Skip to content
The operating layer for Claude Code and Codex

Start with /do.
Scale when the work demands it.

Citadel adds durable state, verification, recovery, and coordination around the coding agent you already use. No new IDE. No orchestration vocabulary to memorize.

Preview route evidence See the work survive a session
15/15PRs landed
30/30hosted journeys
120signed operation-control cells
0adversarial false passes
Level 1 · Do

Describe the outcome. Inspect the routing evidence.

This local visualization resolves only exact commands. For natural-language work it shows generated skill candidates, then stops where the real /do agent performs semantic classification.

/do
Enter to preview  ·  ↑ ↓ history  ·  Esc clear
TIER 0 ~0 tokens
Exact Command
Whole normalized input only - build, test, typecheck, status, next
TIER 1 ~0 tokens
Active State
Resumes a campaign or fleet session already in progress
TIER 2 ~0 tokens
Candidate Lookup
Generated skill keywords supply evidence, not final execution authority
TIER 3 ~500 tokens
Runtime Semantic Classifier
Runs in the real /do agent; this static page stops at the handoff boundary
Intent build
Scope single-domain
Complexity
Spans sessions yes
Parallel fleet no
Needs judgment yes
Recently routed
01Install into your repository
02Route one task with /do
03Resume from disk with /do next
Level 2 · Continue

Operate a real Citadel journey

Choose a task, step through the operating loop, and inspect the repository state that survives after the conversation ends.

Ready

A persistent feature enters through one command

Citadel begins with the request, not a manually selected orchestrator.

/do rework authentication across the application
Level 3 · Coordinate

One objective. Two runtimes. One proof standard.

Operation Fork runs Claude Code and Codex from the same commit, under the same workflow and verifier, then compares receipts instead of personalities.

citadel fork start "Find and eliminate the authentication race"
same objective · scope · policy · budget · workflow · verifier
Claude Codeverified
2/2evidence
1file
1.0sfixture
unknowncost
Codexverified
2/2evidence
1file
1.0sfixture
unknowncost
receipt-missing · no success assumed
Verified tie Both branches satisfy the shared verifier. Speed and cost do not manufacture a winner.
Deterministic local contract fixture · real worktree, receipt, recovery, and redaction tests ship in the repository
Under the hood

How routing works

TIER 0
Exact Command Match
Generated whole-input command contract
~0 tokens · <1ms
+
/do typecheck
✓ EXACT COMMAND · <1ms · 0 TOKENS

The normalized whole input must equal a registered deterministic command. A word inside a larger request never triggers execution. Project commands such as "build" become executable only after the target package declares that script; "build a caching layer" always continues to semantic routing.

/do operator
/do status
/do next

Tier 1 (active session context) is evaluated in live Claude Code sessions - skipped in this demo.

No match · evaluates next tier
↓
TIER 2
Candidate Lookup
Generated from every routable skill
~0 tokens · <10ms
+
review → /review
debug → /systematic-debugging
scaffold → /scaffold

The input is scanned against the generated skill catalog. Matches such as "review" → /review and "debug" → /systematic-debugging become candidate evidence. The real agent still confirms intent before dispatch.

/do review the auth module
/do write tests for UserService
/do scaffold a new dashboard component
No match · evaluates next tier
↓
TIER 3
LLM Classifier
Performed by the real /do agent
~500 tokens · <2s
+
scope: cross-domain complexity: 4 intent: create persist: true parallel: false taste: true
→ /classifier dispatched

The runtime agent classifies scope, complexity, intent, persistence, parallelism, and judgment using the request plus candidate evidence. This static visualization does not imitate that model decision or claim a final route.

→ Archon
Possible persistent, multi-session route after semantic confirmation
/do build me a recipe app
/do add Stripe payments to checkout
or
→ Fleet
Possible parallel route after semantic confirmation and approval
/do migrate the platform to TypeScript strict mode
/do redesign the entire data layer

What you actually get

Real output from real sessions. No wireframes, no mockups.

