everything, in a little more detail.

• a microvm per colony

  not a shared-kernel container; audit findings still open.

• the host publishes

  the host commits, pushes and opens the pull request.

• multiple choice, always

  questions arrive as cards, with an “other…” answer.

• waiting costs nothing

  after ten idle minutes the vm stops; your answer resumes it.

• issues in, colonies out

  pick open issues by label and launch them in one go.

• ants on your code

  a map of the repository, with live colonies walking it.

• done means tested

  tests run in a fresh vm before autopilot publishes.

• a bell, not a feed

  what needs you waits behind one bell.

the cockpit, page by page →

• a decisions inbox

  issues waiting on your call and pull requests that need a person, as cards: post the decision, re-run failed jobs, send a redo colony.

• switch models from the top bar

  every role at once, install-wide or for one org. running colonies restart only if you say so.

• what is left on each plan

  the model popover shows each plan in use, used against its limit and when it resets; an exhausted plan sorts first, in red.

• saved model profiles

  named sets of model choices, kept in the install config and shared across devices; apply one to an org or to all.

• github says no, colonizer waits

  a suspended account or revoked token pauses launches and publishes instead of failing each one, and says why.

the v0.2.7 changelog →

• a swarm

  1 to 8 hunters, each its own colony and microvm.

• waits for an empty nest

  runs only when no colony is live, or waits for that.

• checked findings

  a second model call checks each one; rejects stay visible.

• autofix is opt-in

  off by default: report only. on: fix pull requests.

tests only: no raid has run on a real machine yet. how a raid works →

• a model per role

  orchestrator, subagents and background work, same provider or not.

• any anthropic-compatible endpoint

  your lan or tailnet, deepseek, z.ai, alibaba’s qwen.

• openai, translated

  messages api to chat completions, streaming and tool calls included.

• a budget cap per colony

  a hard cap the settler cannot lift.

• per-task model from the issue shipping
• per-request model planned

cross-provider routes are tested against stubs and a local server, not the hosted apis. providers →

claude code has run real colonies. opencode, codex, grok build and gemini cli fetch their pinned cli on a colony’s first boot, and since v0.2.7 hermes builds its pinned source there; none of them has run a real colony yet. the settlers and their roles →

• the system keychain

  macos keychain or linux secret service; a 0600 file otherwise.

• colony secrets, per host

  your own key reaches only the hosts you name.

• spend only where routed

  on the providers a colony’s models use, within its budget.

anthropic takes a key or a claude subscription; the other hosted apis are untested. 86 more endpoints in a list, unvetted. the trust model →

• merge train

  green colony pull requests merge one at a time; the rest are brought onto the new base. never forced, never as admin.

• disk cleanup

  clears finished colonies’ build output, with a preview first. no colony, no model spend.

• dependencies & supply chain

  scanners on the host read the lockfiles; a colony opens the minimal bump.

• docs & readme

  docs that drifted from the code get one colony that changes only the docs.

• typescript: remove any

  counts the explicit any and hands a colony a small batch to type.

• map refresh

  keeps the repository’s architecture map current, drawn by the mapping colony.

• your own loop

  /loop 1h check ci on main and fix flakes, or daily, weekly, monthly.

• self-paced

  the colony names its own next run, 15 minutes to 24 hours out.

a loop’s colonies are ordinary colonies, under the same limits and budgets; disk cleanup launches none. how loops work →

• add your phone

  scan a qr code, type the six digits it shows into the mothership. the api token never rides in the qr.

• answer from the notification

  one question with up to three options gets a button per option, where the browser shows them.

• your rules per device

  which events arrive, which repositories, quiet hours in the phone’s own time.

• a link from anywhere

  <id>.my.colonizer.dev reaches your own cockpit with no port forwarding. off by default.

• no github sign-in needed

  since v0.2.7 a phone pairs with the remote link by the six-digit code alone; github sign-in first is a setting.

• the address to bookmark

  settings → your cockpit lists where this cockpit can be reached, each with copy and a qr code (v0.2.3).

remote access is off by default. every finding of its security review is fixed in v0.2.7, and the relay at my.colonizer.dev carries its half of those fixes, and pairing by code, since its redeploy on 2026-10-06. how the link works →

• logs and metrics over otlp

  to grafana cloud, datadog, honeycomb or your own collector, with a send-test button in the cockpit.

• one trace per colony

  a span per turn, tool call and subagent, plus who answered each question.

• a prometheus endpoint

  GET /metrics on the observability module, once you switch it on.

• structure, not content

  off until you switch it on; no prompts, tool output, paths or commands leave the machine.

observability →

how fleets work →