नेता · Hindi: leader

You talk to a leader.
It runs the team.

Neta delegates work to tiered worker agents and drives them until the problem is done. The leader never edits files — that restriction is enforced by your CLI's own machinery, not suggested in a prompt.

And it owns no session UI. You stay in Claude Code, Codex or OpenCode — the UI you already use and pay for. Neta injects instructions, tools and restrictions, then gets out of the way; the one surface it draws is the per-worker watch pane.

MIT one bundled file no runtime deps node 22.19+
$ npm install -g @intervene/neta
$ cd your-repo && neta
launching claude as leader · read-only enforced
the signup flow drops 4% of users at the email
step. find out why and fix it.
● neta_spawn scout/architect ×2
● neta_wait ro1 ro2
» ro1: the token expires before the mail provider
retries
● neta_spawn worker/expert --writer
● neta_spawn reviewer/expert
fixed, reviewed, committed as 4a9f2c1
4 workers · 61,204 tokens · est. $0.38
01

A lead, not an implementer

The leader reads, decides, delegates and verifies. Its edit tools are removed by the vendor's own permission system, and shell writes are blocked too — a leader with a way to edit eventually edits.

02

One writer per session

Reads parallelize; writes serialize. Each session has a single writer slot: a second writer is queued, not raced, and starts when the slot frees. A writer is told to commit everything before handing off, and a dirty handoff is called out loudly in its result.

03

Enforcement over instruction

Every restriction that matters is a mechanism: a permission rule, a hook, a kernel sandbox, a protocol rejection. A rule that lives only in a prompt is a suggestion.

04

Finish, then report

A CHARTER.md says which decisions the leader may take on your behalf. Inside that boundary it just does the work. Workers are quiet; only terminal events, blocking questions, and room posts the leader opts into push.

Tiers, not model names

you decide what each one costs
apprentice

The mechanical floor: run a named command and report output, apply one exactly specified small change, or answer one bounded question about a named file.

journeyman

Mechanical work with a precise spec: renames, applying a reviewed diff, running tests and reporting output. It only gets exact instructions.

expert

Well-scoped features, bug fixes with tests, code review.

architect

Ambiguity: unknown-cause debugging, design work, debates.

The leader asks for an apprentice, journeyman, expert or architect worker; you map tiers to backends in settings, and you can mix vendors — putting architect work on Codex while everything else stays on Claude. Unconfigured tiers spread deterministically across whatever you have installed, and reviewers prefer a different vendor than the last writer.

The leader cannot write

enforced by each vendor, not by us
Leader
Typed edit tools
Its shell
Strength
Claude Code
denied by permission rules
neta guard as a PreToolUse hook
denylist
Codex
kernel sandbox
same kernel sandbox, read-only
kernel
OpenCode
permission.edit: deny
bash denied by default; read-only allowlist
allowlist

Codex's is the strongest — the kernel refuses the write. Claude Code relies on Neta's guard, which is a denylist, and a denylist can be incomplete. OpenCode denies bash outright and allows only read-only commands — an allowlist fails closed, but both are weaker than a kernel. That is worth knowing rather than papering over.

Workers you can take over

a pane each, and a door out

A worker is an ordinary session of the CLI that ran it. neta attach rw3 hands the worker's own session id to that CLI's resume command and drops you inside the conversation, where you can read what it did and keep talking to it yourself. Neta drove it; you can finish it.

With Zellij or tmux, each worker also gets a tab streaming its log — prose as markdown, tool calls as one-liners, changes as coloured diffs, and an input line that talks to the worker. Panes read without consuming, so nothing shown there is taken from the leader. Without a multiplexer, workers run headless and nothing else changes.

neta workerswhat is running, and what it has cost
neta watch rw1watch one worker, and type to it
neta attach rw1open it in its own CLI and take over
neta send rw1 <msg>give a running worker more instructions
neta answer rw1 <text>unblock a worker that asked you something
neta kill rw1stop it
neta sessionsleader sessions running on this machine
rw3 auth-refactor · worker/expert · claude · writer
task: sign the session token, tests included
Reading the session layer
Two call sites set the cookie directly, so the
token is signed in session.ts and read back in
the middleware.
● read src/session.ts
● grep "Set-Cookie" src/
src/session.ts
@@ -12,7 +12,9 @@
- res.setHeader("Set-Cookie", raw);
+ const token = sign(payload, secret);
» 41/41 tests pass
running · 18,240 tokens, est. $0.11
commit before you hand off
enter sends to the worker · ctrl+c closes

Backends & playbooks

one ACP path, three vendors

Every worker runs on a login you already have

Claude Codeclaude-agent-acp — its own login
Codexcodex-acp — its own login
OpenCodeopencode acp, native — its own config

Driven over ACP through one internal transport — one code path, not one conditional per vendor. Each worker launches with that CLI's own auth; whether that is a subscription or API credit is that CLI's configuration.

Flavors — playbooks the leader reaches for

implement — Decompose the task, spawn workers by tier, reviewer pass, iterate until clean, PR or merge per charter.
decide — For real tradeoffs: opposing stances assigned to debaters in a room, fixed rounds, a judge pass. The output is a memo that records the losing arguments.
investigate — Parallel scouts map the code or reproduce the bug; one synthesis. Feeds the other two.

Ordinary markdown you can override per project — as are the roles: scout, worker, reviewer, debater.

Working end to end, and young

what is verified, what isn't
Verified
Every vendor mechanism was checked against the installed CLI before being coded.
351 tests drive the real control plane, real worker processes and a real socket.
The published package was installed from its tarball and driven through a full session.
Not verified, and worth knowing
Only Codex workers are sandboxed at the kernel. Elsewhere a determined worker could still write through bash.
No long-running real-model use yet. The honesty rule is mechanized on Claude Code — its own subagent tools are denied — and prompt-level on Codex and OpenCode; no test exercises it against a real model.
Vendor flags change often. That is where breakage will show up first.

Run it in a repo you know

Neta needs Node 22.19+ and at least one agent CLI on PATH. Nothing else to configure — tiers spread themselves across what you have until you say otherwise.

$ npm install -g @intervene/neta
or: bun install -g @intervene/neta
$ neta