The platform

Your org lives in Jira. Your agents can't.

The absence this makes loud: work that exists in two systems and reconciles in neither.

Self-hosting Graphban is free, unlimited, and genuinely complete — for one developer. The platform is what you want when the work stops being just yours: teammates, shared context, and a bridge into the tracker your company already runs on.

Join the waitlist See what's built vs planned ↓
Where self-hosting stops The tracker bridge Why a layer, not a plugin How the hybrid works Governance Built vs planned

The fork

Self-hosting is for one person. That's not a tier — it's the truth about the code.

We're not holding features back to sell you an upgrade. Every mechanism on this site — the grill, the gates, collision clustering, the fleet, the code graph, the learning loop — runs in full when you self-host, with no quotas and no keys. Including multi-agent fleets.

What self-hosting does not have is a way to add a second human. There is no invite flow and no add-member endpoint in the open-source build; a project has one owner and as many agents as that owner mints keys for. That is a real boundary, and it's where the platform starts.

self-host

You and your agents

Everything the tool does, on your machine, unlimited and offline. One human owner, any number of agents. Free, and it stays free.

platform

Your team, and the tracker they already use

Teammates on the same project, shared memory across people, org roles and audit — and the bridge into Linear and Jira so agents can work the tickets your company already files.

The nuance that matters: multi-agent is not the same as multi-human. A solo developer running twelve agents across four worktrees needs nothing from the platform. Two developers sharing one backlog do.

The headline in progress

An agent-facing layer on top of the tracker you already have.

Nobody is migrating off Jira because their agents find it awkward. So the plan is not to replace your tracker — it's to sit on top of it. Your tickets stay where your PM, your stakeholders and your reporting already live. Graphban becomes the surface your agents actually operate.

Trackers such as Linear, Jira and GitHub mirror into a Graphban cloud hub, which serves agents and developers and writes a constrained set of changes back. Linear in progress — first integration Jira planned — after Linear GitHub Issues inbound works today the tracker stays the source of record Graphban Cloud mirrors the tickets · owns claims, clusters and memory the agent-facing layer writes back a constrained set: status, links, comments agent · worktree A agent · worktree B you, in the web UI your agents talk to one surface; your company keeps the system it already reports out of.
Hub and spoke, with authority pointing outward. The tracker is authoritative; Graphban mirrors it read-heavy and writes back only a constrained set. Full bidirectional custom-field sync is explicitly not the plan.

Status, plainly: Linear is in progress. The adapter is built: OAuth, a read-heavy mirror with webhooks, and constrained write-back of status, comments and assignee, along with tracker links that record which system holds authority, and a per-developer pull of assigned issues from the hub mirror. It is not yet connectable from the app and has not been walked against a real workspace, so it does not ship yet. Jira is second. Today the only part of this section you can use is inbound GitHub issues.

The argument

Why a layer, and not a Jira plugin.

You could point an agent straight at a Jira MCP server today. It would read tickets and write comments, and it would be missing everything that makes agent work safe.

A ticket list has no collision model

Jira has no idea which files a ticket touches, so it cannot partition work between four agents. Touch-areas, clusters and reservations have nowhere to live in a tracker built for humans reading top to bottom.

Nothing enforces who reviewed what

A tracker will happily let the account that did the work move it to Done. The self-review ban, the independence ladder and the sabotage receipt need an authority that knows about agents as principals.

Tickets aren't specs

The grill, the frozen baseline and the completeness pass all operate on intent that has been sharpened and frozen. A ticket description is neither.

Memory and the code graph have no home

Lessons, described code, presence and the audit ledger are agent-native structures. They don't map onto issue fields, and shoehorning them there is how you get a custom-field swamp nobody maintains.

So the split is deliberate: your tracker keeps being the system of record for the business, and Graphban is the system of record for the work. Tickets flow in, status and links flow back, and everything agents need that a tracker was never going to model lives in between.

How it works shipped

Your code never has to leave your machine.

The link between a local instance and the hub already exists and already works. Your agents keep talking to the local endpoint; only what's genuinely contended goes up. What stays on the machine, and what linking to an org adds, is going further.

On a linked instance the code graph stays local and authoritative, while items, claims and memory are forwarded to the cloud hub. your machine the code graph — built here, authoritative here described from a repo only you have stays local · push it deliberately, or never your agents → local /api/mcp one endpoint, whether you're linked or not unlinked, nothing is forwarded — a pure local tool forwarded the hub items · claims · clusters · memory contended state needs one authority org roster · audit ledger · quotas and, later, the tracker bridge applies its own authz, metering and audit two developers on two machines can each keep their own code graph private and still share one backlog.
Code-graph tools run locally; everything mutable and contended is forwarded. There's a never-sync privacy flag, an incremental resumable push, a portable export bundle, and a purge — all driven from the CLI.

