Hyperfide

The agent workflow tool that scales from small, simple projects to large, complex codebases.

The local CLI is pure C11: one binary, one SQLite database, no telemetry.

Platform runtime

The runtime under platform/ adds browser, desktop and mobile surfaces, a server, host daemons and provider plugins to the C binary and control plane. Use Node 24 and pnpm 9.15: pnpm -C platform install --frozen-lockfile, then pnpm -C platform dev. The public command is hyperfide platform --help.

| Command | Description | | --- | --- | | hyperfide platform | Front door to the platform runtime CLI: runs HYPERFIDE_PLATFORM_BIN, the repository's platform/apps/cli/bin/hyperfide-platform, or hyperfide-platform on PATH, in that order, passing arguments, streams and exit status through untouched |

The platform guide describes runtime capabilities, authority plugins, fleet, slices and memory integration boundaries, and names the qualification command for each. The operations guide records measured image and index costs. A worker finishing a thread does not mark its spec task qualified.

Overview

Run hyperfide platform --help for the Hyperfide platform runtime commands. The front door preserves arguments, streams and exit codes; see the platform CLI guide for executable lookup and environment.

Hyperfide is an agent workflow engine in a single binary, hyperfide. It maintains the four things a project needs beyond the code itself — what the code is, how it got here, what happens next, and what was learned along the way — and serves all four to humans and AI agents alike.

This tree is Hyperfide 2.0 in development: hyperfide version prints 2.0.0-dev, and nothing in it is a production release. Hyperfide grew out of Codify, whose 1.x releases, feature IDs (such as codify-v15 and codify-v16) and commit history keep their original names. 2.0 adds a distributed control plane — a leader and feature managers on a supervisory server, remote sandboxes for builds and agents, PostgreSQL as the authority — around the same local CLI.

Compatibility. hyperfide is the canonical command. cg is a deprecated compatibility alias installed from the same executable, with identical arguments, JSON and exit codes; it stays for the supported compatibility window of the approved release and is removed only in a later release that announces it. Every example below uses hyperfide; cg runs the same thing.

hyperfide fleet up starts a durable, crash-resumable supervisor for the main agent, wave managers and task workers. It manages each Codex or Claude Code process until work is qualified and merged. Agents receive graph context, branch drift is checked before integration, and hyperfide serve streams events to the editor. Indexing is coalesced across workers; the graph and memory cover every branch and worktree. The core loop makes no network call; the few features that do are named at the end of this overview.

What the code is. Hyperfide indexes source files into a queryable graph: symbols, calls, imports, types, routes, and full-text search, all stored locally in SQLite. Language coverage ranges from native syntax extraction to file-only tracking; the coverage matrix states the boundary for each family. hyperfide context answers "catch me up on this area" in one call: matching symbols with snippets, callers, callees, and related routes. Comments are indexed as first-class nodes for purpose, contracts, dangers, and couplings that live only in prose.

How it got here. A built-in content-addressed snapshot system gives you commits, history, diffs, and restore with no external VCS required. Because snapshots share a database with the graph, hyperfide changes reports the blast radius of your uncommitted edits. hyperfide changelog writes the release notes: from git history by default — a release per tag or version bump, groups from the commit-subject prefix, each task reference carried through, and, with a key, a short model-written Highlights paragraph per release — and from the snapshot chain with symbol-level diffs when you pass --snapshots or the project has no git at all.

What happens next. A spec engine turns plain-text kvx spec files into a working plan: a task board with dependency waves, acceptance criteria attached to every task — and a done that is verified, not asserted. hyperfide spec new and hyperfide spec add create the plan, hyperfide spec lint proves it is executable, and the loop runs it. In Prod mode, implemented records coding completion and source evidence without claiming qualification; only done means executable qualification and graph checks passed. In parallel mode, several agents work at once, bounded by the disjointness of the paths each task declares.

What was learned along the way. An agent memory stores deliberate notes — decisions, constraints, outcomes, preferences, facts — in the same database as the graph, linked to the task they were made under. hyperfide remember saves one mid-task, every hyperfide spec done records an honest outcome automatically (including refusals), and hyperfide recall brings it all back, ranked by relevance and recency.

The layers reinforce each other: commits are auto-tagged with the task they implement, memories surface on the task they belong to, hyperfide why walks a symbol back to the decisions behind it, and hyperfide spec trace walks any task to its symbols, commits, and memories.

And it is present between the steps, not only at them. hyperfide work open starts with a compact task packet, hyperfide work update returns only new state/evidence/workspace deltas, hyperfide event progress classifies loops without mistaking activity for progress, and hyperfide guard notices when an edit drifts outside declared scope. A built-in MCP server exposes 71 tools, resources, and prompts to every MCP-capable agent, while hyperfide integrate plans, applies, and diagnoses each host's native configuration.

And it drives agents, not just serves them. hyperfide handoff and hyperfide resume move a task between sessions without losing state, hyperfide spec claim-next hands an idle agent the next conflict-free task atomically, and hyperfide spec run fans a whole wave out to Codex CLI or Claude Code sessions — one sandboxed child process per claimed task, logs and prompts on disk, leases released on failure.

