in which your code reaches us.

One window.

Sessions, worktrees, runs, spend, the board, the gate and the canon, one instrument. Every list searchable from ctrl-k.