o8

Approvals, audit, and memory across any AI coding runtime. CLI, MCP, Web Console - everything runs on your own subs.
repo:

[Marquise @marquisehurtt]

Would you rather have one expensive agent that usually gets it right, or five cheaper workers with a good reviewer?

[o8 @o8dotrun]

https://t.co/OIVxFsSgtk

[o8 @o8dotrun]

Slow base checks no longer make a mission disappear. o8 0.1.653 keeps cold launches alive for up to four minutes and keeps cleanup away from running packet branches. Headless missions can reset or continue an existing branch. Relaunch to update.

[Marquise @marquisehurtt]

o8 is open source today. MIT.

Agents do the work. You run the room.

One orchestrator scopes what you asked for and dispatches a fleet across 13 agent runtimes. Every worker stays isolated in its own git worktree. Nothing merges until you approve it.

• Approve what ships — every diff reviewed, high-risk work escalated, your sign-off on the merge

• Use the agents you already pay for — Claude Code, Codex, Gemini, opencode, one adapter contract

• Canvas — turn the IDE into a work surface and work with the thing itself

• Speak to the whole system — Symon dispatches by voice through the same gate

• Run the room from your pocket — approve or reject from your phone

• The fleet remembers the work — repeated fixes come back as rules you accept or reject

Fork every line. Change the interface, add a runtime, replace a workflow, or ship your own build.

Free, macOS, runs on the subscriptions you already have. 30 releases in the last 14 days. I built it with itself.

Repo in the first reply.

[mister @MISTERexc7]

The o8 workflows that actually save us hours, in one place:

1. Patch inspection taught me that missing evidence must fail loudly. An agent that fills gaps with plausible code is worse than one that stops.
2. Phone model choice exposed a contract boundary I’d treated as plumbing. User intent has to survive every handoff or the control is cosmetic.
3. A port probe passed alone and failed under shared runs. Isolation is part of correctness when agents test concurrently.
4. Conflicting packet state taught me to keep one terminal authority. Every card, receipt, and status view has to reconcile against it.
5. Browser work needs containment too. I accept less worker freedom to keep previews observable and inside the workspace.

[mister @MISTERexc7]

We decided o8 should run where your code already lives: on your machine.

The tempting architecture was obvious: upload the repo, run agents in our cloud, send the patches back.

It would have made deployment easier.

It also would have created a second copy of your source, a second credential boundary, and a remote system capable of modifying your code.

That is the wrong trust model for autonomous agents.

1. The repository stays local.

o8 runs as a macOS desktop app. Agents work against isolated git worktrees on your disk.

Each lane gets its own checkout and branch. It cannot reach another lane or touch main.

o8 never needs to upload your repository to an o8 server just to orchestrate the work.

2. Credentials stay under your control.

Your agent credentials live in the OS keychain, not in a dashboard database we operate.

You bring the accounts you already use. o8 coordinates them without becoming another vendor holding the keys to your engineering stack.

3. Local-first makes isolation real.

Worktrees are not simulated sandboxes or remote copies that drift from the repository.

Agents operate against the actual local git history, dependencies, scripts, and filesystem boundaries.

When two lanes touch the same file, o8 can surface the collision before either reaches main.

4. Autonomy stops at the gate.

Local execution does not mean unrestricted execution.

Before a lane can merge, o8 rebases it, runs typecheck, locks the reviewed head SHA, and queues merges in order.

Nothing lands without operator sign-off.

The agents can work independently. The repository cannot approve itself.

5. We accepted the tradeoffs.

Local-first is harder to build.

The machine has to manage processes, worktrees, lifecycle recovery, credentials, and concurrent git state. A browser-only product would have hidden more of that complexity on our servers.

We chose the harder architecture because the easier one moved trust away from the developer.

6. Mobile became a control surface, not a code host.

You can review and approve or reject in two taps, while the actual work remains anchored to your machine.

The replayable audit trail records every packet, decision, and merge without turning our infrastructure into the owner of your repo.

That is what local-first unlocks: a fleet that can move quickly without asking you to surrender the machine, the credentials, or the final say.

Your agents can be autonomous. Your code should still belong to you.

[o8 @o8dotrun]

Full re-reviews were unnecessary. So we removed them. 0.1.627 adds per-note reply/apply/act controls, voice-agent fallback, declarative community worker adapters, and a discovery-driven runtime picker. The runtime-only production pin is gone. Relaunch o8 and it's yours.

[o8 @o8dotrun]

Recall was the bottleneck. So 0.1.626 shares one MCP session across symbol-graph traces—cutting p95 from 1643ms to 146ms.

Also shipped: grounded phone Code sessions, declarative CLI adapters, surface approvals, and operator-controlled merges.

Relaunch o8 and it's yours.

