Concepts.

Seats and identity

A seat is an installed identity: a DID derived from a seed, with its own home directory and encrypted log. That is the agent's home: identity, memory, and history, all of it yours. The seed is recoverable from a 24-word BIP-39 code printed once at signin; the same code re-derives the identity on any machine. Secrets live in identity.json and relay.json inside the tally home; the config store refuses secret-looking keys by design. Named agents get their own seat homes under agents/<name>/, managed with tally agent.

Rooms, MLS, operator-blind

A coordination channel is an MLS group (RFC 9420, the IETF standard for end-to-end encrypted groups). Membership is explicit and cryptographic: the owner mints the channel and becomes its first member; invites are tokens; joins block until the owner admits. Messages are MLS-encrypted end to end.

The relay between members is operator-blind: it stores and forwards ciphertext envelopes and cannot read them. A relay breach leaks what the relay holds, which is ciphertext. This is a property of the construction, not a policy.

The portable log

Every seat keeps a local encrypted, hash-chained event log (tally.db). tally log verify walks the entire chain and exits non-zero on tamper or gap; tally status prints the event count and whether the chain verifies.

Strictly, the log is a hash tree, not just a chain: each event seals its parent's hash, and forks from the same context become sibling branches that verify independently. Tamper with any event and its whole subtree fails verification.

On top of the log sits the portable context: a canonical export of a coding session (task, acceptance criteria, plan, files pointer) that tally session materialize can turn back into any supported harness's native session store. That is what continue composes: resolve the seat, load the newest context, materialize, launch.

Sync, not backup. push and pull move sealed log deltas between your own machines through your seat's channel, encrypted with a key derived from your seed. The relay carries ciphertext in transit; your devices hold the log. Registered repos can sync transparently in the background with tally sync.

Harnesses and models

v1 supports three harnesses: claude-code (Anthropic models), pi (multi-provider), and codex (OpenAI models). Every launching verb accepts the canonical form (--harness <h> --model <m>) or the sugar (--claude-code --fable-5, --pi --gpt-5.5, --codex --gpt-5.5). Known model shortcuts are validated against the installed harness (--fable-5 resolves to claude-fable-5); clearly invalid pairs, like an OpenAI model on claude-code, are rejected before anything is written.

The three built-in adapters are Rust. Other harnesses can be added with a declarative adapter, a TOML file describing the harness's session store, managed via tally adapter and browsable in the TUI marketplace.

The watch

tally ui shows fleet liveness derived purely from last-activity recency, computed client-side from metadata. There is no backend that could assert an agent is alive, so nothing can fake alive. The UI opens the log read-only, decrypts nothing, and writes nothing.