Vigla

Open-source mission control for coding agents.
Run cross-vendor workers in parallel worktrees. Audit every submission. Revert the whole mission when the result is wrong.

Open the 16-second replay  ·  Field notes  ·  Build on macOS  ·  Read the architecture  ·  Take an open task

Five coding agents should not mean five terminals, five diff reviews, and five
unread merges. Vigla gives the work one operations room and gives you one job:
set the authority envelope, then judge the verdict.

Vigla is local-first: a Rust orchestrator, Tauri shell, and SQLite event store,
with no cloud control plane, product account, or product telemetry. It
supervises the command-line tools you already use; it does not wrap model APIs
or add another billing layer.

Recovery receipt — 27/27. Every seeded failure trajectory escalated
within the default retry bounds. Reproduce the credential-free case set with
cargo xtask receipt, then inspect the public
method, data, and limitations.

Try the no-install replay

Open the read-only browser replay to
step through accepted, bound-tripped, and quota-paused missions in the real
Operations Room UI. The three event streams are hand-authored canonical
event-schema events committed in app/src/demo/recordings.ts — a scripted,
deterministic replay, not a capture of a real vendor session. The UI is the
production one; no account, vendor CLI, credential, or network-backed agent is
involved.

Run the credential-free demo locally

Vigla ships a mock supervisor, so you can watch a whole mission —
decomposition, parallel workers, integration, audit, verdict — with no vendor
CLI, no credentials, and no token spend:

git clone https://github.com/Kilbex/Vigla.git && cd Vigla
pnpm install --frozen-lockfile
./scripts/dev.sh

When the Operations Room window opens:

1. In the DEPLOY WORKERS panel, describe the work under What should the
   team do?
2. Click Choose folder… and pick a Git repository.
3. Expand Advanced.
4. Set the Supervisor dropdown to Mock (demo) — the only other choice
   is Claude.
5. Click Start mission. A notice above the button confirms the mock is
   armed.

The choice is sticky per machine and defaults to Claude, so the demo is
opt-in and nobody gets it by accident.

The mock mission is not a dry run. It spends nothing and reads no
credential — no vendor CLI process is launched and no API key or login is
read — but it drives the real mission machinery against the folder you chose:
it creates a supervisor branch and worktree, a branch and worktree per worker,
writes files, and makes real git commits, then integrates each worker's work
and stops at a pending-merge decision you Merge or Discard from the
mission overlay. (The review queue is a different surface: it triages
individual worker submissions, not the mission verdict.) Point it at a scratch
repository or a branch you don't mind.

It shows the happy-path arc only. Every task takes a clean first pass by
construction, so a mock mission can never produce a blocked, failed,
retry-exhausted, or quota-exhausted trajectory, and Plan mode Review has no
effect on it — the mock runtime never pauses for plan approval. The unhappy
paths live in two other places:

• the browser replay, which scripts
  accepted, bound-tripped, and quota-paused missions;
• the seven bundled mock-harness scripts — claude_happy, codex_blocked,
  gemini_happy, gemini_blocked, gemini_failed, gemini_terminal,
  claude_quota_exhausted — each of which drives a single worker, not a
  mission. Run mock-harness --help for the trajectory each one takes, or
  spawn them from Settings → Developer → Mock spawn in a development build
  (import.meta.env.DEV, or VITE_VIGLA_E2E=1).

Prereqs: macOS 12+, Rust 1.95 via rustup,
Node 22, pnpm 10, Xcode Command Line Tools. See
CONTRIBUTING.md for the full setup.

How it works

1 — Assign a mission inside an envelope. Describe the goal, choose
the worker roster and models, and set the authority envelope. In review
mode the supervisor proposes a plan first — task graph, file scope, risk
fit — and waits for your approval:

2 — The supervisor arbitrates; you stay out of the loop. Workers
execute in parallel worktrees while the supervisor reviews each
submission and decides Accept / Extend / Scrub / Escalate — inside
your envelope, without pinging you. Live state, diffs, tests, cost, and
raw terminals are always one click away if you want to watch.

