Team builds
Work fans out in two shapes. In team work each task goes to one builder in its own lease and worktree, and the lead merges the results one task at a time. In a swarm several read-only lanes look at the same input through different lenses, and a synthesizer merges what they report.
The builder pool
A wave reads ops/roster.toml, leases each task to a builder CLI in its own git worktree, and merges a task only after a pinned reviewer who did not build it approves. The lead then promotes the sprint integration branch to main through a protected-path gate.
The roster decides who does what. Five roles (builder, reviewer, tester, analyst, documenter) each map to a CLI, a model and an effort, with an ordered fallback chain that must end at a core-trio member. The shipped posture has Claude building, Codex reviewing and testing, and Antigravity analyzing and documenting; the roster can override any of it. Optional members carry an enabled flag and are absent everywhere when it is off. The shipped pins put the newest Gemini at its highest thinking level on agy ("Gemini 3.8 Flash (High)" today, the newest every tier can run; D-022, D-060) and grok-4.7-xhigh on Cursor. Model and effort has every pin and how to change it, and at-setup's role step walks keep current, customize or restore the shipped defaults with validated writes.
Every builder runs under a lease. The lead-owned ledger ops/leases.toml (runtime state) tracks each task through its lifecycle, with heartbeat-based orphan detection, a single requeue to a different builder, and escalation when a task can't converge. The pinned reviewer gets at most 3 fix cycles with the builder before the task escalates to you, and an approved task lands as one squash commit of the lead's own snapshot on the sprint integration branch.
Three mechanisms keep this safe, and none of them restricts who may write code:
- Per-task worktrees with lead-side checks. A builder starts in its own worktree and is contracted to stay out of the canonical
ops/tree. The worktree limits where it starts, not where it writes, so the lead detects changes to git state and the ledger and merges only its own collect snapshot. It detects those changes without preventing them, and it does not see a write elsewhere in the main checkout. - A per-adapter environment allowlist. No builder receives another provider's credential environment variables; credential files under
$HOMEare shared. - Mandatory cross-review before any merge. No agent merges its own build.
Four coordination modes
| Mode | Mechanism | When to use |
|---|---|---|
| File-based | Shared markdown in ops/ |
Persistent state across sessions, audit trails |
| Direct invocation | agy -p / codex exec via bash |
Real-time external agent delegation |
| Personas | dispatch_persona runs a personas/ prompt with the tools, model and turn budget its manifest entry sets |
Reviews, research, verification |
| Agent teams | Multi-Claude with shared task lists (team-lead) |
Complex builds with 5+ interdependent tasks |
Wave Orchestration (at-build)
at-build groups the plan's tasks by dependency into waves. Independent tasks within a wave run in parallel, each in its own lease and worktree, and tasks that modify the same files never share a wave. An integration-verifier runs the tests, build and lint between waves. Each task merges after its pinned review as one squash commit, in wave order, and after the check lease_promote takes the result to the main branch through the promotion gate.
Review Swarm (at-review)
at-review starts every lane at once. The two core lanes always run: Antigravity's architecture-reviewer (architecture, design) and Codex's logic_reviewer (logic, security, tests). Every optional member you have enrolled reviews too. The flags add specialist personas: --security, --perf, --simple and --conventions add one each, and --full runs all five, with architecture-strategist as the fifth. learnings-researcher joins when an ops/solutions/ entry names a changed module. A findings-synthesizer then merges and deduplicates every ops/REVIEW_*.md, giving each finding a confidence tier and a priority (P1, P2, P3). Every lane ends its report with a Coverage line. It is self-reported, and a lane that reports less than complete, or omits the line, is a gap the cycle can't converge on. The lead fixes P1 and P2 and logs P3. A cycle that applied a P1 or P2 fix re-reviews the changed files, that review counts against the cap, and the lead escalates to you after 3 cycles without convergence.
Confidence tiering
Every finding gets a confidence score, so nobody spends time on phantom issues:
| Tier | Criteria | Rule |
|---|---|---|
| HIGH | Verified in codebase via grep/read. Deterministic. | Can be any priority |
| MEDIUM | Pattern-aggregated detection. Some false positive risk. | Can be any priority |
| LOW | Requires intent verification. Heuristic-only. | Can never be P1 |
Suppressions
Each reviewer has a "Do Not Flag" list to reduce noise: readability-aiding redundancy, documented thresholds, sufficient test assertions, consistency-only style changes, and issues already addressed in the current diff. Each persona file in personas/ lists its own suppressions.
Deep Research (at-deep-research)
at-deep-research runs five research lenses in parallel before planning: past solutions and decisions, current framework docs for the stack, git history, Antigravity's targeted codebase analysis, and industry practice. research-synthesizer merges them into one research brief that lists contradictions without resolving them, and hands off to at-plan.
The knowledge loop (at-compound)
After a non-trivial problem is solved, at-compound records it in ops/solutions/, or a decision in ops/decisions/, when it clears the counterfactual bar: a future agent without the note would repeat the mistake or work the decision out again. Otherwise it says in one line why it wrote nothing. Before new work is planned, learnings-researcher searches both directories.