And it survives a fleet. Indexing is a shared resource, not a per-process habit: the first hyperfide that wants a pass runs it, the rest leave a note and coalesce into it, a freshness window skips the walk entirely, and machine-wide parse slots keep concurrent projects inside the core budget (docs/sync.md). Above that, spec/workflow.kvx can declare a hierarchy — a main agent owning the task list, a manager per wave, a worker per task — and hyperfide fleet drives the branch flow: worktree, merge-up, land behind the test and lint gates, pull request, checkpoint. hyperfide fleet up runs that whole tree by itself under a detached supervisor — every wave at once, each manager and its workers alive together, each worker in its own worktree — nudging stalled agents, retrying failed ones with what went wrong, escalating what cannot be rescued, stopping at the approval gates you opted into, and reporting complete when the work merged, not when a process exited (docs/hierarchy.md). Kill the supervisor and hyperfide fleet up --resume adopts the agents still alive. Drift from the spec, colliding tasks, and interface changes other branches depend on are flagged before they merge (docs/drift.md); hyperfide projection build folds every active branch, uncommitted work included, onto one projection ref and names the symbol, interface and textual conflicts with their branches before anything merges, and the projection follows the work through the hooks, hyperfide watch, hyperfide serve and the supervisor (docs/projection.md). Every change is an event that hyperfide events --follow and hyperfide serve stream live (docs/events.md). All of them share one graph and one memory: every branch and linked worktree of the repository indexes into the same .codegraph/, scoped by branch (docs/branches.md).

And it asks for a decision when one is needed. hyperfide jev reaches TypeSafe's System One model for typed judgements — true/false, one-of, ranked. hyperfide memory classify uses it to say which notes are reusable skills, and hyperfide skills promote renders those into portable .agents/skills//SKILL.md; a failing verify_cmd gets a triage line, hyperfide guard gets its findings ranked, and a pull request gets a readiness score. Jev is mandatory for the features built on it, never for the core loop, and never authoritative — no Jev answer changes an exit code (docs/jev.md).

And documentation is the last verified task. New feature specs enable an @docs closure stage by default. Once every ordinary task qualifies, Hyperfide builds a bounded evidence packet from the spec, task-attributed snapshots, code graph, routes, memories, checks, and existing docs. The same configured agent connector updates user and developer documentation, while hyperfide docs check checks declared claim references, local inline links, required graph-surface coverage, and configured target scope. hyperfide docs close records a dedicated [spec:/@docs] snapshot and an incremental baseline for the next spec flow. These structural checks support review; they do not certify every sentence's meaning.

The CLI runs no background services you did not start and sends no telemetry — the fleet supervisor runs only after hyperfide fleet up, and stops with hyperfide fleet down. The graph, memory, snapshots, and the whole task loop run on your machine and stay there. The exceptions are named and opt-in: Jev decisions need OPENROUTER_API_KEY, and only the commands built on them ever make that call; hyperfide changelog asks a model for release highlights, and hyperfide recap has Solar Decide pick statements from past sessions and a model write the brief, only when CENTRA_API_KEY (or HYPERFIDE_CHANGELOG_KEY) is set; and hyperfide fleet pr and checkpoint call gh. The distributed control services under services/hyperfide are separate processes you start explicitly (The Hyperfide control plane).

Why Hyperfide

It closes the loop from plan to proof. Most tooling either plans work (task lists) or describes code (search, indexes). Hyperfide does both against the same database, so the plan can be checked against reality: when a task declares it introduces checkMode and touches src/*.ts, hyperfide spec done refuses to mark it complete until the graph and the history agree.

Agents work like engineers, not tourists. Instead of wandering a repository file by file, an agent asks hyperfide spec next for what to do, hyperfide context for everything about the area, and hyperfide impact for who breaks — then commits with automatic task attribution. The entire loop is available over MCP, so it never has to leave the protocol.

The project remembers what sessions forget. Agent context windows reset; the memory table does not. A decision written once with hyperfide remember meets the next session automatically — on hyperfide spec next, on hyperfide spec start, in hyperfide recall at session start — instead of being rediscovered at full price. And because refused completions are recorded too, "this task was blocked twice and here is why" is one query away.

Context arrives in one call, not twenty — and inside a budget. hyperfide context is designed around how agents actually consume code. One request returns everything needed to start working: relevant memories, where execution enters, what matched, who calls it, what it calls, and which routes touch it — ranked (real definitions above test fixtures, called code above dead code) and fitted to a token budget (--budget, default 4000). A symbol is printed in full once; every later mention is a compact name path:line, and anything cut by the budget is announced with an explicit omitted count instead of silently dropped.

Impact analysis is a first-class command. hyperfide impact -d 3 walks caller and callee edges transitively and answers the two questions that matter before any change: who breaks if this moves, and what does it depend on.

Search is instant and layered. An FTS5 trigram index over symbol names gives case-insensitive substring matching with no warm-up, backed by a word index over full file bodies for everything else.

