dagoSte/squadra

What it claims

Squadra 3.11.0 enforces a fixed workflow on multi-agent coding sessions. A task starts only after its recipient acknowledges it. A proof runs on fingerprinted files and stops counting if the code changes. Closure needs a review by a window that did not write the code. From 3.10.4 on, that reviewer must also be a different model: Codex writes and Claude reads, or the reverse. task refuses a same-model reader unless --same-client-reason records why. The CLI has 54 subcommands, and agents run them from plain-language prompts.

How it works

The coordinator must be a Claude window. A Codex window called first does not coordinate, because its sandbox cannot find or wake other windows; it hands the user a sentence to type in a Claude window. Cursor windows take part only interactively. Squadra never launches cursor-agent, because Cursor runs hooks outside any sandbox.

A task follows these steps:

flowchart TD
  A[task assigned] --> B[recipient ack]
  B --> C{route}
  C -->|full| P[plan read by non-author]
  C -->|light| S[start]
  P --> S
  S --> D[prove on exact files]
  D --> E[deliver frozen candidate]
  E --> F{other-model review}
  F -->|changes required| S
  F -->|accepted| G[check: proof, review, candidate match]
  G --> H[coordinator close]

The light route covers bounded, reversible changes: at most 80 added plus deleted lines across four files and 16 KiB of changed lines (policy light-v1). Scripts, instruction files, contracts and security-relevant changes always take the full route. For task --defect-fix, closure needs proof that the same test fails on the base and passes on the candidate.

State lives in registry.sqlite3, with transactional events, WAL and synchronous FULL, plus content-addressed artifacts/. Events form a hash chain. doctor, save and release-gate closes run a full replay audit. Ordinary commands verify only the anchor and newer events.

Usage reads token counts from the session files that Claude Code and Codex already keep. It stores the counts but not the conversation text. Usage only measures a window registered with --session.

How to use it

Requirements are Python 3.12+ (standard library only), Git, and a browser. Node.js is required for selftest, and those checks fail without it rather than being skipped. Install as a plugin:

/plugin marketplace add dagoSte/squadra
/plugin install squadra@squadra

The plugin does not put squadra on PATH; agents call python3 <skill folder>/scripts/squadra.py. For the command itself, use the standalone installer, not both:

git clone https://github.com/dagoSte/squadra.git
cd squadra
python3 -B scripts/install.py \
  --backup "$HOME/.local/state/squadra/install-backup-001"
export PATH="$HOME/.local/bin:$PATH"
squadra --version

python3 -B scripts/install.py --undo <backup folder> rolls back. The proof command is an exact argv list in JSON, not a shell string. The dashboard (squadra dash --open) listens on 127.0.0.1, checks Host and a token, loads no CDN scripts, and has no buttons that publish or run commands.

Upgrades have breaking points. In 3.11.0, new tasks use journal format 3, which older clients refuse. Upgrade every window and reinstall bundled plugins before creating tasks. From 3.10.0 to 3.10.1, all windows must move at once. A 3.10.0 window stops with Event integrity failure at sequence N, and the old version cannot use that registry again. The only way back is a squadra save made before updating. Checkouts of 3.6.0 or earlier need git reset --hard origin/main to update.

Plugins are data folders under $HOME/.squadra/plugins/<name>/. The CLI and dashboard never run plugin code. The coordinator runs the commands in a plugin's AGENTS.md only when that file is user-owned, not group- or other-writable, and not a symlink. The Sentry plugin has been tested only against a synthetic connection. The memoranda plugin feeds a service that becomes paid after a trial.

Limits

The page states these limits:

• macOS/POSIX is the only tested environment. Windows process control is not qualified, and neither is recovery with submodules, LFS or sparse checkouts.
• Windows are trusted. Identities are not cryptographically authenticated, and hash integrity does not prove that claims are true.
• save copies to the same disk, and --declared-offsite is only a declaration.
• Secret filters are partial. Artifacts are immutable, so a secret recorded by accident cannot be removed.
• A Codex window with sandboxed networking cannot open the dashboard.
• selftest uses no model calls, and the benchmark uses fake clients, so neither measures model quality.

The fetched page was truncated at about 60,000 of 75,299 characters, so the changelog for 3.10.3 and earlier is not covered.