vigla

---

Five coding agents should not mean five terminals, five diff reviews, and five unread merges. Vigla gives the work one operations room and gives you one job: set the authority envelope, then judge the verdict.

WORK	WATCH	VERDICT	REVERT
Claude Code, Codex CLI, Antigravity, and profile-backed CLIs share one mission	Each worker gets an isolated git worktree and typed event stream	A supervisor checks scope, reversibility, risk, and quality before merge	The accepted mission can be undone with a normal Git revert commit

Vigla is local-first: a Rust orchestrator, Tauri shell, and SQLite event store, with no cloud control plane, product account, or product telemetry. It supervises the command-line tools you already use; it does not wrap model APIs or add another billing layer.

Recovery receipt — 27/27. Every seeded failure trajectory escalated within the default retry bounds. Reproduce the credential-free case set with cargo xtask receipt, then inspect the public method, data, and limitations.

Try the no-install replay

Open the read-only browser replay to step through accepted, bound-tripped, and quota-paused missions in the real Operations Room UI. The three event streams are hand-authored canonical event-schema events committed in app/src/demo/recordings.ts — a scripted, deterministic replay, not a capture of a real vendor session. The UI is the production one; no account, vendor CLI, credential, or network-backed agent is involved.

Run the credential-free demo locally

Vigla ships a mock supervisor, so you can watch a whole mission — decomposition, parallel workers, integration, audit, verdict — with no vendor CLI, no credentials, and no token spend:

git clone https://github.com/Kilbex/Vigla.git && cd Vigla
pnpm install --frozen-lockfile
./scripts/dev.sh

When the Operations Room window opens:

1. In the DEPLOY WORKERS panel, describe the work under What should the team do?
2. Click Choose folder… and pick a Git repository.
3. Expand Advanced.
4. Set the Supervisor dropdown to Mock (demo) — the only other choice is Claude.
5. Click Start mission. A notice above the button confirms the mock is armed.

The choice is sticky per machine and defaults to Claude, so the demo is opt-in and nobody gets it by accident.

The mock mission is not a dry run. It spends nothing and reads no credential — no vendor CLI process is launched and no API key or login is read — but it drives the real mission machinery against the folder you chose: it creates a supervisor branch and worktree, a branch and worktree per worker, writes files, and makes real git commits, then integrates each worker's work and stops at a pending-merge decision you Merge or Discard from the mission overlay. (The review queue is a different surface: it triages individual worker submissions, not the mission verdict.) Point it at a scratch repository or a branch you don't mind.

It shows the happy-path arc only. Every task takes a clean first pass by construction, so a mock mission can never produce a blocked, failed, retry-exhausted, or quota-exhausted trajectory, and Plan mode Review has no effect on it — the mock runtime never pauses for plan approval. The unhappy paths live in two other places:

• the browser replay, which scripts accepted, bound-tripped, and quota-paused missions;
• the seven bundled mock-harness scripts — claude_happy, codex_blocked, gemini_happy, gemini_blocked, gemini_failed, gemini_terminal, claude_quota_exhausted — each of which drives a single worker, not a mission. Run mock-harness --help for the trajectory each one takes, or spawn them from Settings → Developer → Mock spawn in a development build (import.meta.env.DEV, or VITE_VIGLA_E2E=1).

Prereqs: macOS 12+, Rust 1.95 via rustup, Node 22, pnpm 10, Xcode Command Line Tools. See CONTRIBUTING.md for the full setup.

How it works

1 — Assign a mission inside an envelope. Describe the goal, choose the worker roster and models, and set the authority envelope. In review mode the supervisor proposes a plan first — task graph, file scope, risk fit — and waits for your approval:

2 — The supervisor arbitrates; you stay out of the loop. Workers execute in parallel worktrees while the supervisor reviews each submission and decides Accept / Extend / Scrub / Escalate — inside your envelope, without pinging you. Live state, diffs, tests, cost, and raw terminals are always one click away if you want to watch.

3 — You judge results, not keystrokes. Finished missions land in your inbox with a structured verdict: audit score, test results, files changed, residual-risk band, unresolved issues — and a revert button that undoes the whole mission atomically:

The vocabulary is small and precise — mission, worker, envelope, arbiter, verdict — and defined in docs/lexicon.md.

