Citadel
An operating layer that makes multi-step Claude Code and Codex repository work recoverable, verifiable, and coordinated.
Per-dimension scores and reasoning
Evidence shows least-privilege design: local state by default, no automatic transmission, .env protection, path checks, external action gates. User confirmation exists (approval gates, explicit consent). Data flow transparency documented (SECURITY.md, THREAT_MODEL.md). Sensitive data handling protected (.env protection, private state guidance). Dependency security partial: dependency pinning in GitHub Actions, but no dependency audit or vulnerability scan evidence. External effects controlled (prohibits push, publish, etc.). Rollback documented (INSTALL.md, /unharness). Source attribution: author identity unverified, but license and repo metadata present. Deductions: dependency security evidence thin, source attribution limited by unverified publisher.
Self-consistency: README, SECURITY.md, package.json align; features match docs. Dependency availability: Node.js 18+ requirement clear, but no lockfile or integrity checks. Failure messages: error handling documented (stderr mirroring, block reasons). Deduction: dependency availability evidence thin.
Audience and scenarios: clearly targets Claude Code and Codex users, multiple use cases. Capability boundaries: docs explicitly state it does not replace code review, branch protection, etc. Trigger precision: /do command has clear routing logic. Environment fit: supports Windows, Node.js 18+, runtime adapters. Deduction: none significant.
Information architecture: clear docs structure, docs/ directory. Install notes: detailed, quick and manual install. Naming stability: version 1.3.0, but no naming stability guarantee. Examples and FAQ: DEMO.md and common questions. Known limitations: SECURITY.md and THREAT_MODEL.md outline boundaries. License: MIT explicit. Versioning and changelog: CHANGELOG.md present. Maintenance responsibility: author unverified, but contributing guide exists. Deductions: naming stability evidence thin, maintenance responsibility limited by unverified publisher.
Output usability: CLI, docs, demos provided. Marginal value: clearly states when useful, when not. Cost-benefit: benchmark reports exist, but unverified. Deduction: cost-benefit evidence based on unverified benchmarks.
Claim traceability: evidence manifest and benchmark reports. Cross-source corroboration: multiple benchmark reports, but not independently verified. Fact-inference separation: clearly distinguishes verification results from inferences. Deduction: cross-source corroboration thin.
- Publisher identity unverified; assess supply chain risk carefully.
- Dependency security evidence thin; check dependency locking and vulnerability scanning.
- Benchmark results not independently verified; treat cost-benefit claims with caution.
What does this agent do, and when should you use it?
Citadel is an open-source operating layer for Claude Code and OpenAI Codex, not a replacement coding runtime. Its /do entry point routes a request to a focused workflow, coordinated session, persistent campaign, or parallel Fleet. Repository-local state records campaigns, discoveries, handoffs, next actions, and telemetry so work can resume in later sessions. Lifecycle hooks, verification records, and receipts add operational controls around consequential work. Installation adapts an existing Git repository with runtime-specific configuration and local state; optional cross-clone memory uses a user-level SQLite database.
After /do <request>, Citadel routes the request to a focused skill, coordinated session, campaign, or Fleet. Its hooks apply repository rules, gate consequential actions, and capture required checks; it then writes the result, handoff, and next action into repository state for /do next or /do continue. citadel operation ... adds explicit quality, privacy, tool, time, model-fallback, and cost constraints, using the Operations Protocol’s operations, attempts, intents, evidence, and receipts. Operation Fork runs one objective in isolated Claude Code and Codex worktrees. On Node.js 22.13+, citadel memory enable stores durable cross-clone knowledge in a user-level SQLite database.
- A Claude Code maintainer resuming a refactor across sessions and needing
/do continueto surface the recorded next action. - An OpenAI Codex user making a risky, multi-step repository change that needs hooks and explicit verification.
- An engineering team coordinating several agents or branches with isolated worktrees, ownership, and shared discoveries.
- An evaluator comparing Claude Code and Codex on the same objective through isolated branches with Operation Fork.
- An operator packaging a repeatable outcome with permissions, checks, stopping conditions, and a verifiable receipt.
What are this agent's strengths and limitations?
- Directly supports both Claude Code and OpenAI Codex with runtime-specific installation paths.
- Preserves campaigns, discoveries, handoffs, and next actions for interruption recovery across sessions.
- Uses hooks, verification states, and receipts; absent evidence is not promoted to success.
- Operation Fork can execute the same objective in isolated Claude Code and Codex worktrees.
- Requires a Git repository, Node.js 18+, and either Claude Code or OpenAI Codex; it is not a standalone coding runtime.
- Runs with the permissions of its host runtime and does not replace code review, branch protection, or repository-specific checks.
- Cross-clone memory requires Node.js 22.13+ and uses a user-level SQLite store.
- Its published representative shakedown missed the frozen 20% energy gate, which the project reports as failed.
How do you install or deploy this agent?
Requires Claude Code or OpenAI Codex, Node.js 18+, and a Git repository. In the target repository, install Citadel through your coding agent, follow any printed enable step, start a fresh session if prompted, and run /do setup --express. For manual installation, run git clone https://github.com/SethGammon/Citadel.git ~/Citadel; for Codex run node ~/Citadel/scripts/install.js --runtime codex --add-marketplace, or for Claude Code run node ~/Citadel/scripts/install.js --runtime claude --install --scope local. Start a fresh session in that repository and run /do setup --express.
How do you use this agent?
After setup, begin with a request such as /do review README.md or /do generate tests for the changed files; /do is Citadel’s natural-language entry point. Citadel routes the request to a focused workflow, coordinated session, persistent campaign, or parallel Fleet. During the work, repository-local state records results, discoveries, handoffs, and next actions. Use /do next to surface the recorded next action, or /do continue to resume the work in a later session. When a repeatable operation requires explicit quality, privacy, tool, time, model-fallback, or cost constraints, use citadel operation ...; its Operations Protocol records operations, attempts, intents, evidence, and receipts. Operation Fork can run the same objective in isolated Claude Code and Codex worktrees. On Node.js 22.13+, run citadel memory enable to opt into durable cross-clone repository memory stored in a user-level SQLite database.
How does this agent compare with similar options?
Citadel complements rather than replaces CLAUDE.md or AGENTS.md: those files describe project rules, while Citadel supplies workflows and state for carrying them out. A short one-off edit may already be handled by the coding runtime alone; Citadel targets cases where recovery, coordination, and verification are the harder problems.
FAQ
Does Citadel automatically transmit project state or telemetry?
Does it guarantee the quality of an agent’s code?
What happens when verification evidence is missing?
passed, failed, blocked, or unknown; missing evidence is not promoted to success.How can it be removed?
/unharness to create a receipt-owned leave plan, review the footprint, then apply it with the plan token. Legacy installs are inventoried first and cannot claim exact removal.