The opinionated OMP launcher inside
Manifold, using the independent
atyrode.omp plugin for governed
agent execution.
Code's TypeScript/React plugin supplies typed model catalogs, four-level capability ladders, routing and estimates, shared account choices, suggestions and the workbench. Its web panels and headless client use the same typed Code/OMP workflow. There is no standalone Code binary, machine runtime, broker, gateway, credential store or public process ABI.
| Code | Manifold | OMP |
|---|---|---|
| Domain validation; routing, catalogs, container preferences and account-choice semantics; suggestion policy; React panels and typed caller workflow | Fleet identity, grants and consent; durable storage and migrations; artifact/binding revisions; jobs, locations, terminals and traces | Native broker/gateway placement and service policy; provider sign-in, credential storage and observations; workspace/probe/session operations; model runtime, retries, fallback, quotas and session resume |
Code depends on Manifold and the separately versioned atyrode.omp plugin and
typed client package. Babel is a downstream consumer of Code, not a Code
dependency. Its adoption is independent work; no old Code engine or runtime
protocol is retained for it.
Code owns custom launch and continuation choices; OMP supplies the runtime primitives that execute them. Moving the launcher into Manifold does not move its product policy into OMP. The retained continuation scope is native fleet metadata, exact terminal reopening, native resume and explicit next-resume choices. Portable archives, general live settings-origin inspection, live per-account quota preservation and Code-owned upstream fallback repair are not planned.
- Code workbench: one main view under a top bar of tabs (Generator, Accounts,
Sessions) and one More menu (Models, Setup, Options, Shortcuts, Tutorial); the panel
reads its inputs again on its own. Its questions, Shortcuts, Models' import, native reviews
and tutorial all stay inside the panel. A person's first open offers a short tutorial
that dims the panel around one real control at a time, in the order Code is used,
once per person and replayable from More. The generator is five rows of plain
words (lane, model, thinking, advisor, fallbacks) changed in place by pointer, keys
or wheel, each model shown by its short alias per tier, with Defaults and
Revert in its head and a readout line that says what a pointed word does,
including to quota where it strands a role or leads on a strained pool. A lane for
a signed-in family the model list lacks is struck, and pressing it checks the models,
which finds them. Cost and speed meters sit above a launch row that names the next step
(Launch, Save & launch) beside a dropdown of the machines it can run
on; a machine without OMP is refused like an offline one. When the step is refused it
stays focusable and the launch line names what failed (the accounts, the workspace
profile, OMP missing from the machine) with a fix; pressing it anyway opens a dialog
with the reason, why it applies and the same fix. Whatever a press waits on the person
for (a check's charge, a review that differs) is asked in such a dialog, and how a
press ended also reaches Manifold's notice stack. Routing beside it lists every
role's
model:thinking, with a fallback-chains checkbox, and usage under both; each can be hidden. Below 760 px routing and usage stand under the generator when the panel is tall enough for the generator and the whole routing at once, and are tabs of their own otherwise, the profile then grouped under the rows by provider and level. The sessions list running and explicitly read saved sessions and this device's recent profiles. Priority, prewalk and auto plans are profile switches in Options. Every action is a visible control; keys are accelerators, listed under Shortcuts, with a short key line that a touch screen does not show. Launch is task-less: the task is typed in the session. Empty workspaces derive a render-only starter from OMP's passive bundled model metadata, so exploring needs no models, credentials or runtime setup. Stored active policy always wins. Models (the list as one ladder per provider, its check and charge, a staged list, import and export), Setup (one checklist of what the machine needs, with the profile's facts, the standing approval of model checks and the classifier) and Options (profile switches, skills and automation for one launch) open as sheets. An unsaved profile survives a reload in the tab. - Model checks: a launch needs a model list checked against the account pool, and Launch runs that check itself when the list in use cannot serve it (a first launch, a model OMP no longer lists, or a lead the accounts no longer serve), then goes on to the launch. The first check asks the person, in a dialog, to approve its cost, once: later checks within twice that charge run without asking, and Setup can withdraw the approval. A finished check is kept as that person's check of the exact account pool, so another workspace whose choices select the same pool adopts it on its first launch, without spending. When accounts change, a check renews a list that passed one on its own while the panel is open, within the approval, and Launch keeps working with the last list that passed meanwhile.
