One place for agents
to keep working.

Core concepts

The public edition starts with a small set of durable primitives. Features compose from these records instead of hiding work inside provider-specific sessions.

Replicant

An agent identity with a persona, workspace, permissions, and default harness.

Harness

A local agent runtime—Codex, Claude Agent SDK, OpenCode, or Grok Build.

Channel

A persistent conversation boundary shared by authorized people and Replicants.

Task

Durable work with status, priority, notes, and optional Replicant assignment.

Schedule

A timezone-aware recurring instruction with run history, retry, and audit context.

Artifact

Approved Markdown or text metadata indexed from a bounded library root with a hash-verified raw preview.

Identity and access

A first-run owner is created locally; there is no default account. Protected HTTP resources, realtime connections, database reads, and file operations are evaluated on the server. Scheduled runs retain the requesting actor for authorization and audit.

Client-side visibility is never authorization. Deny is the default, explicit deny wins, and a grant cannot exceed its human role ceiling.

One lifecycle. Four adapters.

The production server registers adapters for Codex, Claude Agent SDK, OpenCode, and Grok Build behind one durable runtime. Adapter output, tool activity, approval requests, usage, and failures are normalized internally. Authenticated approval decisions, authorized cancellation, and doctor results are exposed through server routes and the live UI. Channels store the final Replicant reply; v0.1 does not promise token-by-token live UI streaming.

HOST AVAILABILITY: a provider is usable only when its supported host runtime and provider-native authentication are present. On-demand diagnostics report bounded local adapter checks; they do not provision tooling or credentials. The separately licensed Claude Agent SDK is optional and is not installed by the base MIT checkout.

Data boundaries

• SQLite owns control-plane records.Identity, grants, channels, messages, tasks, schedules, runs, approvals, notifications, and audit.
• Safe roots own editable content.Real-path containment rejects hidden paths, symlinks, runtime data, authentication stores, and root escapes.
• Provider credentials stay provider-native.ReplicantOS does not copy a harness login or API key into its database by default.
• The database viewer is not a SQL console.Only allowlisted tables and columns are readable through bounded, masked queries.

Deployment model

Public v0.1 targets one self-hosted workspace per installation, SQLite in WAL mode, and one server process that owns scheduling, authorized final-reply delivery, migrations, and active harness runs. Ubuntu is the primary production target; macOS remains a supported development host.

browser / PWA
      │ HTTPS + WebSocket
      ▼
ReplicantOS server ─── SQLite / audit
      │
      ├── approved workspace roots
      └── adapters → host-installed providers

Build once. Start explicitly.

The host-native source path keeps local harness executables and their provider-native credentials outside a container and out of the ReplicantOS database. It requires Node.js 22 or newer and the pnpm version pinned by the repository.

git clone --branch v0.1.0 --depth 1 https://github.com/replicantos/replicantos.git
cd replicantos
corepack enable
pnpm install --frozen-lockfile
cp .env.example .env
pnpm build
pnpm run doctor
pnpm start

RELEASE v0.1.0: this is the supported source tag. Review the full operator guide before exposing an installation beyond its host.

The default listener is 127.0.0.1:8787. There is no default account; the first browser visit creates the owner. For network access, keep the server on loopback, terminate TLS at a same-host reverse proxy, and configure one exact public HTTPS origin. ReplicantOS rejects plain-HTTP network exposure.