a harness, white papers, an agent event-triggering lab, agent skills, an MCP server, a Rust app, a CLI, an orchestrator, an SDK.
It starts the moment two agents reach for the same file in one repo, and it grows from there — to the whole machine, across the network to fleets you don’t own, and toward a market for agent labor. The small idea and the big idea are the same idea, at four scales.
Your machine
A local daemon decides what is true — one writer, one durable file, no consensus.
Your swarm
Agents claim before they touch, so the second one to reach a file waits instead of clobbering it.
Your cockpit
The whole swarm as one picture you zoom into — down to the real diff, never a wall of them.
The market
Rent a trustworthy agent across machines, settled on one ledger that cannot lose your money.
Bring your Claude Max or ChatGPT Pro login. Every agent in the fleet runs on that one seat — no metered API bill. Same login, same model. More hours of work per day. Switching a backend on is one environment variable.
$0.00
2 min
claude-cli · codex
The app is where you watch and steer. Underneath it is a set of commands your agents can script themselves: claim a port, hold a lock, leave a note, hand off a job, recover work from a crash. Every replay below is a genuine asciicast capture of the released pd CLI against a live daemon — real text, full scrollback, select any line and copy it.
Agents claim the files they are about to edit and leave notes the next agent can read. The guard checks staged files against the active session and blocks the commit when something is not claimed. FleetBar and the Fleet Control Center show all of it before you let more automation loose.
See who is editing what before anyone starts writing
Each agent writes down what it proved before it stops
Fails closed on staged files with no active claim
There is no SDK and no server to run. The sender uses plain fetch(). The agent runs pd tube, waits, replies, and keeps listening — all in one shell call, over the same channels Port Daddy already ships. Point several agents at one channel and every listener gets every message.
$ pd tube ui:clickstube waiting on ui:clicks (up to 600s; Ctrl+C to exit)──── event id=42 · channel ui:clicks ────Body: {"button":"deploy-staging","user":"erich"}Act on the event, then reply:pd tube ui:clicks --reply "your response here"──────────────────────────────────────
Port Daddy is built as infrastructure first, with a real operator surface on top. FleetBar, Fleet Control Center, sessions, guardrails, inboxes, resources, spawned runs, and relay security all point back to the same local daemon state.
For an AI tooling team, the important question is whether the control plane is more than a demo. Each card links a user-facing surface to the command, state, and outcome underneath it.
A native menu-bar app that opens the real Fleet Control Center, shows daemon health, starts and stops fleets, and keeps the selected project one click away.
Open the same daemon-served console from native chrome or the browser.
The console for Flow, Roadmap, Agents, Resources, Activity, Channels, Inbox, Spawned Runs, Memory, Shipwright, and YAML. It is served by the daemon and embedded by FleetBar.
Inspect the current project without guessing which branch, daemon, or browser tab is authoritative.
Survey a repo, propose a starter fleet, simulate budget and bond exposure, then move into Flow, Agents, and YAML without leaving the app.
Understand what Port Daddy thinks the repo needs before launching background work.
Launch tracked delegated work with a durable id, backend/model, budget ceiling, transcripts, and result state you can inspect later.
Launch delegated work without losing the run id, model, budget, or result trail.
Inspect memory, disk, Port Daddy process cost, local model pressure, renderer load, fleet activity, daily spend, and the suggested concurrency envelope.
See whether the machine is healthy enough for more agents.
Readiness tells you which backends need API keys, CLI login, model access, dependency installation, telemetry parity, or manual confirmation.
Know which backends are launchable and which are only configured on paper.
Notes, scoped channels, actor inboxes, claims, tuples, and salvage records give agents durable ways to talk without sharing one chat window.
Give agents a shared memory trail that survives process exits and branch drift.
Sessions, notes, file claims, locks, tuples, inboxes, activity, salvage, and Coordination Guard make repo work attributable before code reaches a commit.
Prevent invisible overlap by making claims and sessions visible.
Install a local pre-commit guard that checks staged files against the current session and active claims, then blocks uncoordinated commits when enforcement is on.
Catch unclaimed staged files before they enter history.
A conversational pipe over Port Daddy channels. Listen, send, reply, resume from cursors, and bridge agent handoffs through block-once prose or JSON output.
Send durable agent handoffs without inventing a new hosted webhook bridge.
OIDC-first relay identity with admin-approved local Web-of-Trust fallback. The relay routes ciphertext while daemon fingerprints stay auditable.
Keep managed relay identity fail-closed instead of accepting self-attested fingerprints.
Named work boundaries, note encryption, Ed25519 harbor-card verification, and proof-backed security work sit underneath the local daemon.
Give risky agent work a scoped permission boundary.
When an agent crashes, its session notes, file claims, and work context survive. A new agent can claim the abandoned work and continue.
Recover abandoned context instead of asking the human to reconstruct it.
Port Daddy is open source and free. You run it from the Mac app: pick a project, start a to plan a fleet of agents, launch one-off , set spending limits, and hand work between agents. Agents stay in the terminal. You should not have to read command output to know what is going on.
Pick a project, check that the background service is running, and see which agents are working and what they have claimed.
Agents use the terminal to start sessions, leave notes, claim files, and hand work to each other. That is where they live.
The guard fails closed at the commit: it blocks any commit whose staged files are not claimed by an active session. The commit is the one hard gate — file claims before it are advisory.
FleetBar shows whether the background service is running, which project you are on, the agents at work, what they have claimed, and where spending stands. Install it, then this is what you get.
brew install curiositech/tap/port-daddypd setup
A swarm sharing one machine collides over the same scarce things: ports, files, locks, and the record of who did what. The instinct, trained on a decade of distributed-systems literature, is to reach for consensus. We make the opposite move: collapse the whole problem onto a single writer over a single local SQLite database in write-ahead-log mode, and let the operating system’s file lock serialize every mutation. There is one decider, so there is no agreement to reach. The kernel is a single-writer transactional reference monitor in the sense of Anderson and Lampson — and it is honest about exactly where its promises stop.
When you spawn a script, that script often inherits far more authority than its task needs. This paper specifies signed identity and capability cards, attenuation checks, revocation data structures, and the verifier boundary that consumes them. ProVerif checks symbolic correspondence and attenuation properties of the phase models; Kani checks bounded source properties; conformance tests cover the deployed bridge. Those layers are complementary evidence, not a proof of arbitrary-depth delegation, complete runtime interception, or hardware-level constant time.
A data owner and a model owner who will share neither data nor model can still obtain one attributable, policy-bound joint computation. Token-level taint through a generative model is not soundly definable, so the security boundary cannot be the token; it has to be the declassification gate. This chapter builds that clean room — dual-attested key release, two fences, whole-worker taint, two gates — and prices what still gets through as an information-theoretic budget of q times b bits across q jobs, before timing channels, which stay out of model.
