The TUI

Bare tally opens the agent-centered terminal app. The durable agent is the noun; harness, model, workspace, and source continuation are choices for the next launch.

Opening it

$ tally

tally ui is the same surface spelled out. On a fresh machine, bare tally silently creates the internal owner identity and then leads with adoption. Local adoption, inspection, launch, and capture do not require an account.

First run: adopt before create

When supported native sessions exist, first run lists them with source harness, task preview, workspace, and age. Enter opens a read-only preview; adoption then asks for the durable agent name and creates it atomically. Codex discovery is shipped today. Claude Code and Pi discovery are not yet shipped.

If nothing is discoverable, the app says which locations it checked and offers a new agent. It never renders the internal owner identity as a fake default agent.

Home: agents and activity

Home lists named agents. Empty metadata columns collapse, and relay state is honest: a saved relay credential reads connected, not synced. Liveness comes only from real local-log activity; no backend can mark an idle process alive.

Rooms appear in a separate ACTIVITY section only when they exist. j / k walk through agents and then rooms; a jumps to the highest-priority unread room. Solo users pay no screen space for coordination.

The agent page

Enter opens the selected durable agent. A persistent tab strip exposes five views; 1 through 5 address them directly and Tab / v cycles:

1. Overview shows standing character (when present), current work, unfinished next steps, and the last continuation/workspace.
2. Understanding shows only persisted character, task, acceptance, plan, decisions, relevant files, and memory. Missing sections disappear.
3. Continuations is the virtualized branch ledger. Selecting a row inspects that exact captured digest and provenance.
4. Sources shows the native session, encrypted-log event/hash/parent, workspace, and exact captured context.
5. Settings shows recovery-key status, relay status, memory/character state, and exact rename/identity/delete commands.

Agent content is decrypted locally from that agent’s own encrypted log. Opening the page and changing tabs is read-only; the relay is not consulted. e edits memory and E edits character through the existing hash-chained self-document commands.

Continue: inspect before execution

Press c on home or the agent page. With a remembered harness/model, Tally prepares the common path immediately; otherwise you choose from the same validated model table the CLI uses. Pi choices come from the live Pi model oracle rather than a fabricated list.

Before launch, a zero-write plan shows:

• machine, durable agent, harness, and resolved model;
• exact source continuation and workspace, including fallback warnings;
• Tally relay: receives none of the outbound context for this launch;
• model provider: receives the exact outbound context when the harness invokes it;
• native-session materialization, launch-preference, and post-exit capture writes;
• the exact equivalent tally continue command.

p opens the full scrollable outbound text. w edits the workspace; Enter replans and an invalid directory returns to the sheet with the input preserved. h and m change harness/model. The source sequence and workspace shown in the approved plan are frozen into the real CLI request, including tmux launches.

The planner itself does not materialize a session, write preferences, contact a model, or open the network. Those effects begin only after Enter authorizes the real launch.

After exit

A direct launch snapshots the source understanding before execution. If a new captured continuation exists afterward, the result sheet reports only persisted changes: plan changes, source-provided decisions, relevant files, task, and memory when a new memory event actually exists. Pending memory reflection is a separate status, never presented as a completed memory update.

Enter opens the newly captured continuation; Esc closes the result.

New tmux-window launches are asynchronous, so the main TUI updates when their capture lands but does not fabricate an “exited” result for a process it did not wait on.

Rooms

Opening an ACTIVITY row enters the room’s local decrypted feed. i composes, t creates a thread (its own MLS group), Tab / Shift-Tab switches threads, and an owner uses a to admit a pending joiner. The relay transports ciphertext; room membership controls who holds decryption keys.

Command palette

: keeps advanced operations available without making them the product loop: new, backup, doctor, rooms, signup, adapters, push, pull, verify, and config.

Keys

Keyboard and mouse invoke the same actions. Footer hints are clickable; click a selected row again to open it. ? is the authoritative contextual key map.

Key	Does
Enter	Open the selected item; authorize a fully previewed launch
c	Continue the selected agent/continuation
n	New or adopt
1 … 5	Overview, Understanding, Continuations, Sources, Settings
Tab / v	Next agent-page section
p	Toggle exact outbound context in the launch sheet
w	Edit launch workspace
h / m	Change launch harness / model
e / E	Edit memory / character from Understanding or Settings
j / k	Move selection or scroll the focused document
:	Command palette
?	Contextual help
Esc	Back or cancel without mutation
q	Quit when no modal owns the key

Configuration

The TUI reads the ordinary config store at startup; there is no second settings file.

Key	Values	Tunes
ui_spawn	auto | direct | tmux	where interactive harnesses open
ui_emoji	true | false	optional emoji glyphs
watch_idle_mins	minutes	idle threshold
watch_stalled_mins	minutes	stalled threshold

$ tally config set ui_spawn tmux
$ tally config set watch_idle_mins 10

Where next

• Quickstart: the complete adopt-to-continue loop
• Continue, start, and run: underlying verbs
• Harnesses and models: validation and provider rules