# Vigla **Supervise the merge. Not every terminal.** Run Claude Code, Codex CLI, Antigravity, and other agent CLIs as one supervised team — each agent in its own git worktree, every submission audited, every mission reversible in one click. [Watch the replay](https://kilbex.github.io/Vigla/demo/) · [Website](https://kilbex.github.io/Vigla/) · [How it works](#how-it-works) · [Compare](#how-it-compares) · [Build a local DMG](#build-a-local-dmg) · [Architecture](https://github.com/Kilbex/Vigla/blob/main/ARCHITECTURE.md) · [FAQ](https://github.com/Kilbex/Vigla/blob/main/docs/faq.md) · [Roadmap](https://github.com/Kilbex/Vigla/blob/main/ROADMAP.md) · [Contributing](https://github.com/Kilbex/Vigla/blob/main/CONTRIBUTING.md) Running one AI coding agent means babysitting one terminal. Running five means five terminals, five diff reviews, and five chances to merge something you never actually read. Vigla turns that into a single operations room: - **Two decisions, not two hundred.** You assign the mission and set the authority envelope. A supervisor agent decomposes the work, directs the workers, audits every submission, and escalates to you **only when one of four bounds trips: Scope, Reversibility, Risk, or Quality.** - **Cross-vendor by design.** Claude Code, Codex CLI, Antigravity, and profile-backed agent CLIs can work the same mission side by side — pick the best agent for each task instead of the one you happen to have open. Adapters normalize every vendor's output into one canonical event stream. - **Everything is reversible.** Each worker runs in an isolated git worktree; final merge records durable before/merged anchors. Reverting an entire mission creates a normal Git revert commit and preserves later work. - **Local-first.** A Rust orchestrator, Tauri shell, and SQLite event store — no cloud control plane, account, or product telemetry. The default build adds no app-originated network traffic beyond the vendor CLIs you launch. An `EMBEDDINGS=1` build fetches its public embedding model into a local cache on first use, then performs inference locally. > Vigla supervises the agent CLIs you already have. It does not wrap > LLM APIs, run its own models, or add another billing layer. **Launch receipt: 27/27 seeded failure trajectories escalated within the default retry bounds.** Reproduce the fixed, credential-free case set with `cargo xtask receipt`; the [method, data, and limitations](https://github.com/Kilbex/Vigla/blob/main/docs/evidence/recovery-receipt.md) are public and CI-checked. ## How it works **1 — Assign a mission inside an envelope.** Describe the goal, choose the worker roster and models, and set the authority envelope. In review mode the supervisor proposes a plan first — task graph, file scope, risk fit — and waits for your approval:
Vigla plan review: the proposed task graph is checked against the Scope, Reversibility, Risk, and Quality bounds before any agent starts
**2 — The supervisor arbitrates; you stay out of the loop.** Workers execute in parallel worktrees while the supervisor reviews each submission and decides **Accept / Extend / Scrub / Escalate** — inside your envelope, without pinging you. Live state, diffs, tests, cost, and raw terminals are always one click away if you *want* to watch.
Vigla Operations Room: five coding-agent workers progress in parallel while one completed submission waits in the review queue
**3 — You judge results, not keystrokes.** Finished missions land in your inbox with a structured verdict: audit score, test results, files changed, residual-risk band, unresolved issues — and a revert button that undoes the whole mission atomically:
Vigla mission inbox: a merged mission with audit breakdown, subtask status, low-risk verdict, and one-click revert
The vocabulary is small and precise — *mission*, *worker*, *envelope*, *arbiter*, *verdict* — and defined in [docs/lexicon.md](https://github.com/Kilbex/Vigla/blob/main/docs/lexicon.md). ## Vendor support Real workers are driven from the in-app Deploy panel; the mock harness covers demos and CI. Integration tests are the authoritative verification path for the fully gated vendors. | Vendor | Binary | Role | Verification | |---|---|---|---| | Claude Code | `claude` | supervisor + worker; session retry / continue | `real_claude_gate.rs`, `supervisor_live.rs` | | Codex CLI | `codex` | worker | `real_codex_run.rs`, `supervisor_live.rs` | | Antigravity | `agy` | profile-backed worker | `real_antigravity_run.rs` | | Gemini CLI | `gemini` | legacy / enterprise worker | `supervisor_live.rs` | | Kiro | `kiro-cli` | profile-backed worker | end-to-end verification pending | | GitHub Copilot | `copilot` | profile-backed worker | end-to-end verification pending | Google ended consumer **Login with Google** access for Gemini CLI on 2026-06-18. Vigla retains the adapter for existing enterprise