celestial v0.3.0

Install: git clone this repository, then cel update.

Added

• A worker may no longer land, release, delegate, scout, spike, collect or
  reconcile: the guard denies those verbs for the worker role and
  cel-fanout refuses them on its own before any gh call or ledger lock, so
  the bottom tier ships a PR and reports rather than driving the factory.
• The two signed-in subscriptions are visible at last. The fleet runs on a
  Claude subscription (pi's OAuth and Claude Code) and a Codex one (ChatGPT,
  through omp), and nothing on the plane could see either: cel quota knew API
  balances only, so a five-hour window at 100% stopped every worker on that
  account with no message anywhere anyone looks. cel quota now prints one row
  per signed-in account above the balances — each window, its percentage and
  the local time it resets — and cel quota --json carries them under
  subscriptions. A token is never printed: an account is named by its
  provider plus a short stable id. Readings cache for 60 s, so the console's
  status edge (claude 16%/41% · codex 9%/62%, amber at 80, red at 100), its
  new q QUOTA view, cel fleet --json and the dashboard's Subscriptions card
  all read the cache instead of calling a provider on every draw. The steward
  raises one rolled-up item per account (status over CEL_SUB_WARN_PCT, 80;
  blocked at 100) and clears it when the window drops, and a profile routed at
  a spent 5h window is vetoed before its pane spawns, with the reset time in
  the refusal
• The ledger closes what the world already closed: cel-fanout reconcile
  lands the rows whose PR GitHub merged, abandons the ones closed unmerged past
  CEL_RECONCILE_GRACE_HOURS, raises one rolled-up item per unread scout
  report and releases ship rows with no PR and no worktree - one gh pr list
  per repo, run every steward tick, with release --all --merged and a console
  X option for the same clean-up by hand
• Releasing is one verb: cel release <x.y.z> dispatches a GitHub workflow
  that checks hygiene and the suite, bumps VERSION, closes [Unreleased] and
  opens the release: v<x.y.z> PR; merging it tags and publishes the GitHub
  Release from the same notes. --dry-run shows what would ship and
  cel release status the open PR and newest tag
• The console is a control panel: the unit view now lays out ORCHESTRATOR ·
  WORKERS · BOARD · PRS · WAITING · RECENT MAIL, with Ctrl+T cycling
  the focus and panels that would not fit collapsing to a title and a count
• BOARD: the product's tickets from cel-linear board --json, grouped by
  state in the team's workflow order, with the worker on each; Enter opens the
  ticket detail
• PRS: the open pull requests on the product's repos from one gh pr list
  per repo - review decision, checks, age - with l landing an approved, green
  one through cel-fanout land
• "Since you last looked": a one-line digest under the unit view's header,
  computed from the console's own cursor per workspace, and a TIMELINE view
  (T, or Ctrl+Y) merging the mailboxes, the delegation ledger and the merged
  pull requests into one column, newest last
• Seven verbs as keys and as intents: start, answer, land, nudge, restart,
  move and review, each a proposal on the command line and each a router intent
  with its slots filled from state the console already holds
• cel-linear board [--team K] [--state a,b] [--json]: a team's open issues and
  what it finished today, grouped by state in workflow order, with the raw query
  cached 60 s under $CEL_CACHE so the console's refresh cannot hammer Linear
• cel gateway - several Codex/Claude subscriptions behind one loopback
  door. install registers omp's auth-broker and auth-gateway as box
  services on 127.0.0.1 (47311/47411 by default) and mints the bearer;
  status [--json] prints one row per account with each window's used/limit
  and state, short ids only and never the token; login <provider> /
  logout <provider> <id> are the one-line verbs for adding and dropping a
  subscription. A worker profile that says via: gateway launches pi at
  ompgw/<provider>/<model> with an ompgw provider merged into
  ~/.pi/agent/models.json and OMP_GATEWAY_TOKEN + CEL_SESSION_ID set in
  the pane - the session id is what the gateway balances accounts on, because
  pi sends no session identity of its own. A gateway that is down, or a
  provider with no usable credential, vetoes the profile before a pane spawns;
  cel doctor carries one line about it and the QUOTA view and the dashboard
  list the accounts
• Services are declared, watched and reachable: cel services lists the
  services a workspace declares and every cel-fanout try preview as one
  model - state (up/healthy/down), port, pid, resident memory, uptime and
  the URL that reaches each one from a laptop - and
  start|stop|restart|logs|open <name> drives them through a herdr pane
  (a services: entry with only a name and a url stays valid, and is
  observe-only). The steward probes every service declaring health: and
  raises ONE rolled-up blocker after two consecutive down ticks, clearing it
  when the service answers again; restart: auto restarts it once first and
  says so. The dashboard gains a reverse proxy -
  http://<tailnet-ip>:<dash-port>/svc/<port>/…, WebSocket upgrades included,
  known ports only, control token required - so a loopback dev server or
  preview is reachable from the laptop at all; cel-fanout try prints that URL
  as its last line. The console gains a SERVICES view (S) and the router
  three intents (open_service, service_ctl, service_logs)
• The console can be routed by a decision model: console.router in
  ~/.local/share/cel/config.yaml sends the sentence to a classifier that
  picks one of ten intents (fleet, product_status, why_worker,
  message, ...) and returns a confidence with it - the console fills the
  slots from the fleet it already holds, so the model never writes a command
  line. 0.4 s against 6.5 s for the chat model on "what is happening with
  bundle"; below min_confidence the top three intents become options with
  their probabilities; anything it cannot place falls through to the chat
  model, as does a router that is down. --no-router and
  console.router.enabled: false bypass it
• agents.yaml knows the typesafe provider (TYPESAFE_API_KEY), and
  OpenRouter's decisions endpoint is derived from its chat one
• Update awareness by commit, not only by tag: an update.channel of
  main or release in ~/.local/share/cel/config.yaml (cel update --channel), a build string of v0.2.0+31 (d43910c, main) everywhere, and a
  cel update --check, steward item, dashboard chip and cel doctor line
  that say how many commits are new and what they were
• Memory, everywhere state is read: cel fleet carries rss_mb per
  worker, unit and orchestrator pane plus a box block, prints mem per
  product and the box's headroom on its head line; the console shows it per
  row with the free figure on the status edge and s to sort a unit's workers
  by memory; the steward raises one blocker under 10% available naming the
  largest trees and tells an orchestrator about a worker over
  CEL_MEM_WORKER_WARN_MB - reporting only, never killing
• The console has a unit view: Enter or a double-click on a fleet row opens
  one product whole - its orchestrator with [focus] and [message], every
  worker with ticket, state, quiet time, verdict, ahead count and PR, the open
  decisions and the recent mail
• The console has a worker view, the answer to "why": it runs cel-fanout why <id> on open and offers [prompt] [focus] [collect] [release]
[try] [why again] - the ones that change state as proposals on the
  command line
• Every list in the console is a place you can enter: the inbox tail is
  selectable (Ctrl+T cycles fleet → waiting → inbox), and a message from a
  worker or an orchestrator carries [worker] / [unit] to its page
• The console never shows raw JSON: cel fleet --json, cel-fanout status --json, cel inbox open --json, herdr agent focus and herdr agent get
  are rendered as the tables and lines the panels use, anything else that
  parses as JSON as key: value, and r toggles [raw]
• The console's model can answer from state: ANSWER: <text> for questions the
  fleet document (which now carries workers_list) already holds, with nothing
  run; cel console --render-once --unit <product> and --worker <id> print
  the two new views
• cel fleet --json carries units[].workers_list: every worker still worth
  acting on (running, finished, collected) - id, ticket, repo, branch,
  shape, state, live agent status, quiet_secs, stall verdict and
  severity, ahead, PR, alias, pane and
  worktree - so the stalled count can be read back to its rows, and
  cel-fanout status --json prints the same objects for one workspace
• cel-fanout why <id> says why one worker is stuck in words: verdict, quiet
  time and work at risk, the pane's last 25 lines, the last five messages it
  sent, its PR, and the one next act
• The steward says a thing once: every item it raises carries a condition key
  (cel inbox send --fp), so a repeat becomes an update on the item already
  open - cel inbox open shows (×12, last 17:35) - and the steward resolves
  its own item, with a cleared: line, when the condition stops being true
• cel inbox resolve --all [--from x] [--matching s] [--kind k] [--older-than h]
  cleans a mailbox in one line, and cel inbox open --all-workspaces shows
  everything waiting on one reader across every registered workspace
• repos[].seed in workspace.yaml - the gitignored local files every
  worktree needs to run (symlinked, or copied with copy: true), placed by
  cel-fanout delegate/`scou...