Governance private beta

The part your security review asks about.

BYOK

Your model keys, encrypted at rest

Chat and extraction providers are per-project and resolved from your own credentials. We don't meter token cost, because we aren't buying your tokens.

audit

Every mutation on the record

One append-only row per accepted change, naming the key or user — and for agent actions, the human principal behind the key. "What did my agents do last night" is a query, not an investigation.

tenancy

Orgs, roles and seats

Owner/member roles, emailed single-use invites bound to an address and time-bounded, and a project-access model that a key can never out-rank.

quotas

Counters, not token bills

A plan is a set of counters — projects, seats, memory shards, metered calls per month. Public surfaces like the feedback intake and public roadmap are never metered, on any tier.

Honestly

Built, in beta, or planned.

A roadmap that reads like a feature list is exactly the failure the rest of this site is about. So every row says which it is. Accurate as of 2026-11-10.

CapabilityStatus
The tool itself
Tracker, PRDs, grill, gates, code graph, memory, learning loopshipped self-host and hosted
Rules — six strengths, and an unloaded pack is not offshipped self-host and hosted
Specs library — the PRD, its preamble, and the design-set documentsshipped self-host and hosted
Design sets — compiled prompts, canvases, findings that stay open until the canvas passesshipped self-host and hosted
Guided setup — checklist, setup-status card, one-time tourshipped self-host and hosted
Fleet roles, collision clustering, review pool, enrolment seatsshipped self-host and hosted
Local fleet supervisor — spawns a child per seat, reaps it, orphan sweepshipped separate graphban-fleet package
Seven fleet harnesses — Claude Code, Cursor, Grok, Gemini, DeepSeek, Qwen, local modelsshipped Codex connects over MCP; no fleet adapter
Review-only seats; branches published at review; opt-in auto-merge after sign-offshipped fleet supervisor
Capability matrix and harness mix — models graded per function set from real sign-offsshipped self-host and hosted
Harness capacity — entitlements, a subscription hierarchy, a spend forecastshipped self-host and hosted
Outposts — fleet machines on macOS, Linux and Windowsshipped
Stack view — derived architecture map with a code-health overlayshipped self-host and hosted
Stack health: dead-code and test-result categoriesshipped 2026.10.11 · self-host and hosted
Decider — a System One model that adjudicates memory candidatesshipped opt-in per project · needs a decider provider
Live, Activity, Usage, and OTLP log exportshipped self-host and hosted
Feedback Kit — public boards, votes, roadmap, ingest APIshipped self-host and hosted
gbfleet until — planner loop around the wave; takeover adopts live childrenshipped self-host
Playbook pack — GET /api/playbooks, applied with gban updateshipped self-host and hosted
Native install — launchd / systemd, no Dockershipped self-host
Git delivery contract — agents are told the base branch, or that it is unmeasuredshipped self-host and hosted · the server never touches git
Teams
Adding a second human to a projecthosted only no self-host path exists
Organizations, roles, emailed single-use invites, seatsprivate beta
Plans, quotas, operator consoleprivate beta
Cloud hub for linked local instancesprivate beta
The tracker bridge
Inbound GitHub issues → work items (HMAC webhook, routed by repo)shipped
Outbound: opening real GitHub issuesnot built the endpoint is a stub
Linear sync — mirror in, constrained write-backin progress adapter built, not yet connectable
Tracker links and authority; per-developer pull of assigned issuesin progress built, ships with Linear
Jira syncplanned after Linear
Full two-way custom-field syncnot planned deliberately out of scope
Other sync that already works
PRD ↔ markdown folder (put it in Google Drive Desktop, no OAuth)shipped
Local → cloud code-graph push, incremental and resumableshipped

Known gaps in what has shipped

  • half-run The native install is fully walked on macOS only. On Linux the systemd unit itself was verified; a privileged install, and upgrade, rollback and uninstall on Linux, have not been run.docs/acceptance-prd27.md
  • half-run 19 of the living graph's 22 acceptance steps are measured. The rest need things an agent cannot provision for itself, such as a second human's agent on a second account.docs/acceptance-prd20.md
  • partial Revoking a seat has no push channel. A child finds out on its next server call, or the supervisor notices once the agent reads offline. Instant it is not.GRPH-452
  • filed Work with no test suite cannot be signed off. Sign-off wants adversarial evidence, which is right for code and impossible for a design document, so that work reaches review and no further. Whether to allow a waiver is an open decision.GRPH-P23 §H · GRPH-1059
  • by design The server never touches git. It tells agents the delivery contract. Pushing branches, opening PRs and the opt-in merge are the local fleet supervisor's job, on your machine.