ROUTING
/do review the auth module
Tier 2 candidate evidence: /review Semantic confirmation /review matches the leading review intent; activation and worktree boundaries still apply --- HANDOFF --- - 5-pass review complete: auth module (src/auth/) - 3 issues found: 1 security (token expiry unchecked), 2 style - Security issue is blocking - fix before merge - No test regressions detected ---
CAMPAIGN
/archon - Phase 3 of 4
Phase 3: Build · auth-overhaul campaign --- HANDOFF --- - Built OAuth2 integration with PKCE flow (src/auth/oauth.ts) - Session middleware rewritten - JWT with refresh rotation - typecheck: clean · tests: 47 pass, 0 fail · build: success - Next: Phase 4 (verify) - security audit + integration test - Session resumes automatically - campaign state preserved to disk ---
FLEET
/fleet --quick - Wave 2 of 3
Wave 2 complete · 3 agents · isolated worktrees Agent A (wt-fleet-a): migrated api/ to strict TypeScript ✓ Agent B (wt-fleet-b): migrated components/ to strict TypeScript ✓ Agent C (wt-fleet-c): migrated utils/ - 1 conflict with Agent A Discovery relay: Agent A found 12 implicit any casts in shared types → relayed to Agents B and C before Wave 3 Merge status: A merged · B merged · C pending conflict resolution Wave 3 will resolve C's conflict and run final typecheck.

Work that spans sessions. Automatically.

Complex tasks run across sessions without losing direction - or your confidence.

⧫
Checks at every phase
A quality spot-check runs at the end of every phase. The next phase only starts when it passes.
◎
Auto-pause on failure
After 3 consecutive failures on the same approach, the campaign parks and waits for you.
◈
Nothing breaks silently
Type baselines and test counts are captured before the campaign and verified after every build phase.
Read the full campaign lifecycle →

Proof receipts, not confidence theater

Every result names what happened, where to inspect it, and what the evidence does not prove.

missing source → unknown
Mainline coordination
15 / 15 landed

Fifteen PRs merged and deployed through one serialized steward lane.

Boundary: controlled public stress test, not a customer production deployment.
Inspect public repository →
Operating journey
30 / 30 passed

Claude Code and Codex completed install, route, verify, handoff, resume, and rollback across three operating systems.

Boundary: deterministic fixtures, not thirty human sessions.
Inspect matrix contract →
Evidence integrity
UNKNOWN stays visible

Removing an expected telemetry source changes the status instead of manufacturing a pass.

Boundary: controlled source-health demonstration.
Inspect evidence contract →
Fresh-process continuity
State survives chat

Campaign direction, evidence, decisions, and next action reload from repository files.

Boundary: file-backed state cannot replace missing project-specific judgment.
Inspect campaign contract →
Release integrity
v1.1.0 reproducible

The release includes an archive, file manifest, SHA-256 sidecar, update plan, and rollback path.

Boundary: integrity proves artifact identity, not universal compatibility.
Inspect release →
Economic falsification
168 prospective cells

Three separately frozen local studies retained every failure. V1's apparent savings reverse under timeout sensitivity; v2 shows verifier escalation costing more; v3 verifies repository artifacts while missing its economic gates.

Boundary: one GPU and one model family; the funded multi-stack savings target remains open.
Inspect the evidence index →
49
Skills
covering code quality, debugging, research, orchestration, and more
4
Orchestrators
Marshal, Archon, Fleet, Autopilot
29
Hook Events
automatic quality gates without agent intervention
2
Runtime Surfaces
the same operating journey for Claude Code and OpenAI Codex

Try it now.

Install for Claude Code or OpenAI Codex.
Citadel detects the runtime and prepares the current git repository.

1
Clone Citadel once
PowerShell
git clone https://github.com/SethGammon/Citadel.git "$env:USERPROFILE\Citadel"
macOS / Linux
git clone https://github.com/SethGammon/Citadel.git "$HOME/Citadel"
2
From the repository Citadel should manage
PowerShell
node "$env:USERPROFILE\Citadel\scripts\install.js" --runtime claude --install --scope local
macOS / Linux
node "$HOME/Citadel/scripts/install.js" --runtime claude --install --scope local
3
Start the fresh session requested by the installer
/do setup --express
Claude Code install guide →
First verified success: run /do review README.md, inspect the route and handoff, then close the session and run /do next in a fresh one.
One operating command after installation.