Runs entirely on your machine 🧾 Full audit trail v0.1.0 · active development

One model does.
Another checks.
You approve.

Gang of 8 is a local, human-governed coordinator for multiple LLMs. It routes each request to the smallest council that fits — one lead with specialists on demand, a full panel of independent takes, a blind best-of-N tournament, or a build team whose members own different parts of a larger job. Whichever route runs, a model that did not author the result reads it before delivery. Models produce text only; the coordinator owns every file, command, and approval.

Convene the council → How /goal works
Local CLI seats, own auth Offline mock backend Loopback-only by default
The Gang of 8 — the human coordinator flanked by the council: Claude, GPT/Codex, Gemini, DeepSeek, GLM, Kimi, and Qwen
The bench — seven seats, right-sized per run claude · codex · gemini · deepseek · glm · qwen · kimi
Seven available seats — enable, disable, remap, and model-pin each in Settings
you coordinator claude local CLI codex local CLI gemini local CLI DeepSeek OpenRouter GLM OpenRouter Qwen OpenRouter Kimi OpenRouter

New runs snapshot the enabled roster. No seat is special — any enabled model can lead, author, or check, and roles redistribute automatically across whatever is switched on, so turning a seat off hands its work to the others instead of dropping it. An authoring role never inherits onto the lead's own seat while another seat is live: delegation only buys a second opinion if a different model answers.

Routing · two collaboration modes

A council sized to the task.
A build team when work divides.

A router reads each request and picks the smallest shape that fits — because seven models rewriting the same file seven times is not collaboration, and neither is one model marking its own homework. Whatever it picks, a second model checks the result.

any normal prompt

Ordinary task — the panel

Best for questions, research, reviews, designs, and bounded deliverables.

  • focused — one lead with specialists pulled in only when needed. The default.
  • council — every enabled seat writes an independent take, then explicit synthesis.
  • best-of-N — each seat attempts one complete candidate, and they are compared blindly. A web file that crashes is disqualified before judging; when the deliverable is a binary, the real test is the build, so a winner whose build fails is replaced by the next candidate rather than repaired on the spot.
  • An independent seat reads the result before it ships, on all three.
  • Council and best-of-N cost a multiple of focused — every seat writes a whole answer and all but one is discarded — so they sit behind an Advanced opt-in in the composer.
  • Delivered through a governed promote approval.
/goal <objective>

Build-team goal — owned packages

Best for multi-file builds, overhauls, and long objectives.

  • The architect creates owned work packages with dependencies.
  • One named model owns each package and its output paths.
  • Contract-linked packages start together; only hard artifact dependencies wait.
  • Shared staging feeds completed files downstream.
  • One aggregate diff, one Approve final batch decision.
Ordinary taskBuild-team goal
Start it withAny normal prompt/goal <objective>
Council behaviorRouted: one lead, a full panel, or a blind tournamentThe architect creates owned work packages with dependencies
Model ownershipRoles redistribute across whatever is enabledOne named model owns each package and its output paths
ConcurrencyPanel calls, smoke checks, and judge waves in parallelContract-linked packages start together; hard artifact dependencies wait
Independent checkMandatory on every route — a seat that did not author it reads the result before delivery
IntegrationBlind best-of-N plus a strong finishing/chair passShared staging makes completed package files available downstream
DeliveryA governed promote action for the sessionOne aggregate diff and one Approve final batch decision

This distinction preserves the reason for using several models: a tournament is useful when several independent answers improve selection; a build team is useful when models contribute different pieces instead of rewriting the same file. The roster serves the task — measured runs showed a full council burning hundreds of calls on seam defects the extra seats introduced, so the default is lean and grows only when the work earns it.

How an ordinary task works

Routed, authored, verified.
Then checked by someone else.

The roster serves the task, not the other way round. A lean default grows into a full panel when the work earns it, and scheduling routes around seats that are out of quota, logged out, or missing rather than burning attempts on them.

Read the request, pick the shape

A model reads what you actually asked for — a request to "compile a PDF" is a book, not a build script — and the router picks a lead, a full panel, or a blind tournament. Panel seats work independently so the first answer doesn't anchor the others.

Real work, governed

Seats emit plain text — ARTIFACT, EDIT, BUILD, PROMOTE — and the coordinator parses, authorizes, and executes it. Reads, searches, and web lookups resolve through the same governed skill layer.

Deterministic gates decide

A headless smoke check disqualifies crashing files, and interactive HTML must survive a real browser before it counts. Prose is never proof: a task that promised a file fails unless the file exists and was actually written. In a tournament, blind judges then score anonymous candidates.

A second model checks, you approve

A seat that did not author the result reads it before delivery — the file for a build, the composed answer for a question. A FAIL must be confirmed by a second, different seat before it can refuse delivery. The output stays in council space until promote is approved.