3 — You judge results, not keystrokes. Finished missions land in
your inbox with a structured verdict: audit score, test results, files
changed, residual-risk band, unresolved issues — and a revert button
that undoes the whole mission atomically:

The vocabulary is small and precise — mission, worker, envelope,
arbiter, verdict — and defined in docs/lexicon.md.

How it compares

The table is positioning, not a feature checklist. Each cell is backed
by a primary source below; cells are re-verified before each release.

Sources verified 2026-07-21. “Not documented” means the linked product
documentation does not describe that capability; it is not a claim that an
internal implementation is impossible.

• Vigla. See this README and ARCHITECTURE.md for positioning
  and goals; LICENSE (Apache 2.0).
• Codex app (OpenAI).
  Introducing the Codex app
  documents parallel agents, local and cloud work, and built-in worktree
  support.
• Claude Code on desktop (Anthropic).
  Claude Code on desktop
  documents parallel sessions and automatic worktree isolation; the
  worktrees guide covers the
  underlying isolation flow.

Vendor support

Real workers are driven from the in-app Deploy panel; the mock harness
covers demos and CI. Two independent tiers of evidence back a vendor, and
they are not interchangeable:

• Adapter goldens (CI). Committed transcript-and-golden pairs run through
  the shared vigla-adapter-conformance harness on every pull request. They
  pin the byte-to-event contract. They prove nothing about the vendor binary.
• Real-CLI gate (local, opt-in). An #[ignore]d integration test that
  spawns the actual CLI against a failing fixture repository and asserts the
  agent fixed the defect. It needs a working binary and credentials, so no
  CI workflow runs it — a maintainer runs it by hand.

Google ended consumer Login with Google access for Gemini CLI on
2026-06-18. Vigla retains the adapter for existing enterprise and legacy
configurations, but Gemini CLI is no longer a primary launch path. Google
directs affected consumer users to Antigravity in its
official deprecation notice.

Mission supervision is Claude-only today. The Supervisor dropdown offers
exactly two values — Claude (spawns the real claude CLI) and Mock (demo)
(the scripted runtime, no vendor process) — and host_services rejects any
other supervisor_model with UnsupportedSupervisorModel. There is no
experimental non-Claude supervisor to opt into; a second real supervisor is
roadmap work. Vigla does not pin vendor CLI versions — the
launch path verifies each configured binary, and the real-CLI gates track
adapter compatibility:

cargo test -p vigla-orchestrator --test real_claude_gate -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_codex_run   -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_antigravity_run -- --ignored --nocapture --test-threads=1
VIGLA_LIVE=1 cargo test -p vigla-orchestrator --test supervisor_live -- --ignored --nocapture

VIGLA_LIVE=1 is not optional on the last line: without it every test in
supervisor_live.rs prints a skip line and passes, so the gate looks green
without having run.

The Claude and Codex gates use tests/samples/sandbox/, a workspace-excluded
crate with a deliberately wrong multiply function. The Antigravity gate
creates the same kind of isolated failing Rust fixture in a temporary
repository. Each of those three asserts that the agent fixed the defect. The
supervisor gate builds its own throwaway repositories instead — a wrong add,
a broken test, and a docs task — and asserts that a real claude supervisor
drives each mission to a completed, audited verdict.

Feature tour

• Deploy panel — supervisor profile, worker vendor roster, worker
  count, model selections, plan mode, objective, folder, and optional
  scoped paths.
• Plan governance — direct mode, or review-first mode showing the
  generated plan, task graph, worker assignments, file scope, and
  envelope checks with approve / regenerate / abort.
• Arbiter-driven supervision — one supervisor per mission decides
  Accept / Extend / Scrub / Escalate without pausing inside the
  envelope.
• Structured completion verdicts — CompletionVerdict scores test
  pass, scope, regression, and lint into a residual-risk band
  (Low / Medium / High) with the full audit breakdown in the inbox.
• Reversibility envelope — task integrations and the final target merge
  receive distinct rollback anchors; Revert mission preserves later commits.
• Inspectable aborts — abort retains Vigla-owned branches and worktrees for
  diagnosis; the explicit Clean up artifacts action removes them later without
  changing the target branch.