If a row you need says planned, that's the most useful thing you can tell us on the waitlist — it's how the order gets decided.

← the argumentSilence is not a pass Technical reference ↑ the mechanisms →Spec → done

What's new

latest 2026-11-10
run

The playbook pack, applied with gban update

A deployment publishes the playbook pack at GET /api/playbooks. gban update applies that pack to the checkout. The fleet supervisor still holds no authority of its own.

fleet

Harness capacity is a routing mode beside the grades

Cheap or frontier still comes from measured sign-offs, and a cell under five samples stays unmeasured. The Harness Capacity tab is the other mode: entitlements, a subscription hierarchy you set, and a forecast of spend. A routing verdict the router never recorded is null, with a note. It is not zero.

run

First run is a checklist, not an empty form

After the stack starts, first run is a checklist, a setup-status card that stays until the first job is proven, and a one-time tour. Finish later with no project and the shell keeps the setup chip. It does not drop you into an empty create form.

run

Specs is a library, and a canvas finding stays open

The Specs list is the PRD, its preamble, and the design-set documents, plus the folder they sync to. search_docs searches baselined PRD bodies; drafts and design rows stay out until the call opts in. A design set compiles a prompt, stores the canvas, and can file a finding with a canvas check. That finding stays open until the bound canvas for the latest compiled prompt passes it.

honesty

An unloaded rule pack is not off

Build → Rules draws each rule at a strength: enforced, checked, external, advisory, unmeasured, or not used. library_loaded: false means no pack is loaded. It does not mean every rule is off, and it does not mean nothing was adopted. Turning a rule on or off is a person's REST action. get_rule_toggles has no MCP write.

run

The tracker board has a Blocked column

The tracker defaults to a board. The columns are Backlog, Next, In progress, Review, Blocked, and Done. Blocked sits beside Review, so a card that cannot move is its own column.

graph

Dead code and test results join the Stack overlay

Two new code-health categories on every component. Dead code reads vulture, knip and ts-prune. Tests reads pytest, vitest, jest or any JUnit report, with passed, failed and skipped counts, and each failing test becomes a finding you can Defrag into a card. A run that executed zero tests is recorded as a finding, not a pass, and a suite that hasn't run at the current commit shows as stale or never run.

graph

The Stack view: an architecture map nobody has to draw

Build → Stack maps the running system from the topology the API reports: your deployables grouped by host, the infrastructure you run, and the external services you depend on, in three nested rings. A code-health overlay records scan findings per component and colours each box by its worst severity. A box that was never scanned reads as never scanned, not as clean.

graph

The code graph groups by area

Nodes now cluster by area and draw their kind as their shape, so the map reads at a glance before you open a single label.

fleet

Gemini and DeepSeek join the fleet

Two new named adapters, agy for Google's Antigravity CLI and dsh for DeepSeek, bring the fleet to seven harnesses alongside Claude Code, Cursor, Grok, Qwen Code and local models through gbagent. Each is version-checked before a child starts. Codex still connects over MCP but has no fleet adapter.

honesty

Hand-merged work can be closed without faking a sign-off

Work merged outside the fleet used to sit open forever, or get a sign-off it never had. A project owner can now close it as merged, and the record says that is what happened.

honesty

A check that did not run is not a pass

Sign-off now refuses evidence that denies an acceptance clause, counts only the reviewer's own tests, and treats a skipped check as missing rather than green. A refusal names the word it matched and the rule behind it.

memory

The decider sorts the memory queue

A project can opt in to a fast System One model that grades each memory candidate: grounded, ready, and whether it contradicts a published lesson. Thresholds are calibrated against human decisions, the uncertain middle stays with a person, and a decider that cannot answer says so on the page.

fleet

Review-only seats, and branches published at review

A review-only seat can review but never build, so a reviewer cannot quietly take a slice. When a card reaches review the supervisor pushes its branch and opens a draft PR, one card per PR. With --merge it enables auto-merge after sign-off; without it, a person merges.

run

Usage, Activity and OTLP log export

A deployment-wide Usage page with model usage, an Activity view rebuilt around lenses and facets, and log export over OTLP to the observability stack you already run.

run

The app, reorganised: Plan, Build, Observe

The redesign groups every surface into three sections: Plan (tracker, requests, PRDs, roadmap), Build (code graph, stack, MCP tools, fleet, outposts) and Observe (memory review, lessons, activity, live, harness). The same in self-host and hosted.

