Kilbex/Vigla: five coding agents should not mean five terminals, five diff reviews, and five unread merges

Open-source mission control for coding agents.
Run cross-vendor workers in parallel worktrees. Audit every submission. Revert the whole mission when the result is wrong.

Open the 16-second replay  ·  Field notes  ·  Build on macOS  ·  Read the architecture  ·  Take an open task

Five coding agents should not mean five terminals, five diff reviews, and five unread merges. Vigla gives the work one operations room and gives you one job: set the authority envelope, then judge the verdict.

Vigla is local-first: a Rust orchestrator, Tauri shell, and SQLite event store, with no cloud control plane, product account, or product telemetry. It supervises the command-line tools you already use; it does not wrap model APIs or add another billing layer.

Recovery receipt — 27/27. Every seeded failure trajectory escalated within the default retry bounds. Reproduce the credential-free case set with cargo xtask receipt, then inspect the public method, data, and limitations.

Try the no-install replay

Open the read-only browser replay to step through accepted, bound-tripped, and quota-paused missions in the real Operations Room UI. The three event streams are hand-authored canonical event-schema events committed in app/src/demo/recordings.ts — a scripted, deterministic replay, not a capture of a real vendor session. The UI is the production one; no account, vendor CLI, credential, or network-backed agent is involved.

Run the credential-free demo locally

Vigla ships a mock supervisor, so you can watch a whole mission — decomposition, parallel workers, integration, audit, verdict — with no vendor CLI, no credentials, and no token spend:

git clone https://github.com/Kilbex/Vigla.git && cd Vigla
pnpm install --frozen-lockfile
./scripts/dev.sh

When the Operations Room window opens:

1. In the DEPLOY WORKERS panel, describe the work under What should the team do?
2. Click Choose folder… and pick a Git repository.
3. Expand Advanced.
4. Set the Supervisor dropdown to Mock (demo) — the only other choice is Claude.
5. Click Start mission. A notice above the button confirms the mock is armed.

The choice is sticky per machine and defaults to Claude, so the demo is opt-in and nobody gets it by accident.

The mock mission is not a dry run. It spends nothing and reads no credential — no vendor CLI process is launched and no API key or login is read — but it drives the real mission machinery against the folder you chose: it creates a supervisor branch and worktree, a branch and worktree per worker, writes files, and makes real git commits, then integrates each worker's work and stops at a pending-merge decision you Merge or Discard from the mission overlay. (The review queue is a different surface: it triages individual worker submissions, not the mission verdict.) Point it at a scratch repository or a branch you don't mind.

It shows the happy-path arc only. Every task takes a clean first pass by construction, so a mock mission can never produce a blocked, failed, retry-exhausted, or quota-exhausted trajectory, and Plan mode Review has no effect on it — the mock runtime never pauses for plan approval. The unhappy paths live in two other places:

• the browser replay, which scripts accepted, bound-tripped, and quota-paused missions;
• the seven bundled mock-harness scripts — claude_happy, codex_blocked, gemini_happy, gemini_blocked, gemini_failed, gemini_terminal, claude_quota_exhausted — each of which drives a single worker, not a mission. Run mock-harness --help for the trajectory each one takes, or spawn them from Settings → Developer → Mock spawn in a development build (import.meta.env.DEV, or VITE_VIGLA_E2E=1).

Prereqs: macOS 12+, Rust 1.95 via rustup, Node 22, pnpm 10, Xcode Command Line Tools. See CONTRIBUTING.md for the full setup.

How it works

1 — Assign a mission inside an envelope. Describe the goal, choose the worker roster and models, and set the authority envelope. In review mode the supervisor proposes a plan first — task graph, file scope, risk fit — and waits for your approval:

2 — The supervisor arbitrates; you stay out of the loop. Workers execute in parallel worktrees while the supervisor reviews each submission and decides Accept / Extend / Scrub / Escalate — inside your envelope, without pinging you. Live state, diffs, tests, cost, and raw terminals are always one click away if you want to watch.

3 — You judge results, not keystrokes. Finished missions land in your inbox with a structured verdict: audit score, test results, files changed, residual-risk band, unresolved issues — and a revert button that undoes the whole mission atomically:

The vocabulary is small and precise — mission, worker, envelope, arbiter, verdict — and defined in docs/lexicon.md.

How it compares

The table is positioning, not a feature checklist. Each cell is backed by a primary source below; cells are re-verified before each release.

Sources verified 2026-07-21. “Not documented” means the linked product documentation does not describe that capability; it is not a claim that an internal implementation is impossible.

Vendor support

Real workers are driven from the in-app Deploy panel; the mock harness covers demos and CI. Two independent tiers of evidence back a vendor, and they are not interchangeable:

• Adapter goldens (CI). Committed transcript-and-golden pairs run through the shared vigla-adapter-conformance harness on every pull request. They pin the byte-to-event contract. They prove nothing about the vendor binary.
• Real-CLI gate (local, opt-in). An #[ignore]d integration test that spawns the actual CLI against a failing fixture repository and asserts the agent fixed the defect. It needs a working binary and credentials, so no CI workflow runs it — a maintainer runs it by hand.

Google ended consumer Login with Google access for Gemini CLI on 2026-06-18. Vigla retains the adapter for existing enterprise and legacy configurations, but Gemini CLI is no longer a primary launch path. Google directs affected consumer users to Antigravity in its official deprecation notice.