[o8 @o8dotrun]

Agent-spawned workers were hijacking the screen. So we made them quiet. 0.1.617 also adds mobile plan progress, a Recent tail with truthful outcome chips, review-surface merge, and summary-first packet diffs—PR-view parity in o8’s style. Relaunch o8 and it’s yours.

[o8 @o8dotrun]

Repo switching was doing work for surfaces you could not see. So we removed it. 0.1.614 serves per-repo snapshots, restores known workspace state instantly, keeps hidden panes idle, and refreshes PR data in place. Relaunch o8 and it's yours.

[mister @MISTERexc7]

A multi-model coding fleet fails when every agent is allowed to redefine the job.

That was our early mistake in o8.

We assumed better prompts and more context would keep parallel agents aligned. Instead, each agent interpreted the repo, scope, and handoff differently.

The fix was not a larger context window. It was stronger coordination.

1. Give every agent a fixed role.

We stopped renegotiating responsibilities inside every prompt.

The orchestrator now decomposes the intent into bounded lanes with a clear owner and finish condition. Each agent knows what it may change, what it must return, and where its responsibility ends.

Less improvisation. Fewer overlapping rewrites.

2. Treat handoffs like APIs.

“Investigate this and help the next agent” is not a handoff.

We use output contracts: changed files, assumptions, evidence, unresolved risks, and the exact result the next lane can consume.

A structured handoff beats dumping another 20,000 tokens into context. More context gives an agent more information; a contract tells it what matters.

3. Make agents check each other.

The agent that writes a patch should not be the only agent judging it.

One lane implements. Another can review the result against the task and repo evidence.

Different reasoning paths catch different failures: invented assumptions, missed edge cases, unnecessary scope, or code that looks correct without fitting the surrounding system.

4. Isolate execution, not just prompts.

Every o8 agent works in its own git worktree. It cannot reach another lane or touch main.

That stopped agents from overwriting files mid-task, but exposed the deeper problem: two isolated agents can still form incompatible assumptions about the same surface.

So when lanes touch the same file, o8 surfaces the collision before anyone ships.

5. The orchestrator is an assumption manager.

Dispatch is the easy part.

The real job is preserving scope, ordering dependencies, enforcing handoffs, and preventing one agent’s local truth from silently becoming the fleet’s shared truth.

Then the review gate rebases, typechecks, locks the reviewed head SHA, and merges in order only after operator approval.

That is the tradeoff: more structure around the agents, far less chaos around the code.

o8 taught us that a fleet does not become reliable by making every agent smarter.

It becomes reliable when the system makes disagreement visible before it reaches main.

[o8 @o8dotrun]

o8 is a desktop control plane where you dispatch coding missions to AI agents that execute work in isolated git worktrees called lanes. It is built for developers who want to orchestrate multiple AI runtimes while maintaining absolute oversight via a structured approve-and-merge workflow. Unlike standard chat interfaces, o8 ensures every AI-generated diff is reviewed by the operator before it ever lands on the main branch.

[o8 @o8dotrun]

The transcript should be a work surface, not a log. So 0.1.591 adds a tighter turn grammar, per-file reviews, inline diff peeks, and file-scoped diffs. Threads name themselves, and private reports get IDs and public, credited fix receipts. Relaunch o8 and it's yours.

[o8 @o8dotrun]

0.1.585.

Every agent state lives on one canvas now — the motion is the state, the color is the severity.

Reviews say why they were declined. Files open on any path. Idle CPU is down, cold launch is traced.

Relaunch o8 and it's yours.

[o8 @o8dotrun]

0.1.584.

huddle plans reach fleet. the mic opens as audio ducks.

files open and save anywhere. finder stays on your surface.

declined reviews say why and pulse orange. request changes goes to orchestrator. discard stays recoverable.

relaunch o8 and it's yours.

[o8 @o8dotrun]

0.1.575.

native crashes leave evidence now.

segfaults, aborts, bus errors, stack overflows. o8 writes minidumps for them.

relaunch o8 and it's yours.

[o8 @o8dotrun]

to get the most from the release of 5.6 Sol.

claude Fable orchestrated codex Sol.

then codex Sol orchestrated claude Fable.

zoom out: gemini, hermes, openclaw — every runtime plugs into the same review gate.

omnidirectional. free beta → https://t.co/lpOxOs7QgG

[o8 @o8dotrun]

The design principle is simple: agents can move fast inside isolated lanes, but the operator keeps the merge decision. Autonomy should produce reviewable work, not hidden writes to main.

[o8 @o8dotrun]

A coding-agent fleet breaks when every agent is working from the same checkout.

[o8 @o8dotrun]

Main stays behind a gate. o8 rebases the lane, runs checks, locks the reviewed head SHA, and queues the merge for operator approval. Finished work is not automatic permission to land.