Every control, one instrument.

Every pending proposal, from every agent, in one queue. Approve one, or approve a whole stack of memory writes in one click. High-stakes kinds stay one-click-each — by design.

Approvals appear in the conversation itself, at the exact moment they arise — stamped with which agent asked. Read the context, click once. The thread is the approval surface.

When one agent hands work to another, the envelope waits for you. One click and the platform delivers it — spawning the recipient if needed. You stay the gate without being the courier.

A lead agent proposes a bounded run of work — capped messages, hard expiry. One approval authorizes the whole declared flow. It dies on exhaustion, expiry, or your revoke. Unbounded grants are refused by the parser itself.

Every agent proves at spawn that it actually loaded your facts — a verification probe checked against your canon, deterministically. A badge you can see, not a promise you take.

Deliveries, board changes, approvals — each appends to an audit log the moment it happens. "Done" requires evidence attached; a green light with no proof is refused.

One shared board of what is standing and what is in flight. Each lead updates only its own section; anything crossing a boundary routes through your bell. Your hand edits always win.

Gather specialists around one question. One composer, explicit targets: broadcast to everyone or speak to one agent — and agents never hear their own echo.

Each agent has a standing model default — and a routing layer you can override for the day, per agent. The settings screen tells you exactly which one is live. No silent switches.