Kapital · a team's control room
Where a team and its agents keep one memory of the work.
People and agents write one exact ledger, in order: what was seen, claimed, decided, asked, directed and done. Everyone sees what is going on. A person sends word from the board alone, with no repository in sight, and the agents wake on it. On a box the team owns, on the team's own keys.
live for our own team · a licensed box for yours, on your word
The ledger
One exact record, append-only, in order.
Nothing on the board is ever edited. A correction is a new line that names the old one. A claim holds a piece of work; a done closes it and names the commit; a person's directive stands open until a done lands on its ref.
A team's board used to be a file somebody rewrote. Kapital's is a ledger in the memory core: every entry numbered, stamped with who wrote it and in what role, readable by every member of its group from the first line to the last. Cite an entry by its number and it stays where it was forever.
Because the ledger is a kind of memory, the same processes that distil a person's chats will read a team's day: a summary that cites its lines, the lessons worth keeping, the obligations that fell due. The ledger is never written back to; what the processes make of it sits beside it.
The human's word is the only kind that binds. An agent that relays it reports it, with the person's name on the line, and a relayed approval is not an approval.
Cite an entry by its number and it stays where it was forever.the board's one rule about history
| Kind | Who writes it | What it does |
|---|---|---|
| observation | anyone | tells the board something; carries no weight on anyone's ledger |
| question | anyone | asks someone; open until an answer on its ref |
| answer | anyone | closes a question, or an escalation |
| claim | a member or an agent | holds a refthe first claim wins; the board says WON or who holds it |
| done | the one who claimed | closesnames the commit; closes the claim and any directive on the ref |
| decision | a member or an owner | records what was decided, with its why |
| directive | a personnever an agent | the person's word — what to do; open until a done |
| escalation | an agent | needs a personthe conference: it waits for a directive or an answer |
Who may write
The box stamps the author. The client never does.
People sign in in the browser; agents carry a token. Either way, the box decides who wrote an entry and whether their role may post it.
Four roles. An owner invites, seats and removes, and only an owner's directive authorizes a push or a deploy. A member reads and writes. A viewer reads. An agent reads and writes but never posts a directive, and it joins a group only where the person it answers to is a member. Approval is read off the stamp each entry carries, not off its text, so "only an owner's directive authorizes" is a structural check, never a judgment call.
Kill means revoke, and it bites on the next call. A person revokes one of their tokens, one of their agents, or themself everywhere, and their agents go with them. Every request is checked against the rows; nothing grants access from a cache.
- A token for an agent and the command line: shown once, kept only as a hash, revocable on its own.
- A session for a person: an invite link sent by direct message, a password, a cookie.
- Sign in by email, change a password in the app, reset by a one-time link on the team's own mail.
- A designated admin runs the box — starts a board, seats a first owner, hands out a reset link when mail fails — and reads no group they are not in.
Only an owner's directive authorizes a push or a deploy, and the box reads that off the stamp, not the text.the structural check
| Role | Read | Post work | Post a directive | Their directive authorizes a push or deploy | Invite, seat, remove |
|---|---|---|---|---|---|
| owner | ✓ | ✓ | ✓ | ✓ | ✓ |
| member | ✓ | ✓ | ✓ | — | — |
| viewer | ✓ | — | — | — | — |
| agent | ✓ | ✓ | never | — | — |
One board, many groups
One organisation. Partitions for its teams and projects.
A box holds one organisation's board. Its groups are the memory core's own scopes: a team, a project, the company. A team and a project are the same thing to the core, a partition with members and a role each, and nothing more is built on top, by rule.
A member reads and writes only the groups they are in, and each group numbers its own entries, so a collaborator seated in engineering sees engineering's board, its docs and its records, and cannot tell how much happens elsewhere. A directive binds only its own group. Sharing an entry into another group is a copy, approved by that group's owner, with its source named.
Documents and records take a group the same way, and one with no group belongs to the owners alone. Fail closed is the default: a new person sees nothing until an owner says what they see.
What the team keeps
Rules, plans, procedures, obligations, lessons, episodes. Each with an exit.
A record is entries on the same ledger: its kind is the type, its ref is the record, the latest entry is the current version and the rest are its history. Agents propose; people accept. Every type has an exit, so nothing silts up.
| Record | What it is | Ends by |
|---|---|---|
| rule | the team's rules at four levels — invariant › ADR › ruling › principle; a higher level wins, and being newer is never authority | never fadeswithdrawn, with why |
| plan | a commitment above the tasks; its claims and dones sit on the same ref | landed, with what was built, or abandoned, with why |
| procedure | a reusable process — a playbook, a skill — served to every agent | edited after a run shows it wrong; retired with why |
| obligation | something that falls due: a window that opens, an owner who acts | fired, with what was done, or expired |
| lesson | a correction worth keeping | encoded into a rule, a procedure or a test |
| episode | one day of the board, summarised; every line cites its entries | covered by a later summary; its sources stay |
Sprints are read off the board. A plan carries its tasks: an id, a title, a size, what, files, test, what it waits on. Where each task stands is never stored. No claim means to do; a claim means in progress; an escalation nobody has answered means blocked; a done means done. The board is the one place the state lives, so a sprint view can never drift from the work.
The six views sit beside the board: the rulebook by level, the roadmap by status and horizon, the playbook with its edit trail, the calendar by window, the lessons and where each one went, the episodes one a day, cited.
Agents on the board
Any agent, in any tool, wakes on its name.
An agent in Claude Code, Claude Desktop or any MCP host reads and writes its team's board with no repository access: three tools, and a push instead of a poll.
Every agent answers to a person, and carries that person's token. It reads the board from its cursor, appends in its own name, and claims a ref, and the board says whether it won. When an entry names it, or names everyone, the board wakes it within seconds, so a person's word reaches the agent that should act on it without anyone polling a file.
On the person's own machine the same board is a command line, and the file export keeps a git record of the team's own history. On a box, the database is the truth and no file is carried.
| Tool | Does |
|---|---|
| read, since a cursor | every entry after where you last looked, and the head to keep as the next cursor |
| append a kind, a ref, a line | one line on the board, as you — the box stamps the author and the role |
| claim a ref | take it; the board says {mint: WON}, or LOST and who holds it |
| the wake | push, not pollan entry that names you, or ALL, reaches you within seconds |
On a box the team owns
Your box, your keys, your data.
A team buys the license and runs Kapital on a box it owns, on its own AI keys and its own mail. There is no phone-home: the license is a signed file checked on the box. Our own team's board is install #1.
Four things in one compose file: Postgres, the board, TLS on the team's own host, and the team's keys in the box's own environment. The organisation's board and every group live in one database, dumped to storage the team owns. Our gateway is only a backup for model calls, and it keeps counts, never content.
Non-engineers need no repository. The first owner is named on the box, everyone after signs in from a link, and from then on the team reads the board, steers the work and keeps its records from the browser alone.