• Real CLI and mock workers — Claude Code, Codex CLI, Antigravity,
  legacy Gemini CLI, profile-backed Kiro / Copilot, plus deterministic mock
  workers for development and demos.
• Isolated worktrees — each worker gets its own git worktree and
  branch; work is inspected, merged, discarded, or reverted without
  touching your main checkout.
• Canonical event stream — adapter-normalized status, cost, file,
  test, review, and terminal events (event-schema).
• Session-aware recovery — Claude workers support retry and
  follow-up continuation; quota windows can pause missions and resume
  them when the window reopens; failures are classified for retry,
  continuation, or escalation.

• Station canvas — one tile per worker with dependency edges, live
  status, task, model, progress, ETA, cost, file and test counters.
• Worker drawer — result, feed, terminal, files, tests, cost, and
  plan tabs; stop, retry / continue, switch models, assign squads.
• Review queue — workers needing review surface as actionable cards
  with open, retry, continue, accept, and reject flows.
• Live terminal capture — raw stdout/stderr preserved alongside
  normalized events; a power-user feed with every event is one toggle
  away.
• Squads — group workers, designate leads, color-code the fleet.

• Mission inbox — completions, escalations, side effects,
  unresolved issues, audit breakdowns, and revert eligibility in one
  right rail; macOS notifications when a bound trips while the app is
  unfocused.
• Mission history — browse audited missions with status, risk
  tier, and full drill-down.
• Worker replay — page through event history, play / pause, step,
  scrub, change speed, and return to live.

• Local Memory Kernel — repository-scoped memory written through a
  single-writer path and attached to future workers as context bundles.
• Pinned notes + auto-promoted insights — pin facts, decisions, and
  hazards; completed work proposes durable notes after validation.
• Safety filters — memory writes are size-limited, schema-checked,
  secret-scanned, and drift-checked.
• Vendor-native files as render targets — CLAUDE.md, AGENTS.md,
  and GEMINI.md are generated projections, never the source of truth.

Built in public

Priorities move with operator evidence and focused contributions. See the
full roadmap for acceptance boundaries and the work Vigla
deliberately will not take on.

Tech stack

The only abstraction Vigla permits is the event boundary: vendor CLI
bytes → canonical events. Adapters live in crates/adapters/{vendor}, one
crate per vendor, pure translation — no I/O, no process spawning, no
git.

The desktop app is macOS-only, so those are the paths you will actually
see. The orchestrator crate is portable and resolves the database
against the host platform's own convention, which is what the Linux CI
job exercises: $XDG_DATA_HOME/vigla/vigla.sqlite (default
~/.local/share/vigla/vigla.sqlite) on Linux, and
%APPDATA%\Vigla\vigla.sqlite on Windows. VIGLA_DB_PATH overrides
all of them.

vigla/
├── app/                  # Tauri 2 + React 19 + Vite + TS
│   ├── src/              # React UI, Zustand stores, hotkeys
│   └── src-tauri/        # Tauri host (Rust): IPC, event forwarding
├── crates/               # All Rust library/bin crates (Cargo workspace)
│   ├── orchestrator/     # Rust supervision crate (business logic)
│   │   ├── src/memory/               # Memory Kernel (event-sourced)
│   │   ├── src/mission_runtime/      # Mission state machine + replay
│   │   ├── src/mission_supervisor_run/ # Supervisor turns + review loop
│   │   ├── src/supervisor/           # Worker process lifecycle + resume
│   │   ├── src/arbiter/              # Bound-based escalation decisions
│   │   └── resources/                # Bundled at compile time:
│   │       ├── vendor_profiles/      #   per-vendor command-rendering policy
│   │       └── skills/               #   worker skill set (embedded)
│   ├── adapters/         # One pure crate per vendor CLI + supervisor
│   ├── event-schema/     # Canonical typed event contract
│   ├── mock-harness/     # Mock vendor CLI (credential-free demos)
│   └── xtask/            # Workspace task runner (cargo xtask)
├── tests/                # Playwright e2e specs + real-CLI sample targets
├── docs/                 # Lexicon, good-first-issues, media
└── scripts/              # dev.sh, build.sh, capture-readme-media.cjs

Deep dive: ARCHITECTURE.md covers the orchestrator,
memory kernel, mission lifecycle, arbiter / audit / recovery, event
schema, and per-vendor adapters.