How it compares

The table is positioning, not a feature checklist. Each cell is backed by a primary source below; cells are re-verified before each release.

Sources verified 2026-07-21. “Not documented” means the linked product documentation does not describe that capability; it is not a claim that an internal implementation is impossible.

	Vigla	Codex app (OpenAI)	Claude Code on desktop (Anthropic)
Cross-vendor worker roster	yes	no; Codex agents	no; Claude agents
Parallel local agent sessions	yes	yes	yes
Isolated git worktrees	one per worker	built in	automatic or manual
Bound-based supervisor audit across workers	yes	not documented	not documented
Atomic mission merge + revert	yes	not documented	not documented
Deterministic demo without a vendor account	yes	not documented	not documented

• Vigla. See this README and ARCHITECTURE.md for positioning and goals; LICENSE (Apache 2.0).
• Codex app (OpenAI). Introducing the Codex app documents parallel agents, local and cloud work, and built-in worktree support.
• Claude Code on desktop (Anthropic). Claude Code on desktop documents parallel sessions and automatic worktree isolation; the worktrees guide covers the underlying isolation flow.

Vendor support

Real workers are driven from the in-app Deploy panel; the mock harness covers demos and CI. Two independent tiers of evidence back a vendor, and they are not interchangeable:

• Adapter goldens (CI). Committed transcript-and-golden pairs run through the shared vigla-adapter-conformance harness on every pull request. They pin the byte-to-event contract. They prove nothing about the vendor binary.
• Real-CLI gate (local, opt-in). An #[ignore]d integration test that spawns the actual CLI against a failing fixture repository and asserts the agent fixed the defect. It needs a working binary and credentials, so no CI workflow runs it — a maintainer runs it by hand.

Vendor	Binary	Role	Real-CLI gate (local, opt-in)	Adapter goldens (CI)
Claude Code	claude	supervisor + worker; session retry / continue	real_claude_gate.rs, supervisor_live.rs	6 conformance cases + from_fixture.rs
Codex CLI	codex	worker	real_codex_run.rs, supervisor_live.rs	4 conformance cases + from_fixture.rs
Antigravity	agy	profile-backed worker	real_antigravity_run.rs	4 conformance cases
Gemini CLI	gemini	legacy / enterprise worker	supervisor_live.rs	4 conformance cases + from_fixture.rs
Kiro	kiro-cli	profile-backed worker	none yet	4 conformance cases
GitHub Copilot	copilot	profile-backed worker	none yet	4 conformance cases

Google ended consumer Login with Google access for Gemini CLI on 2026-06-18. Vigla retains the adapter for existing enterprise and legacy configurations, but Gemini CLI is no longer a primary launch path. Google directs affected consumer users to Antigravity in its official deprecation notice.

Mission supervision is Claude-only today. The Supervisor dropdown offers exactly two values — Claude (spawns the real claude CLI) and Mock (demo) (the scripted runtime, no vendor process) — and host_services rejects any other supervisor_model with UnsupportedSupervisorModel. There is no experimental non-Claude supervisor to opt into; a second real supervisor is roadmap work. Vigla does not pin vendor CLI versions — the launch path verifies each configured binary, and the real-CLI gates track adapter compatibility:

cargo test -p vigla-orchestrator --test real_claude_gate -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_codex_run   -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_antigravity_run -- --ignored --nocapture --test-threads=1
VIGLA_LIVE=1 cargo test -p vigla-orchestrator --test supervisor_live -- --ignored --nocapture

VIGLA_LIVE=1 is not optional on the last line: without it every test in supervisor_live.rs prints a skip line and passes, so the gate looks green without having run.

The Claude and Codex gates use tests/samples/sandbox/, a workspace-excluded crate with a deliberately wrong multiply function. The Antigravity gate creates the same kind of isolated failing Rust fixture in a temporary repository. Each of those three asserts that the agent fixed the defect. The supervisor gate builds its own throwaway repositories instead — a wrong add, a broken test, and a docs task — and asserts that a real claude supervisor drives each mission to a completed, audited verdict.

Feature tour

• Deploy panel — supervisor profile, worker vendor roster, worker count, model selections, plan mode, objective, folder, and optional scoped paths.