Model Citizen v0.14.0

The control plane for your coding agents, however you run them.

An open-source control plane for coding agents. One checkout of rules, skills, roles and stances, projected into Claude Code and Codex with your own primitives, enforced with hooks, and measured with usage telemetry and cost controls. It layers under the rules libraries and orchestration you already use.

Preferences you can switch: autonomy, delegation, cost, testing, voice, commits, planning, licensing and build versus buy. Three of those bind to enforcement today: autonomy sets which shell-command grade stops and asks, delegation changes spawn routing, and cost resolves a model and budget table per role. The rest are prose that swaps cleanly. The usage report groups rule hits by the variant that was selected, so a switch can be checked rather than assumed.

Compatibility

• claude-code-cli-macos: qualified
• claude-code-vscode-macos: unqualified
• claude-code-cli-linux: qualified
• claude-code-plugin-marketplace: unqualified
• codex-cli-macos: unqualified
• codex-vscode-macos: unqualified
• codex-desktop-macos: unqualified
• codex-cli-linux: unqualified
• cursor: planned
• grok: planned

Native restrictions remain authoritative. See the versioned compatibility catalog for evidence and gaps.

Compatibility policy

Stable interfaces, preview boundaries, deprecation, migration and failed-release recovery are defined in the versioned compatibility policy.

Migration

Upgrade from v0.13.1 by reviewing the generated v0.14.0 projection before applying it: a minor release that renames the product to Model Citizen, adds the citizen command with harness kept as an alias, renames the plugin to model-citizen@model-citizen, and adds one selection resolver with modes and on/off switches for rules, skills, workflows, roles and hooks. Sync now links the repository's rules one file at a time into a real ~/.claude/rules/harness/ directory instead of one directory link. The release also adds the local decision provider's user-level policy file and its binding into Bash command grading, a write-intent ledger for parallel writers, workspaces built from .code-workspace files, session-start injection of a differing project or session stance, a profile fingerprint, schema versions and context attribution on ledger rows, and the concise voice. Every new switch, mode, provider and workspace is off or unchanged until you select it. The architecture-viewer preview is inert until an external adapter is registered and selected.

• Run citizen sync --dry-run from the v0.14.0 checkout and inspect every proposed write, ownership change and conflict. Expect one migrate ~/.claude/rules/harness (one link per rule replaces the directory link) line followed by one link line per rule into that directory, and relink lines for skills, agents, commands, hooks, the output style, stance links and CLAUDE.md. Nothing outside the harness's own files should appear.
• Run citizen sync only after resolving unmanaged-file and adoption conflicts. Afterwards ~/.claude/rules/harness is a real directory of per-rule links, and citizen diff reports no drift.
• harness keeps working as an alias of citizen; the documentation now names citizen.
• If you installed the Claude Code plugin, move it to the new ID: with a checkout installed run citizen upgrade --dry-run, then citizen upgrade, which uninstalls agent-harness@agent-harness, removes the agent-harness marketplace, adds it again from its recorded source and installs model-citizen@model-citizen. A plugin-only install runs the same four /plugin steps in a session; see docs/runtime-installation.md. Skills move from /agent-harness:<name> to /model-citizen:<name>.
• Your configuration keeps working unchanged. A new citizen init records the stances it wrote under init_defaults; a v0.13.1 configuration has none, so every stance reads as set by you in citizen selection. To try a mode, run citizen config set mode minimal (or full, the defaults); a key you typed still wins over the mode. Switch a unit off with citizen config set <kind>.<id> off, for example rules.decisions-and-plans; the four core hooks, grade-bash, stop-gate, brief-guard and neutralize-tool-output, can be switched off only after you set core_switches_acknowledged true. See docs/modes.md.
• With governance.provider set to anything but none, grade-bash now asks the provider about every Bash command it lets through, and an agent write to a governance policy file or to your config.json is always asked about. A user-level governance.json beside config.json is read under the repository's .agent-harness/governance.json. Under provider none nothing changes.
• Workspaces are opt-in: set workspaces_dir to the folder holding your .code-workspace files to turn on citizen workspace and the workspace-session start hook; while it is set, sync owns CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD in ~/.claude/settings.json. See docs/workspaces.md.
• Expect new rows in ~/.local/state/agent-harness/ to carry schema_version, profile_fingerprint and, on session rows, context_attribution; rows written earlier are read unchanged and never rewritten. On Claude Code a second edit to a path a live sibling session has claimed with citizen intent claim is denied; coordination.repeat_overlap: "warn" only warns.

Recovery

• Preserve reported conflicts, adopted backups, external viewer adapter descriptors and external viewer installations.
• To return to v0.13.1, first remove ~/.claude/rules/harness, which v0.14.0 made a real directory holding only links to the checkout's rules, then check out v0.13.1 and run harness sync once. Skip the removal and the v0.13.1 sync refuses at that path, exiting 2 after it has already relinked stances, hooks, skills, commands and CLAUDE.md, which leaves a mixed home until a sync succeeds; --adopt completes it only by moving v0.14.0's directory under ~/.local/state/agent-harness/pre-harness/ as though it were your own backup. After the rollback, v0.13.1's harness diff and harness doctor report one missing link per rule under ~/.claude/rules/harness/: stale journal entries from v0.14.0, harmless because the directory link serves every rule, and cleared by the next v0.14.0 sync.
• v0.13.1 ignores modes, switches, init_defaults, core_switches_acknowledged and workspaces_dir, so every rule, command and hook comes back on, and nothing in your configuration needs removing for its sync to succeed. Its local provider reads only the repository's .agent-harness/governance.json, never the user-level file, and its grade-bash does not ask the provider. If you set workspaces_dir, run citizen config unset workspaces_dir and citizen sync from v0.14.0 before rolling back, so sync puts CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD in ~/.claude/settings.json back to what it held; v0.13.1 never touches that key.
• A rollback sync does not touch the plugin: citizen upgrade has no reverse, and a moved install stays model-citizen@model-citizen.
• Use harness uninstall to remove the installation, and follow docs/runtime-installation.md for rollback and ownership recovery; use docs/task-continuation.md for task continuation.