Requirements

• macOS 12+. Linux and Windows are on the roadmap —
  the non-host Rust workspace is built, linted, and tested on Linux in CI;
  desktop packaging and platform UX are scoped on the roadmap.
• Development: Rust 1.95 (pinned via rust-toolchain.toml), Node 22.x,
  pnpm 10.x, Xcode Command Line Tools.
• Vendor CLIs are optional and only needed for real (non-mock) workers.

Build a local DMG

Vigla publishes no maintainer-built binaries today: there is no signing
identity, notarization credential, or update channel to trust, and the only
supported artifact is the one your machine produces. (A Mac App Store release
would replace that trust model with Apple's; whether to make that trade is
undecided and under investigation.) On a
Mac, clone the source and run one command:

./scripts/build.sh

The script installs the locked frontend dependencies, builds the application,
ad-hoc signs it without an Apple account or personal signing identity, verifies
the app and disk image, and prints the DMG path and SHA-256 checksum. The local
artifact remains under target/release/bundle/dmg/; no workflow uploads it.

Keep the printed checksum with the artifact. SECURITY.md
documents the independent shasum, hdiutil, and codesign checks.

Prerequisites are the development tools listed in Requirements.
Set EMBEDDINGS=1 when running the command to include the optional embeddings
feature. Its first use downloads the public FastEmbed model into the per-user
cache; if that download is unavailable, retrieval falls back to local BM25.

Known limitations

Design trade-offs in the current build, not bugs:

• Real supervisor execution is Claude-only. supervisor_model accepts
  claude (the real CLI) or auto (the scripted mock); everything else is
  rejected. Cross-vendor applies to workers, not to the supervisor.
• Memory retrieval is local and best-effort. Alias-expanded BM25
  with optional embedding / hybrid re-ranking; degrades to lexical
  retrieval instead of blocking workers.
• The supervisor sees typed mission events, not raw worker
  dialogue. By design — escalation is bounded on outcomes, not
  chain-of-thought.
• Session resume requires vendor session-ID support. CLIs that
  don't expose a session ID can't be continued across app restarts.

Why "Vigla"?

Vigla (Byzantine Greek βίγλα, "watchpost" — from Latin vigilia,
the root of vigilance) was the imperial guard regiment that kept the
night watch on campaign: it posted the sentries, held the watchword,
and ran the signal line so the emperor could actually sleep. That is
this app's entire job — a supervisor that keeps trained watch over a
fleet of powerful agents and wakes you only when something crosses a
bound.

In category terms: Vigla is an open-source control plane for supervised
agent operations — coordinating fleets of AI coding agents instead of
babysitting them one terminal at a time.

Contributing

Start with CONTRIBUTING.md and
ARCHITECTURE.md; project authority and maintainer
succession are explicit in GOVERNANCE.md.
Newcomer-friendly tasks live in
docs/GOOD_FIRST_ISSUES.md — adapter
fixture work is the recommended first PR and is designed to land in
under two hours.

Questions and bug-report routing: SUPPORT.md. Security reports:
see SECURITY.md. Reviewing or recording Vigla? The public
creator kit provides a 10-minute script,
credential-free inputs, media, evidence, and exact claim boundaries.
Operators coming from vibe-kanban can use the
concept-by-concept migration guide;
it does not claim a database importer or kanban-board parity.

License

Apache 2.0, with the project NOTICE. Bundled component
attribution and retained licenses are in
THIRD_PARTY_NOTICES.md; the generated,
self-contained THIRD_PARTY_NOTICES.txt covers the
locked production Rust and JavaScript dependency graphs.