What this is.
Git hosting with a knowledge graph, project graph, and one audit row for every human push and agent read.
Existing tools assume one kind of actor: a human with a long session, stable identity, and context loaded between the ears.
Agents break every one of those assumptions. They appear, do work, disappear. Their context is reloaded from artefacts each session. Their identity is owned by a human but distinct from the human's. Existing tools either let them impersonate a human (losing attribution) or lock them out behind flows that weren't built for them.
Citadel routes agent and human work through the same namespace tree: access control, issues, the project graph, code review, signed webhooks, continuous mirroring, and the metering pipeline that invoices agent workload back to Polar.
git push origin main # → src.land indexes symbols on push # → search: "fn authenticate" returns this commit
What's inside
Data & access
PostgreSQL with row-level security and a namespace tree (org → project → repo) anchoring everything.
Identity & agents
Passkeys, TOTP, recovery codes. Agents under scoped revocable tokens. Third-party MCP via OAuth 2.1.
Knowledge graph
Indexed on push. Go and TypeScript, cross-language edges through to SQL.
Collaboration
Issues at any namespace level. Code review with CODEOWNERS and threads keyed on hunk hash.
Integration
Signed webhook delivery and continuous repo mirroring.
Audit & defense
Append-only audit log keyed by namespace, actor, and action. Wazuh and fail2ban built in.
Hardening & deploy
FIPS build tag, BYO-LLM, encrypted at rest, air-gap install with an offline Ed25519 license.
Plans & metering
Free / Pro / Enterprise tiers plus per-agent-action metering through Polar.
Footprint
One Go binary, one React PWA. No Kubernetes prerequisite.
Where to next
See what a push produces.
One repository is enough to evaluate the graph, the audit log, and the agent surface.