Audit row
id #1170
actor db@src.land
action push
ns rethunk/payments/payments-core
at 2026-06-04T18:17:30Z
Code, queryable.
Symbols, callers, impact analysis, and cross-language edges - rebuilt on every push. Query from the CLI, the web UI, or an agent token over MCP.
What changes
git, plus an index.
A plain git host
Citadel adds
host repos, issues, PRs, releases
same - full parity, native Go transport
-
every push indexed into a symbol graph
-
agents query it over a built-in MCP server
-
scoped tokens: per namespace, per action, revocable
log in with a third party
be the identity provider - OAuth 2.1, passkeys
someone else's servers
self-host the whole thing - one Go binary
Issues
Cross-namespace issue relationships, visualized.
Every push indexes issues alongside code, so typed edges connect work across orgs and repos. blocks, tracks, and relates render as colored edges; cross-namespace counterparts carry their own lane label.
⊞ tracks
⊞ tracks
⊘ blocked by
#214
Harden identity surface
acme/platform
#48
Rotate signing keys
acme/auth-service
#19
Unify auth copy
acme/web-app
#7
Publish key-rotation runbook
acme/auth-service
Why it matters
A refactor, two ways.
Without the graph
grep for callers, hope you got them all
miss the TypeScript caller of a Go route
ship it - break checkout in prod
find out in an incident channel
With the graph
kg_impact returns every caller, all languages
impact shows the blast-radius before you merge
a caller check gates the risky PR
the audit row already says who and when
Workflow
A safe rename, start to finish.
The graph turns a scary refactor into four legible steps - the same on the web or from an agent.
Find
Search the symbol by name - no UUID hunting.
citadel-cli kg search processPayment
Check blast-radius
Direct + transitive callers across projects, with impact.
citadel-cli kg impact processPayment
Patch & PR
Edit in-browser or push; suggested edits roll up.
git push origin rename/process-pay
Gate the merge
CODEOWNERS zones + caller checks block a risky merge.
4 callers - 2 owners - 1 pending
No testimonials
Receipts, not quotes.
We won't show you logos. Here's what the system actually emits on a push.
Symbol diff
processPaymentmodified
body sha256 4f9c...a210 -> 7b1e...c904
callers 2 -> 3
0 symbols removed
See it on your code
Point it at one repository.
A single repo is enough to browse the graph, run impact analysis, and watch the audit log fill in.