/os
The part that remembers.
A ledger of what was decided, a floor of what was actually said, and a set of tools that answer questions about your project without pretending to more certainty than they have. It runs on your disk, against your project, under your keys.
Everything below exists and runs today — StateEngine is built with it. The idea underneath all of it is that a system which cannot say “I don’t know” cannot be trusted when it says anything else.
continuity
Your project outlives the window. So does everything the last agent learned.
A context window ending is not an event the project should notice. Each agent keeps its own durable memory outside the session — and it keeps writing even when the thing that records transcripts stops working.
the log does not pause when the watcher does
the floor
Written with append and fsync, not by a watcher
Each seat appends to its own rolling log and an immutable turn log, keyed to its agent id rather than to a session. That path does not depend on transcript capture — so when capture breaks, and it has, continuity still lands.
across tools
The same seat, whichever client it runs in
A seat that moves between different coding tools writes to the same memory. Its history is one history, not one per vendor.
identity
It cannot become another agent
Identity resolves from the seat’s own file, then the registry, then a neutral default that is its own id — never another seat’s name. Ids are twelve random bytes, and a weak entropy source throws rather than minting a bad one.
merging
Fusing two seats needs a human, and loses nothing
Merging one seat’s memory into another requires human authority, validates the alias, and throws on any turn-count mismatch. Zero loss is an invariant, not an intention.
delegation
A loop you shape. Not one we impose on you.
Work is delegated, not just generated: a seat writes the spec, an author runs it in a clone of your repository, and reviewers judge the result before a human decides. How much review that work gets is a dial you set — the rigour is available, not compulsory.
writes the spec and delegates it
delegates — it does not author
spawns as a subagent in a clone of your tree
clone in · diff out · clone discarded
how much scrutiny this job is worth — your call
2 opinions · you pay for exactly these
nothing reaches your repository without it
awaiting a person
not a setting — the one stage with no dial
four slots, four independent choices — an author is never judged by its own family
the sequence
Spec, author, review, gate
The delegating seat writes a spec. The author spawns as a subagent inside a clone of your tree. Its output goes to reviewers. Nothing reaches your repository without a human at the end of it.
configurable
You choose how much review a job is worth
Reviewer count is yours to set. A throwaway change and a load-bearing one do not need the same scrutiny, and you should not pay as if they did.
isolation
Authoring never touches your working tree
Work happens against a separate clone, and the destination is refused rather than reused if something is already there.
model-agnostic
The roles can be different vendors
Author, verifier and reviewers are configured independently and need not come from the same model family — so a model is not asked to sit in judgement on its own output.
context
A cold start that isn’t cold. Bounded, ranked, and the same every time.
A fresh agent does not read your repository to find out where things stand. It reads a packet: a bounded, ordered extract with provenance on every section, small enough to be cheap and deterministic enough to be diffed.
the id line is counted in its own budget
bounded
Fifteen kilobytes, measured honestly
The budget includes the packet’s own identifier line, so a packet cannot slip over the ceiling by not counting part of itself.
ranked
Every section carries a classification
Canonical decisions, verified state, revisable working state, candidate recall — each is labelled with what kind of truth it is, and each carries its own provenance and digest.
deterministic
The same inputs produce the same packet
A packet is identified by a hash of its content and metadata, which is what makes it possible to ask only for what changed since the last one.
not injectable
Untrusted text cannot forge a section header
Working state and continuity are sanitised before assembly, so text inside a packet cannot fabricate an authority section around itself. That is what makes the ranking a mechanism rather than a convention.
authority
Agents propose. Only a human makes it canon.
Decisions are appended to an event log and the canonical index is rebuilt from that log rather than stored as the source of truth. Nothing is edited in place, so nothing can be quietly rewritten.
I recorded a proposal from this session. It won’t bind anything until you say so.
api.retry-policy
Exponential backoff, max 3 attempts
seq 261 · proposed by agent · PENDING
I can’t ratify my own proposal.
▸▸human gate on (an agent cannot run /ratify on its own behalf)
the proposal waits. it cannot promote itself
ratification
Model output never promotes itself
A proposal stays a proposal until a human — or a policy a human ratified — promotes it, and the promotion is itself a recorded event that can be reversed.
tiers
Every claim carries a rank
Your instruction outranks the ledger, which outranks working state, which outranks anything an agent merely recalled. Conflicts are resolved by the ordering, not by whichever source spoke last.
tamper-evident
You cannot ratify something that changed
Promoting a memory requires its content to match what was proposed. A log that was edited afterwards cannot launder new text under an old identifier.
contradictions
Disagreement is an event, not a warning
When two parts of the project conflict, that conflict is recorded with both sides and tracked until it is explained or resolved. A warning has no lifecycle; this does.
uncertainty
It tells you when it doesn’t know. Which is the only reason to believe it when it does.
Most systems are confident by default and quiet when they fail. These are built the other way round: an answer carries the staleness of whatever produced it, and a silent sensor reads as unknown rather than as healthy.
no match
searched 18,543 nodes across natural_key, source_path, symbol_name
“retry” matched 4 nodes
“budget” matched 2 nodes
“owner” matched 0 nodes
it reports what it searched, not just that it failed
atlas
Bounded find that returns pointers, never text
Answers come back as locations with provenance, each carrying how stale its source is, and stale extractors are quarantined rather than quietly trusted.
sensors
The system measures its own completeness
Capture coverage, unmade decisions, open contradictions, runner liveness — each has a named producer and a renewal expectation, so absence of a complaint is not treated as evidence of health.
drift
It notices regression and refuses to fix it itself
Fixed probes accumulate observations and raise a flag when the latest falls outside what its own history implies — and deliberately never adjust routing on their own, so the thing being measured cannot move the bar.
how you reach it
Usable today. At home in our own harness.
The whole tool surface is exposed over MCP, on stdio and HTTP — so StateEngine works with the coding tools you already run, including Claude Code and Codex, against a project on your own disk. That is the on-ramp, and it works now.
The full experience lives inside our own model-agnostic agent harness, where the state layer is native rather than reached through someone else’s client. Credentials there are yours: bring your own key, or sign in with OAuth where the provider’s terms permit it.