A local operating system for autonomous work, in TypeScript on Electron and React. An operator is a standing role with its own engine, remit, capabilities, workstreams and cost ledger, all of which survive a restart; a crew is several operators sharing one brief and one transcript; a gate is the point at which an operator has to ask before doing something consequential, and the answer is written to a ledger that outlives the run. Nothing calls home: the core binds to IPv4 loopback, accepts exactly one renderer origin, and holds credentials write-only. It ships no model and drives the coding CLIs already installed on the machine.
This is the one entry on the shelf that is not a personal repository. The owner created the Helmryth organisation on 7 September 2026 — his first — to hold it, and the code sits at Helmryth/HelmRyth under Apache 2.0. It is filed here anyway, because this shelf records what he has put in the open and the account it is published under is a fact about the project rather than a reason to leave it off.
It is built around three objects. An operator is a standing role rather than a chat window: its own engine, its own remit, its own capabilities, its own workstreams and its own cost ledger, all of which survive closing the app. A crew is several operators sharing one written brief that each of them reads before every turn, writing back into one transcript — a brief without shared state. A gate is the moment an operator wants to do something consequential and has to ask, in the transcript, with the exact command, the consequence in plain language and the name of the operator that asked. A run keeps its own transcript, token tally and unsent draft, and four of them can be open inside one operator without a word crossing between them.
The architecture is four layers deep and each boundary does something. An Electron shell with node integration off, context isolation on, the sandbox on and all IPC through an allowlist. A React renderer served from one known origin. A local core on a loopback port holding the engine drivers, the permission broker, the capability broker, a cadence scheduler with its own webhook receiver, and SQLite plus JSON in a directory under your home. It ships no model at all: setup is a scan of the CLIs already installed and signed in on the machine, with their real version numbers, rather than a form asking for keys.
The permission broker is the hard part. When an operator's engine asks for a tool its permission mode would otherwise deny in silence, the request is routed over a per-turn unix socket back to Helmryth, rendered as a card, and the turn stops until it is answered. If the broker cannot start, the turn fails closed — an unanswerable request is denied and never auto-approved. Granting is narrow by construction: a standing rule names the exact command key it will remember, so allowing one command does not quietly allow the next.
The rest of the boundary is written as refusals, each with a test behind it. A request carrying a wrong origin is refused and localhost is not accepted as an alias for the loopback address, which is what closes DNS rebinding. Handing an operator a real macOS session needs both an acknowledged warning in the interface and an explicit flag on the wire; the same request without the flag is answered 400 by the server rather than by the UI. External URLs open only under http or https — an allowlist, so every scheme nobody has thought of yet is refused by default. MCP credentials are written to a mode-0600 temporary file and passed by path, because anything on the command line is readable by any local process for the life of the turn. Webhook secrets are returned once at creation and the listing endpoint has no secret field at all, so it cannot re-reveal one. Anything key-shaped is masked in the gate card, in the reply, and in the raw protocol log on disk.
The figures are the repository's own, and it treats most of them as build gates rather than claims: 160 HTTP routes, 597 renderer controls across 63 files, 76 runtime IPC channels and 21 measured colour pairs are each pinned by a script that fails the build when the code and the documented census drift apart. The test count is different in kind — 3,054 registered across 274 files, of which 3,035 pass on macOS with 19 POSIX-only skips and 3,045 on Linux with 9 — and is whatever the suite prints on the day it runs. Its documentation is thirty-odd screen recordings taken in one pass against a live build, with the token counts, dollar amounts and error states on screen the ones the app produced.
The honest edge is distribution. Packaged release endpoints are not provisioned in this tree: publishing it means bringing your own release channel, signing assets and checksums. Telemetry is off and no sink is configured. The isolated Linux desktop needs Docker, and the whole thing needs at least one coding CLI you already pay for, because it deliberately does not bring a model of its own.