- 3,054 tests across 274 files
- 160 routes and 76 IPC channels pinned by build gates
- 30 product films, each shot in one take on a live build
A private operating system for autonomous work, in TypeScript on Electron and React. It runs standing AI operators on the coding CLIs you already own, on your own machine, and stops every consequential action at a gate until you answer — each answer written to a ledger that outlives the run. It ships no model of its own.
Three objects carry the design. An operator is a standing role, not a chat window: its own engine, remit, capabilities, workstreams and cost ledger, all of which survive closing the app. A crew is several operators reading one written brief before every turn and writing into one transcript. A gate is the moment an operator wants to do something consequential and has to ask — in the transcript, with the exact command, the consequence in plain language and the name of the operator that asked.
The architecture is four layers, and every boundary does work. An Electron shell with node integration off, context isolation on, the sandbox on and every IPC call through an allowlist. A React renderer served from exactly one origin. A local core bound to IPv4 loopback holding the engine drivers, a permission broker, a capability broker with 500 connectors, a cadence scheduler and a webhook receiver. SQLite and JSON underneath, in a directory under your home. Setup is a scan of the CLIs already signed in on the machine — Claude, Codex, OpenCode, Grok, Cursor, Qwen, Kimi, Droid — not a form asking for keys.
The permission broker is the hard part. When an engine asks for a tool its mode would otherwise deny in silence, the request travels over a per-turn unix socket back to Helmryth, renders as a card, and the turn stops until it is answered. If the broker cannot start, the turn fails closed: an unanswerable request is denied, never auto-approved. A standing rule names one exact command key, so allowing one command never quietly allows the next.
The rest of the boundary is written as refusals, each with a test behind it. A wrong origin is refused, and localhost is not accepted as an alias for the loopback address, which closes DNS rebinding. Handing an operator a real macOS session takes an acknowledged warning in the interface and an explicit flag on the wire; without the flag the server answers 400. MCP credentials travel as a mode-0600 file, never on the command line. Webhook secrets are shown once. Anything key-shaped is masked in the gate card, in the reply and in the protocol log on disk.
The suite registers 3,054 tests across 274 files. 160 HTTP routes, 597 renderer controls, 76 IPC channels and 21 measured contrast pairs are each pinned by a build gate that fails the moment the code and the documented census drift apart. The documentation is thirty product films, each recorded in one take against a live build, with the real token counts, costs and error states on screen.
It lives under its own GitHub organisation, Helmryth, under Apache-2.0, alongside an iOS companion in Swift, a phone sidecar and Cloudflare workers in the same tree.