State of the vault · internal report
TL;DR: read this, skim the rest
This is the running node reporting on itself: what is deployed right now, what shipped across v0.2.0 → v0.4.0, and what is being built next. If you are new to Citadel, the home page covers what it is and how to start; this page is the numbers.
Across v0.2 → v0.4 we shipped zero-dependency onboarding, autonomous ingestion, Linear sync, read-side isolation, and Shared Session Traces (share a dead end, reference-only, without leaking private memory). Next: a GitHub App for PR context + checks, a Google Chat digest bot, and one central agent hub over all org knowledge. Every section below expands. Open the ones you care about.
Health and scale. The live tiles below refresh from the running node each time this page loads; the rest are repo facts as of the last report.
Live tiles pull from /api/state. Commits, decision records and MCP tools refresh daily. Tests, releases and LOC are as of v0.4.0, 2026-07-22.
The capabilities that are in production today. The three you'll touch most are session sharing, autonomous capture, and Linear sync.
SessionEnd distills how you approached a problem into a private Session Trace. Hit a dead end worth flagging? citadel_share_session shares a redacted, compacted version to a shared dataset.
A git pre-push hook and Claude Code SessionEnd hook snapshot work to your Node. Both are fail-silent. An hourly evolve cycle folds GitHub, Linear, and repo content into the graph.
hooks + hourly evolveThe full workspace syncs to Central; issues assigned to you mirror into your Node as a Seat-Scoped Mirror, so an agent answers "what do I need to do?" from your memory.
workspace → Central · yours → NodeA web UI renders org knowledge as a concept map and a live sync/search/ingest timeline. Portal Phase 1: paste your token, land on My Node (stats, checklist, deep links).
Pixel Bastion brand · caller-scopedShipped in v0.4.0. The goal: let the team learn from each other's dead ends without exposing anyone's raw private working memory.
citadel_share_session or POST /api/share-session) and requires an Approved Capture Root (server-side cwd check).session-traces dataset.citadel_search includes traces with a reference-only tag. Traces never promote to Central and never feed the daily improve loop.Zero per-session ceremony. Three capture paths feed your Node; one scheduled cycle keeps Central fresh.
citadel capture: summarizes each approved root (git metadata + README, never raw files).Every tag shipped to PyPI and deployed to Railway. Expand any release for its full notes.
/api/share-session; Compact Session Context, reference-only in search, deferred cognify./api/knowledge/events and /feedback are now caller-scoped; pip-audit CI gate.citadel activity: dev-side view of your vault; --watch and a --global seat-presence board.--json error parity.token create --seat inherits the seat's role and private dataset; interactive picker replaces the service-account footgun.citadel token set + citadel update: rotate a token or self-update without re-running onboard; stale-shell auth hints tell you the actual fix.ingest/search HTTP-backed by default and routed to your seat; inline cognify makes notes searchable immediately.citadel mcp add wires Cursor, Codex, Gemini, Windsurf; guided first run; citadel doctor repairs setup drift.citadel status.Honest status: some of this is in active design, some is still a sketch we're pressure-testing. Nothing here is claimed as shipped.
A GitHub App that injects relevant vault context into pull requests and runs verifying checks as a PR status, kept in sync with Linear and other connected apps, so a review sees the same knowledge an agent would. Direction sketched via the modular update-agent architecture; not built yet.
A single point of access to all org knowledge and context: an internal update agent plus hosted MCP consolidating GitHub, Citadel search, Linear, and future approved sources behind one contract. Repository boundary and initial contract are drafted.
A daily Organization Update Digest to one Google Chat space: what changed, what's open, what merged, plus a cautious source-linked "Agent read." Outbound-only in Phase 1; app-auth and schedule are settled. Silent on quiet days.
Make durable, first-class Structured Knowledge the source of truth Citadel owns, with the retrieval layer demoted to a rebuildable index. Plus a retrieval eval harness (citadel bench) and vault lint (citadel lint). This is how the vault stops depending on any one engine to hold the truth.
Retraction controls (citadel unshare, ~90-day TTL, admin hard-delete), overlap-ranked prior-work retrieval, and more delivery gateways (Agent Messenger, Slack, email, webhook) off the same update-agent contract.
The application is Apache-2.0 and public. The vault it serves is not — and that separation is the point. You can read every line, run the full test suite offline, and send a pull request without ever touching org memory.
Licensed under Apache-2.0, including the patent grant. Contributions come in under the same terms via DCO sign-off (git commit -s) — there is no CLA to sign.
Contributors work on the application only. No ctdl_ token is issued and none is needed: the suite runs with no token, no network and no database, so every change is reviewable without vault access.
Tests on Python 3.11 and 3.12, ruff, a dependency audit, CodeQL, licence review, DCO, and a gitleaks secret scan carrying a rule for ctdl_ tokens. One CI gate check guards main.
Work is labelled by type, area, priority and status. New issues land in status/needs-triage; newcomers start at good first issue. Vulnerabilities go to a private advisory, never a public issue.
Start with CONTRIBUTING.md — setup, the label taxonomy, commit conventions, and exactly what you can and cannot run locally.