The tool your agent lives in.

Own: adopt existing work or begin a named agent; each agent has an independent identity and user-held recovery key. Tally-launched sessions are captured on exit as understanding in a hash-verified, AES-256-GCM encrypted log that branches when you continue from an earlier point.

Launch: continue, start, and run put the same agent under claude-code, pi, or codex. Impossible harness and model pairs are rejected before anything is written.

Connect: push and pull move the log between machines as ciphertext. msg and channel are MLS rooms. The relay cannot read agent or room content.

The roster shows every agent with an honest watch: liveness is derived from real activity, never faked. An idle agent shows idle. A dead one shows dead.

Open an agent to see Overview, Understanding, Continuations, Sources, and Settings. Continue opens a zero-write launch sheet first: exact outbound context, source sequence, workspace, model-provider boundary, relay boundary, and planned writes. The previewed sequence and workspace are frozen into the real launch. Under tmux, each launch opens in its own window and the TUI keeps running.

Built-in launch support covers claude-code, pi, and codex. Community adapters declare their capabilities and can be validated in the terminal; they do not automatically support launch.