Scheduler
Computes the DAG frontier, next-action signals, blockers, and unblocker order before workers run.
Local-first operator system for AI-agent fleets
Harmony
Harmony lets one engineer safely operate fleets of coding agents: a typed Go control plane gates every change, and a desktop cockpit makes the work visible, reviewable, and steerable.
Cockpit — the operator surface
The Operator Cockpit turns long-running, parallel agent work into one operable surface — DAG frontier, runner lanes, review packets, previews, and ledger evidence in a single canvas — connecting roadmaps and issues to changes you can preview, gate, and audit.
Fleet — the orchestration plane
Fleet schedules DAGs of agent work in typed Go, applies policy and trust checks before any write, measures planners against eval baselines, and records every accepted action to a durable audit ledger — improving with every run, proven across 900+ private fleet runs spanning business, product, and development work.
- Frontier
- DAG, worker, proof, and attention state converge on one next task.
- Authority
- Preview-first actions keep mutation authority behind Fleet-owned gates.
- Learning
- Token usage, eval misses, and ledger readback improve the next run.
Loop
Architecture and operator loop
The loop is intentionally operational: plan the graph, let Fleet gate and record worker execution, use Cockpit to focus attention, then turn receipts into better evals, prompts, and release checks.
Control contractModel proposes; Go commits.
Fleet turns uncertain worker output into typed decisions, gated previews, durable receipts, and reviewable state.
Control plane
Fleet keeps authority in Go
CLI, daemon, scheduler, policy, evals, runners, and the SQLite proof ledger own the durable state.
Deterministic policy
Caps, trust checks, schema validation, privacy gates, and stale-preview rejection happen before apply.
Ledger writes
Every accepted action becomes durable receipt state for review, replay, evals, and release checks.
Operator cockpit
Cockpit turns state into attention
A rich canvas for the operator thread, worker lanes, Atlas context, review packets, preview controls, and ledger readback.
Graph + lanes
The DAG, worker progress, proof requirements, and blockers are visible as the next decision surface.
Packet + Atlas
The operator sees provenance, linked context, evidence, and the exact apply boundary before committing.
Preview/apply
Previews are disposable. Applies stay behind Fleet-owned gates and must match current state.
Worker seams
Workers return typed envelopes
Go owns lifecycle and mutation authority while Codex, Claude, and Python subprocesses plug in through explicit seams.
Workspace work
Long-lived workers handle repository tasks and return progress, outcomes, usage, and proof envelopes.
Typed intake
StructuredGenerator produces pure typed plans for DAG intake without durable mutation authority.
Python envelopes
Python tools can join through stdin/stdout contracts while Fleet remains the source of committed state.
Disposable proposal
The model can propose an action and render the consequences without changing durable state.
Fresh-state gate
Fleet rejects stale previews and unsafe writes before any mutation crosses the apply boundary.
Operating signal
Token, context, cost, cache, and quota pressure are shown as operator telemetry without exposing private metrics.
Demo
Operator canvas tour
The public GUI tour uses Demo Lab mock fixtures and fake provider adapters, with no external provider mutation or private production state. The important part is the interaction pattern: see the frontier, inspect the evidence, preview the action, then feed the result back into the next run.
01
Cockpit overview
Operator Cockpit brings DAG attention, worker lanes, review packets, previews, and ledger evidence into one canvas.
02
Plan atlas
Atlas ties prompts, issues, runs, review evidence, and decisions together so the next unblocker is visible.
03
Preview boundary
Preview-first control asks Fleet to validate trust, schema, policy, freshness, and current state before any apply path.
04
Audit ledger
The ledger turns runs into durable receipts: proof notes, provenance, token usage, audit events, and follow-up standards.
Boundary
Real system, public boundary
Harmony is public-safe because it separates the real control plane, cockpit, worker contracts, and release gates from private source material that never belongs on a public page.
Fleet control plane
Harmony Fleet is the Go CLI, daemon, scheduler, policy layer, eval harness, runner system, and SQLite-backed proof ledger. The model proposes; Go commits.
Operator Cockpit
Harmony Operator Cockpit is the Electron surface for DAG attention, worker lanes, Atlas context, review packets, preview controls, and ledger readback.
Preview and release gates
Preview-first actions keep applies behind Fleet-owned gates. Release and privacy scans prepare operator decisions instead of publishing, tagging, or changing visibility on their own.
Public extraction boundary
The public extraction keeps the reusable architecture, docs, demo material, and proof patterns while leaving private tickets, logs, prompts, databases, credentials, and provider payloads out.
Engineering
What Harmony actually proves
Harmony's proof is not a generic agent claim. It is the concrete engineering loop: typed Go gates, worker protocols, operator attention, usage telemetry, evals, and release discipline.
Typed Go mutation gate
LLMs draft structured actions, but Fleet owns identity, schema validation, trust checks, DAG safety, SQLite writes, and audited apply boundaries in typed Go.
Polyglot worker protocols
Runner workers do long-lived workspace work; StructuredGenerator workers make typed intake plans. Python can plug in through stdin/stdout envelopes without owning durable mutations.
One canvas for the next unblocker
Cockpit turns graph status, blockers, worker lanes, review packets, and proof into the single next decision most likely to unblock the work.
Token insight as telemetry
Fleet reconciles session and worker-result usage, tracks model/role slices, cache tokens, quota pressure, and cost-per-output signals for operating the fleet.
Self-improving proof loop
Planner evalsets, worker calibration, proof failures, and ledger readback become concrete changes to prompts, standards, gates, fixtures, and future run habits.
Receipts
Release and proof receipts
The receipts are commands and component checks. They prove release posture, privacy posture, worker boundaries, and preview-first controls without claiming market outcomes, live provider authority, or benchmark superiority.
make proof
Runs the full local lane: layout, privacy, whitespace, Fleet CI, Cockpit install/typecheck/tests/build/smoke/e2e, media readback, cleanup, and final scans.
make release-scan
Runs the faster publication-boundary scan for privacy and release drift before any visibility or launch-copy decision.
Fleet eval and gate proof
Checks planner behavior, runner contracts, policy gates, preview/apply validation, and the safety boundary around DAG mutations.
Cockpit release proof
Checks the operator surface, source contract, release scan, review packet rendering, ledger states, and preview-first UI behavior.
Next step
Review the operator loop first.
Review the public tour, then read the source: Fleet (the Go control plane) and the Operator Cockpit (Electron) ship together in one repo, Apache-2.0.
Apache-2.0. Demo Lab data is fictional; the interaction patterns come from real private fleet runs.