Skip to content
The operating layer for Claude Code and Codex

Start with /do.
Scale when the work demands it.

Citadel adds durable state, verification, recovery, and coordination around the coding agent you already use. No new IDE. No orchestration vocabulary to memorize.

Try the live router See the work survive a session
15/15PRs landed
30/30hosted journeys
120signed operation-control cells
0adversarial false passes
Level 1 · Do

Describe the outcome. Citadel chooses the lane.

This deterministic demo shows the routing decision. In a real repository, the selected workflow executes under your project rules and writes a handoff.

/do
Enter to route  ·  ↑ ↓ history  ·  Esc clear
TIER 0 ~0 tokens
Pattern Match
Regex on raw input - fix typo, rename, commit, build, status
TIER 1 ~0 tokens
Active State
Resumes a campaign or fleet session already in progress
TIER 2 ~0 tokens
Keyword Match
Matched against the installed skill keyword table - review, test, debug, scaffold…
TIER 3 ~500 tokens
LLM Classifier
6-dimension classification: scope · complexity · intent · persist · parallel · taste
Intent build
Scope single-domain
Complexity
Spans sessions yes
Parallel fleet no
Needs judgment yes
Recently routed
01Install into your repository
02Route one task with /do
03Resume from disk with /do next
Level 2 · Continue

Operate a real Citadel journey

Choose a task, step through the operating loop, and inspect the repository state that survives after the conversation ends.

Ready

A persistent feature enters through one command

Citadel begins with the request, not a manually selected orchestrator.

/do rework authentication across the application
Level 3 · Coordinate

One objective. Two runtimes. One proof standard.

Operation Fork runs Claude Code and Codex from the same commit, under the same workflow and verifier, then compares receipts instead of personalities.

citadel fork start "Find and eliminate the authentication race"
same objective · scope · policy · budget · workflow · verifier
Claude Codeverified
2/2evidence
1file
1.0sfixture
unknowncost
Codexverified
2/2evidence
1file
1.0sfixture
unknowncost
receipt-missing · no success assumed
Verified tie Both branches satisfy the shared verifier. Speed and cost do not manufacture a winner.
Deterministic local contract fixture · real worktree, receipt, recovery, and redaction tests ship in the repository
Under the hood

How routing works

TIER 0
Pattern Match
Regex · 9 built-in patterns
~0 tokens · <1ms
+
/do fix typo on line 42
✓ REGEX HIT · <1ms · 0 TOKENS

Pure regex against the raw input string. No model call, no skill load. Catches exact-intent commands that need no classification - typos, renames, commits, status checks. If it matches here, Claude executes it directly and stops.

/do fix the typo on line 42
/do rename AuthService to AuthHandler
/do commit my changes

Tier 1 (active session context) is evaluated in live Claude Code sessions - skipped in this demo.

No match · evaluates next tier
↓
TIER 2
Keyword Lookup
12 registered skill keywords
~0 tokens · <10ms
+
review → /review
debug → /systematic-debugging
scaffold → /scaffold

The input is scanned against a keyword table built from every installed skill. "review" → /review, "debug" → /systematic-debugging. New skills register their own keywords automatically. No LLM needed.

/do review the auth module
/do write tests for UserService
/do scaffold a new dashboard component
No match · evaluates next tier
↓
TIER 3
LLM Classifier
One evaluation · two possible dispatches
~500 tokens · <2s
+
scope: cross-domain complexity: 4 intent: create persist: true parallel: false taste: true
→ /classifier dispatched

Classifies 6 dimensions: scope, complexity (1–5), intent, multi-session persistence, parallel execution, and taste. The result determines the dispatch - Archon for contained work, Fleet for platform-wide scope.

→ Archon
Single-feature, single-session work
/do build me a recipe app
/do add Stripe payments to checkout
or
→ Fleet
Platform-wide or parallel work
/do migrate the platform to TypeScript strict mode
/do redesign the entire data layer

What you actually get

Real output from real sessions. No wireframes, no mockups.