Celestial v0.2.0 — AI software factory

Celestial — an AI software factory

The first public release of Celestial, published under MIT from a reviewed, clean-history source snapshot.

A visible production system for coding agents

• Coordinate orchestrators and workers across workspaces and Git worktrees, with visible herdr panes and workspace-specific policy.
• Follow work on an interactive isometric factory floor: intake, build, test, review, dispatch and a separate holding area.
• Select a work order to inspect its branch and delivery signals, open its PR or ticket, or focus its worker.
• See blocked and missing signals explicitly. Dispatch means approved, green and ready for a merge decision — not already shipped.
• Use the existing operational task lists, inbox and agent controls alongside the factory view. Light/dark themes, keyboard selection and reduced-motion preferences are supported.

Safer operation

Garbage collection retains dirty, unlanded, live and unverifiable work. Idle reaping requires ownership and observed-idle evidence. Workspace credentials are isolated, state writers use locks and atomic replacement, and private HTTP controls enforce Host/Origin and anti-CSRF checks.

Fresh installations use explicit application releases, verified native checksums and exact external plugin commits. Installation failures propagate. GNU/Linux x86-64 and arm64 are the supported platforms; setup is not a hermetic machine-image lock.

Start here

• README and quick start
• Architecture and trust boundaries
• Security reporting
• Changelog

Celestial is a trusted-user control plane, not an agent sandbox or an account-authentication boundary. Review the manifests before installing and the HTTP trust model before exposing a service.