Agentic Control

A self-hosted control plane for AI coding agents. One agent plans and reviews, another writes the code, and you approve before anything reaches your repository.

It runs on one Linux server you own, drives the agent CLIs you already pay for (Codex, Claude Code, OpenCode) and gives you a web panel you can use from a laptop or a phone.

Early release. One maintainer, pre-1.0, used daily on one production server. Run it on a server you can rebuild, and keep the backups it makes. On the server the product is still called infra-cod: that is the CLI (sudo infra-cod doctor), the services and the paths.

A 30-second film redrawn from the panel. Watch it with sound.

How a task goes

1. You describe the task, or label a GitHub issue.
2. The orchestrator plans it. For example, Codex reads the repository and writes a plan with acceptance criteria.
3. An executor implements it on a task branch. For example, Claude Code works in a persistent workspace on your server.
4. The orchestrator reviews the result. It checks the actual commit and runs the project's tests. If something is wrong, it sends the work back.
5. You approve, and the platform opens a pull request. If the task came from an issue, the pull request says Closes #N.

Neither agent grades its own work. Every step is recorded with the commit, diff and checks it refers to, so you review evidence instead of a summary.

Pick the team	Work arrives from GitHub	The result is a pull request

A worked example is Focus Timer. The agents built the whole app through this panel, and every change came in as a reviewed pull request, including issues #3, #5 and #7.

What you get

• Agent teams per project. Any supported runtime can be the orchestrator or the executor, with a choice of models.
• GitHub issue intake. Issues are offered only from the repository's owner, members or collaborators, and only when they carry your label. Nothing starts until you press Start.
• Review with evidence. Each review is tied to an exact commit and the executor's checks, so a revision request names what has to change.
• Pull requests from a GitHub App, using short-lived installation tokens.
• Operations built in:
  • signed releases;
  • infra-cod update with automatic rollback;
  • encrypted backups with a restore drill before every update;
  • infra-cod doctor;
  • staged runtime upgrades (qualify → promote → probation).

What it is not

• Not a new agent. The platform does not run its own agent loop or manage the agents' context. It orchestrates the native CLIs.
• Not a hosted service. Your code, workspaces and credentials stay on your server.
• Not multi-tenant yet. Version 1 has one owner per installation.

Requirements

• Ubuntu 24.04 on x86-64, with root access, at least 4 GB RAM, 10 GB free disk and ports 80, 443 and 3100 free.
• Optionally, a domain whose A record points at the server. Without one, the panel uses <server-ip>.sslip.io.
• Your own accounts for the agents you want to use. For example, a ChatGPT plan for Codex, a Claude plan for Claude Code, or a model provider of your choice for OpenCode.

Install

On a clean Ubuntu 24.04 server:

curl -fsSL https://github.com/STpytut/agentic-control/releases/latest/download/get.sh \
  | sudo sh -s -- --email [email protected]

Without --domain, the panel is served at https://<server-ip>.sslip.io. That name resolves to your server's address, so you don't need a DNS record and you still get a real certificate. Add --domain panel.example.com to use your own domain; its A record must point at the server first. To install a specific version, add --version 0.4.0-rc.122. To check the host without changing anything, add --check.

get.sh is the only code that runs before a signature is checked, and it is short enough to read first:

1. It downloads the release.
2. It verifies the minisign signature over SHA256SUMS with the release key written into the script.
3. It checks the tarball's checksum.
4. It runs the installer from inside the verified tarball. The installer verifies the signature again.

git clone --depth 1 --branch <tag> https://github.com/STpytut/agentic-control.git
cd agentic-control
gh release download <tag> --dir /tmp/rel

sudo ./deploy/install.sh \
  --artifact /tmp/rel/infra-cod-<version>-linux-x64.tar.gz \
  --checksums /tmp/rel/SHA256SUMS \
  --signature /tmp/rel/SHA256SUMS.minisig \
  --public-key release/keys/infra-cod-release.pub \
  --acme-email [email protected] [--domain panel.example.com]

The installer is idempotent. It sets up:

• PostgreSQL, Caddy and the pinned Node;
• the systemd units;
• a separate OS user for each agent runtime;
• Codex and Claude Code, at the versions this release is verified with.

The install ends with the panel's address and a single-use password. The panel asks you to change the password when you first sign in.

Then connect your accounts:

What	Where
Codex (ChatGPT)	In the panel, Settings → Connections. First allow it in ChatGPT: Settings → Security → device code authorization for Codex.
Claude Code	In the panel, Settings → Connections: Sign in with Claude, then paste the code it shows.
Antigravity	Optional, an analyst only. Install it (sudo infra-cod runtime install antigravity), then in the panel, Settings → Connections: Sign in with Google (Antigravity) and paste the code within a minute. See docs/ANTIGRAVITY.md.
GitHub	In the panel, Settings → Connections: create the GitHub App and choose the repositories it may use.

To add an agent later, or to see what is ready:

sudo infra-cod runtime install opencode
sudo infra-cod runtime install antigravity
sudo infra-cod runtime list
sudo infra-cod doctor

Updating later takes one command, and a failed update rolls back:

sudo infra-cod update --artifact … --checksums … --signature … \
  --public-key release/keys/infra-cod-release.pub

Security model, in short

• Caddy is the only listener exposed to the network. The panel listens on loopback.
• PostgreSQL is reached over a Unix socket with peer authentication. There is no database password anywhere.
• Agents run as their own OS users, with no access to the database or to each other's credentials. Read-only steps run under a Landlock ruleset.
• Issue text is fenced. The agent receives it as a request to weigh, not as instructions.

You remain responsible for complying with the terms of the AI services whose accounts you connect.

Details are in docs/SECURITY.md and docs/OPERATIONS.md. To report a vulnerability, see SECURITY.md.

Status

The project is pre-1.0 (0.4.0-rc). It is developed and used every day by one person on one server, and it has had more than a hundred release candidates. Releases are signed and updates roll back on failure, but interfaces and defaults still change between release candidates. Use it at your own risk.

Tell us where installing it stopped you. The developer guide, where some design documents are still in Russian, is docs/DEVELOPMENT.md.

Website: https://agenticcontrol.app. Contact: [email protected].

License

GNU AGPL-3.0.

• You can use, change and self-host the platform freely.
• If you offer a modified version to others over a network, you must publish your changes under the same license.

Contributions are accepted under the Contributor License Agreement; see CONTRIBUTING.md. For a commercial license without AGPL obligations, open an issue or contact the maintainer.