run

Feedback Kit: public boards, votes and a roadmap

Collect feedback through an ingest API or the embeddable widget, publish boards people can vote on, and show a public roadmap. Submissions land in triage and become cards.

fleet

Outposts and the harness mix

The Fleet view is rebuilt around a catalog of harnesses, a mix that sets each vendor's share of launches, and outposts: the macOS, Linux and Windows machines your fleets run on.

fleet

A capability matrix built from real sign-offs

Models are graded per function set from reviewed work and probes, learned across users. Ask for a tier and the resolver picks from what has been measured. A cell with under five samples says unmeasured instead of guessing.

honesty

Done cannot be minted at the door

Two ways around the completion gate existed: create an item already marked done, or release a claimed one into done. Both now refuse. Signing work off still requires an attestation — the status is not a field you get to set because the form accepted it.

honesty

Agents are told the git process, or told it is unmeasured

Nothing used to name a base branch, so agents opened PRs against main because that is what models do. The org — or the local project — now stores a sparse delivery contract: base branch, whether they may push to it, optional naming. get_context returns it. An unset field stays unmeasured, not a silent main. Graphban still does not open PRs, merge, or rebase.

fleet

until is a planner loop, not a thicker supervisor

gbfleet up is still one wave: spawn, wait, reap. until sits around it — keep going while there is work, spawn reviewers when review appears, and on restart adopt the children that are already running rather than launching a second set beside them. The supervisor still holds no authority of its own.

fleet

A wait for a human is a blocked item

When an agent needs a person, that wait is a blocked item on the same tracker rather than a side channel nobody will look at. The work stays visible, and the reason is on the record.

memory

A published lesson that nobody retrieved is a miss

Observe now has a Lessons catalog. Reach and outcomes are computed rather than assumed, and publishing something the next agent never found is recorded as a miss — not as a silent success that looks like the lesson landed.

run

Install without Docker, as a system service

Compose is still the default. A Mac or Linux box can now run Graphban as launchd or systemd, with one CLI for install, upgrade and uninstall. Postgres with pgvector is required and verified, never installed for you. There is no .app.

fleet

The caller picks the model a child runs

Every spawned child used to run whatever its vendor CLI defaulted to, with no way to say otherwise — the cost lever the whole fleet idea rests on, missing. The supervisor now passes a model through, along with the two knobs one vendor each exposes. Pass-through, not selection: the supervisor still does not choose models on your behalf, and a knob the chosen vendor does not have is refused rather than quietly ignored.

graph

The living graph answers back

Hubs, shortest path and two-hop reach reach the UI rather than staying in the API. Paths say which way each edge points, and the whole graph is one tab stop — arrows move real focus, so it is navigable without a mouse.

honesty

The reference docs cannot silently fall behind

Three documents presented themselves as complete inventories and were not: the API reference covered 87 of 160 routes, configuration 19 of 51 settings, the data model 15 of 48 tables. A ratchet now records the known gap and fails on any new one, in both directions — documenting something and leaving it listed as missing fails too.

fleet

The fleet supervisor

gbfleet runs one wave: a child per seat, spawned in its own worktree, waited on, reaped. It is a separate distribution that depends on httpx and nothing else, and it holds no authority of its own — it can only launch a process holding a seat the server issued. Delete it and every invariant still holds; the fleet just needs a human to open terminals again.

fleet

Vendor adapters, named and version-checked

claude, cursor-agent, grok and codex, each resolved by name rather than guessed at, with the supported version asserted before a child is spawned. The credential is written to the child's config file and never to argv, because argv is world-readable on a shared box.

fleet

Mint, list and retire became one capability

A planner can retire the seats it minted and only those, scoped by minted_by. Ending a wave expires seats, never credentials — no client config is touched and nothing has to reconnect.

proof

The supervisor walk, run against a real server

Sixteen steps passed, one is blocked on a decision rather than a budget, and it found nothing in the supervisor. The walk refuses to run unless pointed at a real instance and refuses any project it did not create itself — a walk that quietly passed by not running would be the worst possible version of it.

fix

A closed PRD no longer blanks the PRD page

The status map covered three states and the server sends four. One closed PRD threw during render and took the whole list and editor with it. An unrecognised status now costs one oddly-labelled chip instead of a white screen, and a test compares the two lists across the stack.

fix

Linking a request to an item works on a renamed project

Item ids are frozen at issue time while the key you see is rendered from the project's current tag. The link stored the key you sent instead of the id it resolved to, so on any renamed project it violated a foreign key and returned a 500.

Every entry is work that merged. The full history is on GitHub.