Deliberation proceeds in bounded round blocks — after the consent interval the app asks you whether to continue, run more rounds, or compose from work already done. Agent-call, wall-clock, delegation-depth, and fan-out budgets remain hard limits. A seat that stalls or answers with an announcement instead of the work is escalated to a different model, not asked the same question twice.

How a build-team goal works

One owner per piece.
One release decision.

Enter /goal in the dashboard composer for work that should be divided among the council.

dashboard composer 
/goal Overhaul the application in C:\Projects\ExampleApp. Split the work into
owned frontend, backend, persistence, test, performance, and documentation
packages. Preserve current behavior and deliver the verified result back to
C:\Projects\ExampleApp.
1

The architect creates a package graph

Each package gets one enabled model owner, exclusive output paths, an interface contract, and acceptance checks. Hard AFTER/REQUIRES edges wait for verified file bytes; a CONTRACTS edge hands the owner the upstream API immediately and never blocks scheduling. Cyclic hard-dependency plans are rejected.

One file is authored by one owner, end to end — splitting authorship of a single file across models puts a defect on every seam. But that cap is about authorship, not the work: when the deliverable carries a large body of content, the architect adds research packages that gather it in parallel across every enabled seat. They output data only, never a fragment of the artifact, so there is no interface for two owners to disagree about — and the seats that would otherwise sit idle do the part that genuinely parallelizes.

2

The source is copied into private staging

Each goal gets a persistent overlay at data/goal-workspaces/<goal-id>/stage/. Generated and vendor trees (.git, node_modules, caches, dist…) are skipped. The real project stays read-only during package work.

3

Owners build distinct pieces in parallel

A broad plan puts most or all enabled owners into the first execution wave. The owner writes its declared artifacts directly — a lead model does not silently rewrite them. A missing output earns the same owner one focused retry. Completed files are hashed into shared staging for downstream owners.

4

Packages are verified before release

A package cannot complete with a malformed contract, an absent or empty required file, an unexpected dependency change, or a failed acceptance check. Repair loops are bounded — a failure is recorded honestly, and the goal pauses with staging intact for inspection and resume.

5

The entire goal is released once

No per-file promotion approvals. One release session shows one aggregate diff and two decisions. Approval runs a fresh preflight against the existence/hash baseline, prepares replacements and backups first, and surfaces target drift, locked files, and rollback failures rather than hiding them.

🔒 Approve final batch · Deny — a rollback-protected multi-file transaction
Governed skills & approvals

Work happens freely.
Delivery never does.

Models do not receive unrestricted shell or filesystem access. They request named actions, which Gang of 8 validates and executes.

SkillPurposeApproval
read_file · search_project · list_dirRead and search allowed spacesno approval
web_search · web_fetchRetrieve current public informationno approval
git_snapshotInspect branch, HEAD, and working-tree status without fetching or mutating Gitno approval
write_file · edit_file · stageAuthor and stage work in council spacesno approval
run_testsBounded verification in a council spacestatic auto · functional gated
install_depsFetch the third-party packages a build imports, into this session onlyapproval required
build_artifactRun a declared command to produce a binary deliverableapproval required
promoteCopy an ordinary session artifact to the real destinationapproval required
promote_batchRelease a goal's complete verified manifestone final-batch approval
🗂️

Four intentionally different spaces

Disposable session sandbox → registered active workspace → persistent goal staging → your real project. Models write freely in council spaces; the established/delivery folder needs human approval, always.

🧭

Paths can't escape

Paths resolve inside their selected root — absolute-path tricks and .. traversal are rejected. "Read from A, save to B" keeps roots separate, so a source is never overwritten just because it was read.

🏠

Local-only by design

Binds to loopback and rejects non-local requests. Remote serving requires both --allow-remote and GANGOF8_ALLOW_REMOTE=1 — and revealing a key or opening a local file still requires a loopback request.

📝

Models only ever type

No agent writes a file, runs a command, or opens a path. They emit plain-text contracts — ARTIFACT, EDIT, BUILD, PROMOTE — which are parsed, checked against a default-deny permission catalogue, and only then executed by the coordinator.

✅

Nothing ships unchecked

A headless smoke check, then a real browser for interactive HTML, then a model that did not write it reads the result. Deterministic gates decide; models only author and repair. A refusal needs two different seats to agree — one bad review can't veto a good build.

🧾

Never asked twice

Installing a package is the one action that fetches and runs code from the network, so it is always approved by you. Before the card is raised the coordinator reads what the build interpreter can already import and drops anything present — a request that is entirely satisfied never interrupts you at all.

⏱️

Silence is cut off, work isn't

A model that streams for half an hour is working; a connection that has produced nothing for three minutes is dead. The cutoff measures silence, not elapsed time, so a long productive author is never killed on a guess while a hung seat stops costing you wall clock.