and legacy configurations, but Gemini CLI is no longer a primary launch path. Google directs affected consumer users to Antigravity in its [official deprecation notice](https://developers.google.com/gemini-code-assist/docs/deprecations/code-assist-individuals). Mission supervision is Claude-backed today; non-Claude supervisor options should be treated as experimental until their end-to-end tests land. Vigla does not pin vendor CLI versions — the launch path verifies each configured binary, and the (`#[ignore]`-gated) real-CLI integration tests track adapter compatibility: ```sh cargo test -p vigla-orchestrator --test real_claude_gate -- --ignored --nocapture cargo test -p vigla-orchestrator --test real_codex_run -- --ignored --nocapture cargo test -p vigla-orchestrator --test real_antigravity_run -- --ignored --nocapture --test-threads=1 cargo test -p vigla-orchestrator --test supervisor_live -- --ignored --nocapture ``` The Claude, Codex, and supervisor gates use `tests/samples/sandbox/`, a workspace-excluded crate with a deliberately wrong `multiply` function. The Antigravity gate creates the same kind of isolated failing Rust fixture in a temporary repository. Each gate asserts that the agent fixed the defect. ## Requirements - **macOS 12+.** Linux and Windows are on the [roadmap](https://github.com/Kilbex/Vigla/blob/main/ROADMAP.md) — the non-host Rust workspace is built, linted, and tested on Linux in CI; desktop packaging and platform UX are scoped on the roadmap. - Development: Rust 1.95 (pinned via `rust-toolchain.toml`), Node 22.x, pnpm 10.x, Xcode Command Line Tools. - Vendor CLIs are optional and only needed for real (non-mock) workers. ## Build a local DMG Vigla does not publish maintainer-built binaries. On a Mac, clone the source and run one command: ```sh ./scripts/build.sh ``` The script installs the locked frontend dependencies, builds the application, ad-hoc signs it without an Apple account or personal signing identity, verifies the app and disk image, and prints the DMG path and SHA-256 checksum. The local artifact remains under `target/release/bundle/dmg/`; no workflow uploads it. Keep the printed checksum with the artifact. [SECURITY.md](https://github.com/Kilbex/Vigla/blob/main/SECURITY.md#verifying-a-local-build) documents the independent `shasum`, `hdiutil`, and `codesign` checks. Prerequisites are the development tools listed in [Requirements](#requirements). Set `EMBEDDINGS=1` when running the command to include the optional embeddings feature. Its first use downloads the public FastEmbed model into the per-user cache; if that download is unavailable, retrieval falls back to local BM25. ## Known limitations Design trade-offs in the current build, not bugs: - **Real supervisor execution is Claude-gated.** The production mission-supervisor path and its end-to-end verification are Claude-backed today. - **Memory retrieval is local and best-effort.** Alias-expanded BM25 with optional embedding / hybrid re-ranking; degrades to lexical retrieval instead of blocking workers. - **The supervisor sees typed mission events, not raw worker dialogue.** By design — escalation is bounded on outcomes, not chain-of-thought. - **Session resume requires vendor session-ID support.** CLIs that don't expose a session ID can't be continued across app restarts. ## Contributing Start with [CONTRIBUTING.md](https://github.com/Kilbex/Vigla/blob/main/CONTRIBUTING.md) and [ARCHITECTURE.md](https://github.com/Kilbex/Vigla/blob/main/ARCHITECTURE.md); project authority and maintainer succession are explicit in [GOVERNANCE.md](https://github.com/Kilbex/Vigla/blob/main/GOVERNANCE.md). Newcomer-friendly tasks live in [docs/GOOD_FIRST_ISSUES.md](https://github.com/Kilbex/Vigla/blob/main/docs/GOOD_FIRST_ISSUES.md) — adapter fixture work is the recommended first PR and is designed to land in under two hours. Questions and bug-report routing: [SUPPORT.md](https://github.com/Kilbex/Vigla/blob/main/SUPPORT.md). Security reports: see [SECURITY.md](https://github.com/Kilbex/Vigla/blob/main/SECURITY.md). Reviewing or recording Vigla? The public [creator kit](https://github.com/Kilbex/Vigla/blob/main/docs/operations/creator-kit.md) provides a 10-minute script, credential-free inputs, media, evidence, and exact claim boundaries. Operators coming from vibe-kanban can use the [concept-by-concept migration guide](https://github.com/Kilbex/Vigla/blob/main/docs/migrations/from-vibe-kanban.md); it does not claim a database importer or kanban-board parity. ## Canonical resources - Source: https://github.com/Kilbex/Vigla - Browser replay: https://kilbex.github.io/Vigla/demo/ - Architecture: https://github.com/Kilbex/Vigla/blob/main/ARCHITECTURE.md - Security: https://github.com/Kilbex/Vigla/blob/main/SECURITY.md - Support: https://github.com/Kilbex/Vigla/blob/main/SUPPORT.md - License: Apache-2.0