ROUTING
/do review the auth module
Tier 2 keyword match Routing to /review because input contains "review" (keyword match, 0 tokens) --- HANDOFF --- - 5-pass review complete: auth module (src/auth/) - 3 issues found: 1 security (token expiry unchecked), 2 style - Security issue is blocking - fix before merge - No test regressions detected ---
CAMPAIGN
/archon - Phase 3 of 4
Phase 3: Build · auth-overhaul campaign --- HANDOFF --- - Built OAuth2 integration with PKCE flow (src/auth/oauth.ts) - Session middleware rewritten - JWT with refresh rotation - typecheck: clean · tests: 47 pass, 0 fail · build: success - Next: Phase 4 (verify) - security audit + integration test - Session resumes automatically - campaign state preserved to disk ---
FLEET
/fleet - Wave 2 of 3
Wave 2 complete · 3 agents · isolated worktrees Agent A (wt-fleet-a): migrated api/ to strict TypeScript ✓ Agent B (wt-fleet-b): migrated components/ to strict TypeScript ✓ Agent C (wt-fleet-c): migrated utils/ - 1 conflict with Agent A Discovery relay: Agent A found 12 implicit any casts in shared types → relayed to Agents B and C before Wave 3 Merge status: A merged · B merged · C pending conflict resolution Wave 3 will resolve C's conflict and run final typecheck.

Work that spans sessions. Automatically.

Complex tasks run across sessions without losing direction - or your confidence.

⧫
Checks at every phase
A quality spot-check runs at the end of every phase. The next phase only starts when it passes.
◎
Auto-pause on failure
After 3 consecutive failures on the same approach, the campaign parks and waits for you.
◈
Nothing breaks silently
Type baselines and test counts are captured before the campaign and verified after every build phase.
Read the full campaign lifecycle →

Proof receipts, not confidence theater

Every result names what happened, where to inspect it, and what the evidence does not prove.

missing source → unknown
Mainline coordination
15 / 15 landed

Fifteen PRs merged and deployed through one serialized steward lane.

Boundary: controlled public stress test, not a customer production deployment.
Inspect public repository →
Operating journey
30 / 30 passed

Claude Code and Codex completed install, route, verify, handoff, resume, and rollback across three operating systems.

Boundary: deterministic fixtures, not thirty human sessions.
Inspect matrix contract →
Evidence integrity
UNKNOWN stays visible

Removing an expected telemetry source changes the status instead of manufacturing a pass.

Boundary: controlled source-health demonstration.
Inspect evidence contract →
Fresh-process continuity
State survives chat

Campaign direction, evidence, decisions, and next action reload from repository files.

Boundary: file-backed state cannot replace missing project-specific judgment.
Inspect campaign contract →
Release integrity
v1.1.0 reproducible

The release includes an archive, file manifest, SHA-256 sidecar, update plan, and rollback path.

Boundary: integrity proves artifact identity, not universal compatibility.
Inspect release →
Economic falsification
168 prospective cells

Three separately frozen local studies retained every failure. V1's apparent savings reverse under timeout sensitivity; v2 shows verifier escalation costing more; v3 verifies repository artifacts while missing its economic gates.

Boundary: one GPU and one model family; the funded multi-stack savings target remains open.
Inspect the evidence index →
49
Skills
covering code quality, debugging, research, orchestration, and more
4
Orchestrators
Marshal, Archon, Fleet, Autopilot
29
Hook Events
automatic quality gates without agent intervention
2
Runtime Surfaces
the same operating journey for Claude Code and OpenAI Codex

Try it now.

Install for Claude Code or OpenAI Codex.
Citadel detects the runtime and prepares the current git repository.

1
Clone Citadel once
PowerShell
git clone https://github.com/SethGammon/Citadel.git "$env:USERPROFILE\Citadel"
macOS / Linux
git clone https://github.com/SethGammon/Citadel.git "$HOME/Citadel"
2
From the repository Citadel should manage
PowerShell
node "$env:USERPROFILE\Citadel\scripts\install.js" --runtime claude --install --scope local
macOS / Linux
node "$HOME/Citadel/scripts/install.js" --runtime claude --install --scope local
3
Start the fresh session requested by the installer
/do setup --express
Claude Code install guide →
First verified success: run /do review README.md, inspect the route and handoff, then close the session and run /do next in a fresh one.
One operating command after installation.