🔎

Research, or recall — never both

Governed web_search is Google Search grounding, so it needs a Gemini key; without one it is enabled, permitted, and inert. A run that asked for research and performed no lookup says so in its result: the content is the models' own recall, unverified against sources. Unverified recall is a legitimate answer — passing it off as research is not.

📦

A PDF has to be built

Seats emit text, so a file merely named .pdf is prose wearing an extension. A binary deliverable counts only when an approved BUILD actually produced it — and a build that exits clean without writing what it declared is a failure, reported as one.

Timeouts, failures, and recovery

Failures are recorded.
Never dressed up as success.

Slow, high-value authoring gets more time than a quick specialist call — a 900-second panel-authoring floor, 600-second lead and codifier timeouts, raisable per seat.

  • An unavailable local login is detected before a CLI-backed run and recorded as degraded council health.
  • A seat that hits a hard timeout is dropped for that round — the council continues on the remaining evidence.
  • A missing build artifact gets one focused retry from its owner; repair loops re-run verification and stay bounded.
  • Exhausted recovery does not report success.
  • Worker leases stop late background workers from overwriting newer authoritative state.
  • After a restart, orphaned sessions are cancelled and active goals are parked as paused — never left fake-running.
  • Every model call, contribution, drop, skill request, approval, and recovery event lands in an append-only JSONL audit trail beside SQLite session state.
  • A timed-out panel seat is not silently replaced — the degraded roster is reported.
Installation

Python 3.12, a browser,
and the CLIs you already have.

pyproject.toml is the dependency source of truth — no separate requirements.txt. Model CLIs authenticate themselves; an OpenRouter key unlocks the four optional API seats.

install — PowerShell 
py -3.12 -m venv .venv
.\.venv\Scripts\python.exe -m pip install --upgrade pip
.\.venv\Scripts\python.exe -m pip install -e .

# working on the codebase? add dev deps:
.\.venv\Scripts\python.exe -m pip install -e ".[dev]"
run — real agents or offline mock 
# real agents:
.\.venv\Scripts\python.exe cli.py serve --backend cli

# free, deterministic offline smoke run:
.\.venv\Scripts\python.exe cli.py serve --backend mock

# dashboard:
http://127.0.0.1:8790/

First-run checklist

  1. Open Settings and select the cli backend.
  2. Confirm Claude, Codex, and Gemini availability; install/authenticate any missing CLI you intend to use.
  3. Add an OpenRouter key and enable the four optional API seats for the full seven-model council.
  4. Review model pins, role assignments, and per-seat timeouts.
  5. Register an active workspace if new tasks should default to a project folder.
  6. Start with an ordinary question to verify the council — then use /goal for work that should be decomposed into owned packages.

Windows launchers ship in the repo: Launch Gang of 8.bat · Launch Gang of 8 (no window).vbs · Stop Gang of 8.bat — and Invoke-RestMethod http://127.0.0.1:8790/health checks the service headlessly.

CLI & HTTP API

The dashboard has no private powers.

Everything runs on the same FastAPI surface available to local automation — OpenAPI docs at /docs while the app is running.

submit & poll an ordinary task 
$body = @{
  text = "Assess the current application architecture"
  source = "automation"
  background = $true
} | ConvertTo-Json

$run = Invoke-RestMethod -Method Post `
  -Uri http://127.0.0.1:8790/tasks `
  -ContentType application/json -Body $body

Invoke-RestMethod "http://127.0.0.1:8790/sessions/$($run.session_id)"
the same surface, from the CLI 
python cli.py submit "Review this architecture" --backend cli
python cli.py pending
python cli.py approve <session-id> <approval-id>
python cli.py workspace add my-project C:\Projects\MyProject

# goals: POST /goals · GET /goals/{id} · resume · cancel
# settings, seats, api-keys, workspaces — all HTTP routes
Known boundaries

Honest by design.

The audit trail, execution checks, dissent, and approval gates make errors more visible — they do not remove the need for human judgment.

  • Multi-model output is not automatically correct — the gates make errors visible, not impossible.
  • External CLIs and APIs can fail, hang, rate-limit, change model identifiers, or require renewed authentication.
  • A build-team goal is only as good as its package decomposition, contracts, and acceptance checks — review the generated package graph on important work.
  • Rollback protection cannot guarantee atomic replacement across multiple ordinary filesystem files — drift and failures are surfaced, not hidden.
  • It is a single-user desktop service, not a hosted multi-tenant system.
Gang of 8 · v0.1.0

Stop trusting one model's blind spots.

The diversity of a council, the accountability of named owners, and the receipts of an audit trail — running entirely on your desk, behind your approval.

Convene your council → Compare the two modes