Alicorn
You direct the agents. Alicorn runs the ticket.
Named members carry a ticket from brief to pull request on your own machine, hand it to each other as they go, and interrupt you only at the gates you kept.
An editor assumes you are about to type. Alicorn assumes you are about to brief someone, so the unit of work is a ticket rather than a file. Every step is recorded, and that record is what makes leaving the agents alone a decision you can defend.
Sign in to GitHub — Alicorn is available to 8seneca collaborators
macOS today. Agents run under your own subscription — Alicorn never holds a model key.
Developer · Claude Opus · isolated git worktree
Reviewer · Claude Sonnet — refused on the author's model
QA · Claude Sonnet — never reads the implementation it is testing
Merge feat/PAY‑3021 into main?
Gated because merging is irreversible — a hard stop never retires, whatever the track record says.
An illustration of one ticket, not a screenshot.
Four constraints, and nothing ships that breaks one.
Agents made writing code cheap. They did not make accepting it cheap, and a reviewer who receives a finished diff with no decision trail has to reconstruct intent from the ticket and the code. That is missing information, not missing intelligence — so Alicorn is built around four working constraints rather than around a better prompt.
Context efficiency
State belongs on disk, not in a context window. Quality degrades somewhere around 300–400k tokens, so the ceiling binds well before the window is full: cross it and Alicorn offers to split the task instead of letting the session drift.
Token efficiency
A team of agents costs roughly an order of magnitude more than one agent, so one agent is the default and stays the default. The public figure for multi-agent — roughly 90% better results for roughly 15× the tokens — was measured on research tasks, not on shipping features. The meter runs while the agents do.
Quality is a gate, not an opinion
Done is a set of machine-checkable gates authored on the stage, never by the member being judged. A reviewer is refused if it runs on the author's model, and a QA member never reads the implementation it is testing. Blindfold it and it writes tests that match the requirement rather than the bug.
A UI you can drive
One tab per ticket, with its status and running cost on the tab itself. You see where six pieces of work stand without opening any of them. The terminal is still there, one keystroke away in the sidebar.
Set it up once, then let the ticket move itself.
You name the members and draw the process. After that a column change dispatches whoever owns the next stage, findings go straight back to the author, and you are pulled in only where the policy says a human is required.
Members
A member is a role bound to an agent backend, a model, a skill set, a permission mode and a workspace kind. Your space starts with three — Developer on Claude Opus, Reviewer and QA on Claude Sonnet — and you edit them under Agents › Members.
Workflow
Stages, who owns each one, and what triggers the next, bound to your board columns: one model, two views. Moving a ticket into a column starts that member. The return edge is first class, so a failed review goes back to the author with no human carrying the message.
Gates
A gate is a property of every hand-off rather than a box on the canvas, so a workflow cannot be drawn without one. Whether a step gates is decided by blast radius — how reversible it is and what inherits it — both authored on the stage, never inferred.
Ledger
Every step is recorded to an append-only ledger: what ran, what verified it, what it touched and what you decided. That record is what earns autonomy, and it is the same data the pull request body is written from.
A gate retires when the evidence says so, and not before
Every stage starts gated. It climbs only on its own measured record, one rejection drops it a level immediately, and no record at all retires a merge or a deploy.
| Level | What it does | Earned at |
|---|---|---|
| 0 · Observed | Always gates, and records the decision it would have made | where every stage starts |
| 1 · Advisory | Still gates, but pre-fills a recommendation and measures your agreement | 10 runs |
| 2 · Conditional | Runs on its own when the checks pass and it stays inside its budget | 20 runs, 0.90 accepted |
| 3 · Autonomous | Notifies you instead of blocking you | 50 runs, 0.95 accepted, no amendment in 20 |
Which hand-offs stop for you
Nothing gates because it is important, or because it is early. A step gates when it is hard to reverse, or when everything after it inherits the result. That is why Spec can earn its way out and Architecture cannot.
What you get on the first run.
Your own private space
Sign in with your work Google account and the space is yours. There are no organisations to be added to and nothing to configure — signing in is the whole setup.
Three members, ready to run
Developer on Claude Opus, Reviewer and QA on Claude Sonnet. Edit them, add your own, or point one at another provider under Settings › Accounts.
A workflow to start from
Feature delivery ships with the product — Spec, Architecture, Build, Review, Verify, Merge, Deploy — with the correction edges back to Build already drawn, and Merge and Deploy already marked irreversible.
The board drives itself
Move a ticket into a column bound to a member and that member starts. One switch in the sidebar turns all of it off, and nothing new is dispatched until you turn it back on.
A worktree per task
Every task gets its own git worktree, so three attempts at the same bug can run at once and nothing reaches your main branch until you approve the merge.
The meter, while it runs
Cost is attributed per run and rolled up onto the tab. Claude Code and Codex are priced; a backend with no price shows a dash rather than a guess.
Your setup travels as JSON
alicorn config export writes your members, workflows and review policy to a
file — never a key. A teammate imports it, sees a plan of what would change, and
applies it when happy.
It updates itself
New builds arrive through the control plane's authenticated update feed, so the app stays current without anyone passing round a download link.
Three steps to your first ticket.
Nothing runs unattended on day one. Every stage starts gated, and autonomy is earned per member, per stage, from a record you can read.
Have Claude Code ready
Open a terminal and run claude. If that fails, sign in first. You also need
git.
Download and sign in
Install the app, then press Continue with Google. Until you are signed in the sign-in page is the whole window — and signing in gives you your own space.
New project, new task
Add a repository — clone one from a git URL, or point at a folder already on this machine — then open a task and type what you want done.
Download Alicorn
No email form and no card. Alicorn is distributed to 8seneca collaborators through GitHub, so the only thing you need is your GitHub login.
Sign in to GitHub — Alicorn is available to 8seneca collaborators
The macOS build is not signed yet, so the first launch may be refused. Open System Settings › Privacy & Security and choose Open Anyway.
The expensive work never leaves your machine.
Most of what worries a security review is removed by construction here: execution is on the client, and the control plane stores decisions rather than code.
It runs on your Mac
Agents run locally, in your own checkouts, under your own accounts. Alicorn never hosts inference, so there is no shared runner your source passes through.
No model key, ever
Every agent authenticates with your own subscription. A key for another provider is encrypted on the machine that uses it and is never uploaded; a machine with no keychain is refused rather than storing one in the clear.
One private space per person
There are no organisations and no shared projects. Every row carries the space it belongs to and the boundary is enforced by row-level security in the database, not by an application filter a bad query could skip.
A trail nothing can rewrite
The ledger is append-only and exactly-once — duplicate deliveries are absorbed and timestamps are assigned by the server. A ledger that double-counts would be worse than none, because the autonomy policy reads from it.