Mission supervision is Claude-only today. The Supervisor dropdown offers exactly two values — Claude (spawns the real claude CLI) and Mock (demo) (the scripted runtime, no vendor process) — and host_services rejects any other supervisor_model with UnsupportedSupervisorModel. There is no experimental non-Claude supervisor to opt into; a second real supervisor is roadmap work. Vigla does not pin vendor CLI versions — the launch path verifies each configured binary, and the real-CLI gates track adapter compatibility:

cargo test -p vigla-orchestrator --test real_claude_gate -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_codex_run   -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_antigravity_run -- --ignored --nocapture --test-threads=1
VIGLA_LIVE=1 cargo test -p vigla-orchestrator --test supervisor_live -- --ignored --nocapture

VIGLA_LIVE=1 is not optional on the last line: without it every test in supervisor_live.rs prints a skip line and passes, so the gate looks green without having run.

The Claude and Codex gates use tests/samples/sandbox/, a workspace-excluded crate with a deliberately wrong multiply function. The Antigravity gate creates the same kind of isolated failing Rust fixture in a temporary repository. Each of those three asserts that the agent fixed the defect. The supervisor gate builds its own throwaway repositories instead — a wrong add, a broken test, and a docs task — and asserts that a real claude supervisor drives each mission to a completed, audited verdict.

Feature tour

Built in public

Priorities move with operator evidence and focused contributions. See the full roadmap for acceptance boundaries and the work Vigla deliberately will not take on.

Tech stack

The only abstraction Vigla permits is the event boundary: vendor CLI bytes → canonical events. Adapters live in crates/adapters/{vendor}, one crate per vendor, pure translation — no I/O, no process spawning, no git.

vigla/
├── app/                  # Tauri 2 + React 19 + Vite + TS
│   ├── src/              # React UI, Zustand stores, hotkeys
│   └── src-tauri/        # Tauri host (Rust): IPC, event forwarding
├── crates/               # All Rust library/bin crates (Cargo workspace)
│   ├── orchestrator/     # Rust supervision crate (business logic)
│   │   ├── src/memory/               # Memory Kernel (event-sourced)
│   │   ├── src/mission_runtime/      # Mission state machine + replay
│   │   ├── src/mission_supervisor_run/ # Supervisor turns + review loop
│   │   ├── src/supervisor/           # Worker process lifecycle + resume
│   │   ├── src/arbiter/              # Bound-based escalation decisions
│   │   └── resources/                # Bundled at compile time:
│   │       ├── vendor_profiles/      #   per-vendor command-rendering policy
│   │       └── skills/               #   worker skill set (embedded)
│   ├── adapters/         # One pure crate per vendor CLI + supervisor
│   ├── event-schema/     # Canonical typed event contract
│   ├── mock-harness/     # Mock vendor CLI (credential-free demos)
│   └── xtask/            # Workspace task runner (cargo xtask)
├── tests/                # Playwright e2e specs + real-CLI sample targets
├── docs/                 # Lexicon, good-first-issues, media
└── scripts/              # dev.sh, build.sh, capture-readme-media.cjs

Deep dive: ARCHITECTURE.md covers the orchestrator, memory kernel, mission lifecycle, arbiter / audit / recovery, event schema, and per-vendor adapters.

Requirements

• macOS 12+. Linux and Windows are on the roadmap — the non-host Rust workspace is built, linted, and tested on Linux in CI; desktop packaging and platform UX are scoped on the roadmap.
• Development: Rust 1.95 (pinned via rust-toolchain.toml), Node 22.x, pnpm 10.x, Xcode Command Line Tools.
• Vendor CLIs are optional and only needed for real (non-mock) workers.

Build a local DMG

Vigla publishes no maintainer-built binaries today: there is no signing identity, notarization credential, or update channel to trust, and the only supported artifact is the one your machine produces. (A Mac App Store release would replace that trust model with Apple's; whether to make that trade is undecided and under investigation.) On a Mac, clone the source and run one command:

./scripts/build.sh

The script installs the locked frontend dependencies, builds the application, ad-hoc signs it without an Apple account or personal signing identity, verifies the app and disk image, and prints the DMG path and SHA-256 checksum. The local artifact remains under target/release/bundle/dmg/; no workflow uploads it.

Keep the printed checksum with the artifact. SECURITY.md documents the independent shasum, hdiutil, and codesign checks.

Prerequisites are the development tools listed in Requirements. Set EMBEDDINGS=1 when running the command to include the optional embeddings feature. Its first use downloads the public FastEmbed model into the per-user cache; if that download is unavailable, retrieval falls back to local BM25.

Known limitations

Design trade-offs in the current build, not bugs:

• Real supervisor execution is Claude-only. supervisor_model accepts claude (the real CLI) or auto (the scripted mock); everything else is rejected. Cross-vendor applies to workers, not to the supervisor.
• Memory retrieval is local and best-effort. Alias-expanded BM25 with optional embedding / hybrid re-ranking; degrades to lexical retrieval instead of blocking workers.
• The supervisor sees typed mission events, not raw worker dialogue. By design — escalation is bounded on outcomes, not chain-of-thought.
• Session resume requires vendor session-ID support. CLIs that don't expose a session ID can't be continued across app restarts.

Why "Vigla"?

Vigla (Byzantine Greek βίγλα, "watchpost" — from Latin vigilia, the root of vigilance) was the imperial guard regiment that kept the night watch on campaign: it posted the sentries, held the watchword, and ran the signal line so the emperor could actually sleep. That is this app's entire job — a supervisor that keeps trained watch over a fleet of powerful agents and wakes you only when something crosses a bound.

In category terms: Vigla is an open-source control plane for supervised agent operations — coordinating fleets of AI coding agents instead of babysitting them one terminal at a time.