- Agent launch: the launch is one press, with no review step: the press reviews the
session immediately before starting it, and stops only when what would run differs
from what the panel showed, asking in a dialog whether to launch it. Where an Agent Run can carry it,
Code registers one Manifold Agent per sponsor and workspace profile with OMP's TUI
harness, updates it when the profile changes, and launches a Run whose terminal is
OMP's own terminal UI. Sessions heads each machine's group with these Runs: their
activity, live
model:thinking, a lease of Manifold's 24 renewals and one verb, plus model and thinking dials that turn the running session through OMP'scontrolRun. Auto plans, session options, a destination without the harness operation, or a caller who cannot sponsor an Agent there keep the launch the reviewed session, and the launch line says why it has no dials. A Run whose lease ends leaves its TUI running, detached; a settled Run resumes through OMP's Agent-free resume. - Accounts / Usage: include exact OMP-observed identities or credential slots
with a switch per account in the Accounts view; choose the pool, manage reusable
presets, sign in and manage credentials under Manage accounts. The usage pane
reads each reported quota window separately and again every five minutes, or on
Refresh now (
r); unknown and historical facts never imply free capacity. OMP owns the broker, sign-in, credential mutation and gateway. - Workspace / probes / sessions: the shared headless workflow opens exact OMP native reviews, re-observes current revisions before preparation, and returns OMP's retained job receipts or terminal descriptor. Explicit inventory and benchmark jobs may contact providers and incur cost.
- Optional skills: inspect OMP's authorized immutable skill catalog and deliberately select entries or sets for one launch. Review purpose, source, license and review provenance; resolve stale or conflicting choices before launch. Clearing optional choices preserves ordinary loading; disable-all suppresses it. Choices are ephemeral, never shared profile defaults, and a selected skill is not evidence that OMP invoked it.
- Restricted automation: deliberately choose a native-supported tool subset for one launch or resume. OMP enforces its effective reviewed policy, disables OMP task/advisor spawning and ambient skill discovery, and loads only selected sealed skills. Ordinary launches remain the default. Skills grant no authority; permitted bash retains subprocess authority, so tool limits are not an OS sandbox.
- Native fleet sessions: explicitly read bounded header/title metadata from each permitted machine. An exact harness/machine/session correlation can reopen its existing terminal at its authoritative current home; similar names or directories never imply a match. Otherwise choose resume or with current profile on a saved session; resuming runs on the launch row's machine. The latter sends explicit next-resume model/thinking choices and the exact composed overlay/account pool, not a claim about live effective settings. Resume rechecks native inventory and running terminals before preparing anything; native refusals and placement permissions remain authoritative. Recent profiles are device-local and grant nothing.
- Suggestions: Code reviews and invokes only its optional external classifier service, configured in Setup; the main view has no Suggest control. This policy is separate from OMP account and gateway configuration.
Native Plugins installs and governs OMP's root, accounts and gateway bundles, managed resources, locations, service bindings and operation consent. Code has no duplicate runtime pins or machine declarations. Missing resources, caller authority or consent remain explicit refusals; a checked box, installed bundle, retained job or terminal placement is not provider success.
Use Bun 1.4.2, the pinned sibling Manifold checkout, the exact OMP Git client
pin and scripts/gate.sh. The gate prepares real OMP bundles, then runs Code's
check, test, pack and disposable-server/browser verify; see
plugin development.
- Configuration and APIs: current schemas, authority and native workflows, not legacy state-format setup.
- Architecture and transition ledger: #149's ratified design and the sole progress ledger, under integration issue #161.
- Status and caveats: exact source and preview evidence.
The 2026-09-13 preview acceptance installed the pinned independent OMP bundles, preserved the existing account store, and completed native workspace, inventory and account-backed terminal paths on two separately enrolled destinations. Source merge still authorizes neither production deployment nor release, credential relocation, backup disposal or other destructive data changes.
MIT.