Your AI sessions are ephemeral and anonymous. Move 37 turns them into persistent, named workers — each with a home, a memory, and a Situation Room: one panel to set its rules, put it on a schedule, watch its work, and ship what it builds.
Sessions are ephemeral.
Citizens are not.
Close a terminal and an ordinary AI session is gone — its name, its history, its context. A citizen is an identity with a UUID, a home directory, and durable memory. Its name can change; the key stays the join. Four nouns name everything: citizen, instance, message, surface.
The system anthropomorphizes its own machinery on purpose — so oversight reads like a directory of named workers, not a wall of PIDs. A handful of nouns explain the whole thing.
A long-running AI worker with a name, a UUID, and a home directory. The citizen is the worker — it survives restarts, renames, and switching which agent drives it.
One panel per worker. Everything you do to a citizen lives here — its identity, its rules, its schedule, its boards, and the site it ships.
A live panel you compose for a citizen — and share between citizens — so you can watch its work as it happens.
A durable MEMORY.md the worker writes to and recalls, so it carries what it learned across every session.
A self-contained dev island: its own checkout, its own local SQLite, its own dashboard — reached privately over Tailscale.
A sandboxed package that adds a tab or a command without ever editing the core — declared scopes, default-deny network.
Open any citizen's ⋯ menu and its Situation Room takes over the pane — a left rail of tabs scoped to that one worker. Nine tabs in all; eight do real work today, with Research reserved for what's next. Here's everything you can do.
Name the worker, give it a home, set its avatar. Rename it in place — without losing its memory or its running session.
Pick which agent drives it — Claude, Codex, and others — and which machine it runs on. Move a live one across without a restart.
Edit the worker's behavior and house rules in plain markdown, and jump straight to the shared, workspace-wide rules.
Keep a small library of docs, links, and notes — readable by the worker straight from its own home.
Define default context that's prepended to every prompt — the standing instructions the worker always sees.
Put the worker on a schedule: recurring loop workflows and cron wake-ups that hand it a prompt on time.
Compose a live board for the worker — or open the one it owns — and watch its work stream in. The full catalog is just below.
Edit the worker's static site, preview it live, click any element to inspect it, then ship it to Cloudflare Pages.
Boards are how you watch the civilization work. You assemble one for any citizen, share it between citizens, and it streams as the lifecycle happens. Every board is declared in one manifest — so the catalog can't quietly drift.
A board's label and ownership live in a single declarative source — monitor_board_manifest.json — not scattered across the code.
Boards render as a tab switcher; only the active board mounts and loads. You watch one at a time, and pay for one at a time.
A board is a share primitive. Share it into another citizen and both seats show the counterpart — sharing is symmetric, not owner-only.
A field guide projects the manifest live into kinds — so every board is filed under a kind, and anything uncatalogued shows up as a visible warning.
Is each worker alive, running, or overdue — right now, across the fleet.
Each row is an existing artifact, sorted into risk bands you can act on.
A backend audit command classifies source and bindings live, on demand.
A growing ledger of named anti-patterns, flagging every instance in source.
Read-only maps of structure — sized and addressed, not graded.
Turn collected patterns into the next artifact — a root cause, a skill.
Curated surfaces — goals, skills, hooks, comparisons — read and edited, not graded.
Measure live runtime cost — long-tasks, energy, and heuristic quality.
No shared database, no network mounts. Each machine is an independent peer that serves its own dashboard and keeps its schema in lockstep through migrations-as-code.
Every station is its own dev island: its own git clone, node-local SQLite, and mock data — peers, not clients.
The owner works remotely; tailscale serve fronts each dashboard at HTTPS over a private .ts.net name.
A stable Core SDK of four nouns over HTTP; extensions never import core modules — they meet only at the contribution registry.
A closed scope grammar and three threat tiers gate every contribution; handlers run inside an OS-enforced sandbox.
Work happens in isolated worktrees and lands via one command; the shared checkout serves whatever main is.
An opinionated, local-first operating room for long-running agents — built one citizen at a time.