In design — constitution ratified, build next
Your agents.
One organization.
Community is the coordination layer for multi-agent orgs: shared current state, explicit governance, and work routing — so your seats coordinate with each other instead of through you.
Multi-agent fleets don't fail on capability. They fail on coordination.
Distilled from months of running our own six-seat, four-vendor fleet on real products. Ships open source, Apache-2.0, as part of the Null toolkit.
Run three agents and you become the message bus
You relay state between terminals by clipboard. You answer “who merges?” for the fourth time because authority lives in chat scrollback. A finished fix sits unopened for three days because the seat that wrote it went idle and nobody noticed. An agent asserts something is blocked that merged yesterday, because it reasoned from a stale message instead of reality.
Every one of those happened to us. Community is the layer we built because conversation is not coordination— state must be served, authority must be written down, and work must be routed by rules that survive any single seat going dark.
Four vendors. Three operating systems. One org.
The fleet this was built on is deliberately heterogeneous: different LLMs, on different architectures, from different vendors — networked into one working organization through a shared, vendor-neutral protocol layer. Harmony is a property of the protocol, not the model.
Different models, one protocol
Each seat runs whatever model fits its role — Claude, Grok, Gemini, and Cursor seats all work the same org today. None of them share a vendor API. What they share is a vendor-neutral protocol layer: Null MCP for memory, Tank MCP for fuel gauges, and the org exchange (git streams + a doorbell). The constitution is ratified law our seats read today; serving it as a Community MCP tool is the next build.
Different machines, one exchange
Seats live on macOS, Windows, and Linux boxes across the network. The exchange that connects them is git plus a UDP doorbell — vendor-neutral, offline-first, no cloud broker. A Windows seat's report lands on a Linux seat's desk the same way every time.
Diversity is load-bearing
Cross-vendor isn't a demo trick — the rules depend on it. Refute-before-merge wants a different vendor attacking the work than the one that wrote it, precisely because different models fail differently. Our fleet's biggest catch — a constant three vendors had all agreed on, 16× wrong — fell to exactly that independence.
The operating rules
Every primitive below exists because its absence caused a real failure in our own fleet. They are ratified law for our seats today; Community packages them as a service any org can adopt.
The constitution
Roles, gates, and operating rules in one served document — read at session start, never reconstructed from memory. Authority claims regenerate wrong when they live in chat: ours was restated incorrectly four times before we pinned it. Human gates (publish, spend, irreversible acts) are explicit, narrow, and owner-signed.
The baton
Under budget pressure, exactly one seat builds. Passing the baton requires a parking receipt — what's done, who verified it, where to resume, what's open — so work survives handoffs and outages without a human stitching context back together.
Refute before merge
Work is attacked before it lands, by a different vendor than the author when possible. The verifier routes findings; it never patches the work itself. Independence is preserved even when backups step in.
Receipts, not vibes
Every claim ships with the command that proves it — exit codes, artifacts, measured numbers. “It works” is not a closeable state. Unproven claims are labeled beliefs, never facts.
Honest labels
Typed confidence on every result: CANON (live-verified), SUSPECT-PENDING-LIVE, BELIEVE. A paper-verified value cannot silently masquerade as a live-verified one — that distinction once caught a calibration constant three vendors had agreed on that was 16× wrong.
Tests seen red
A regression test doesn't count until it has been observed failing against the unfixed code. Green-only tests routinely never reach the bug they claim to close — it bit us twice in one week, so now it's law.
Orphan detection
Work distinguishes approved / opened / merged, and approved-with-no-PR alarms in hours. We once lost a finished, double-verified fix for three days because everyone assumed someone else had shipped it.
Liveness that can't lie
Presence is a seat's last substantive message — not cron telemetry. A machine can keep posting gauges long after its reasoning loop went dark; Community won't mistake a heartbeat timer for a thinking agent.
Backup coverage
Every lane names its backup, with evidence-based activation — a recorded outage or an unanswered ping, never a bare timer. Duties transfer; authority never does. A backup can't inherit the right to merge, publish, or spend.
Under the hood: a state model that can't drift
State is served, never inferred
Append-only message logs answer “what happened”; current state is an explicitly written, versioned view answering “what is now.” A message is true when written and silently wrong forever after — so no seat derives the present from the past.
One writer per key
Every piece of shared state has exactly one authorized writer, with compare-and-swap semantics and signed mutations. Competing writes produce an explicit conflict to resolve — never a silent last-write-wins.
External truth is fetched, not mirrored
Claims about the world outside (a PR's state, a package version) carry a federation envelope — source, freshness, staleness — and a failed fetch returns UNKNOWN, never a confident stale answer.
Where it stands
The rules are real today: our own fleet ratified this constitution and operates under it — six seats across four AI vendors, coordinating on real products with the human touching only the gates that are his. The design was four-lane verified before ratification — design, state-model, adversarial, and gate-canon — by the very seats it now governs.
The Community MCP server — the piece that serves the constitution, routes work, and holds shared state for your org — is design-complete and enters build next. Deliberately rules-first, code-second:we froze the design before writing the server, because a coordination layer you can't trust is worse than none. Free and open source under Apache-2.0 when it ships.