The index reports when coverage or freshness is uncertain. hyperfide watch observes file changes and requests debounced syncs. A lost watcher event or failed registration leaves durable reconciliation debt. CLI and MCP answers expose extraction coverage and bounded source checks as verified, stale or unchecked; a coalesced update does not by itself certify freshness. One process holds the index gate while other callers leave dirty notes, and machine-wide slots cap parse threads across projects (indexing details).

It adapts to the hardware it runs on. At startup, hyperfide sizes its worker pool and SQLite caches from what the system actually provides: container-aware core counts (the intersection of cgroup v1/v2 CPU quota, the affinity mask, and online CPUs), honest available RAM (MemAvailable intersected with cgroup memory limits), and measured per-project cost. A 16-core workstation gets the full parallel pipeline. A 2-core VPS gets one tuned to finish reliably. Run hyperfide info to see exactly how the pipeline was sized.

Everything stays local. The graph lives in a SQLite database under .codegraph/, and snapshots are content-addressed objects under .codegraph/objects/. Delete the directory and every trace is gone.

The intent layer

A parser sees symbols, calls, and routes. It cannot see why a function exists, what its callers must hold true, or that save_tasks must run after load_tasks reads the disk — that half of the codebase lives only in comments. Hyperfide indexes it (docs/ANCHORS.md is the full convention):

• Anchors are comments that pass the derivability test — *if an agent

• Doc-first retrieval: where an anchor exists, hyperfide context serves doc +

• hyperfide survey reads a hundred files for the price of one body: purpose

• Soft edges: names inside anchors resolve into (soft) references —

• Drift honesty: every anchor baselines the code it describes. When the

• hyperfide anchors ranks uncovered symbols by coordination score (fan-out ×

None of it is required: a repository that never adopts the convention still gets capture, survey, and soft edges from whatever comments already exist.

One session with Hyperfide

hyperfide brief                     # root, active task + ACs, uncommitted work, prior decisions
hyperfide spec next                 # the next eligible task, ACs + relevant memories
hyperfide spec start 16.7           # claim it — one task in progress at a time
hyperfide context "password auth"   # memories, entry points, symbols, callers, routes in one call
hyperfide why verifyLogin           # who changed it, under which task, and what was decided
hyperfide impact verifyLogin -d 2   # who breaks if this changes
...implement...
hyperfide guard                     # anything drifting outside what task 16.7 declared?
hyperfide test-impact               # which tests cover what you just changed
hyperfide remember "sessions rotate on login" --type decision   # linked to task 16.7
hyperfide review                    # the change, paired with the ACs it claims to satisfy
hyperfide commit -m "add password auth"   # snapshot, auto-tagged [spec:ion_spec/16.7]
hyperfide spec done 16.7            # qualification: verify_cmd + graph checks; outcome recorded
hyperfide spec trace 16.7           # proof: task -> symbols -> commits -> memories

And when a session has to stop before the task is finished — the context window is full, the day is over — the work does not evaporate:

# session A, stopping early
hyperfide handoff --done "schema migration; token rotation" \
                  --next "wire the login route; extend 03_auth test" \
                  --blocked "flaky fixture on CI" -m "rotate on login, not refresh"
session B, hours later, a fresh context window
hyperfide resume --prompt   # paste-ready block: task, steps done, blockers,
                            # next steps, uncommitted files, lease state

A handoff is stored as a structured memory linked to the task; each new one supersedes the previous, so hyperfide resume always meets the latest state, not a pile of stale notes.

Every command in that loop is also an MCP tool, so a connected agent can run it end to end — and every step works just as well in a ten-file project as in a monorepo. hyperfide check runs the whole gate in CI as a single step, and hyperfide hook install wires the sync and the scope check so most of this happens without anyone invoking it.

Supported languages and frameworks

Native syntax adapters cover JavaScript/JSX, TypeScript/TSX, C, C++, Objective-C, Go, Rust, Python, Ruby, PHP, Java, Kotlin, Scala, C#, Swift, Dart, Lua, Luau, R, Erlang, Solidity, Terraform, Nix, Pascal, COBOL, VB.NET, CFScript, CFQuery, and ArkTS. Mixed-format adapters cover selected CFML, Vue, Svelte, Astro, Liquid, Razor, Delphi form, and MyBatis XML constructs. JSON, YAML, Twig and properties are tracked at file level. The indexing guide explains supported facts, fallback, limits and unresolved boundaries.

Framework-aware routing records supported literal registrations and links a uniquely identified handler where evidence permits. It covers Express, Next.js, React Router, Expo Router, SvelteKit, Vue/Nuxt, FastAPI, Django, Flask, Laravel, Rails, Spring, Gin, Axum, ASP.NET and Vapor, plus selected registrations in Koa, Fastify, Hapi, NestJS, Sinatra, Echo, Fiber, Chi and Actix. Computed paths and ambiguous handlers remain unresolved.

Installation

Hyperfide 2.0 is built from source in this revision. The one-line installer in scripts/install.sh is not advertised as a Hyperfide release until the distribution and rename tasks (25.4 and 26.2 in spec/hyperfide/spec.kvx) close.

Dependencies: a C compiler, python3 (the build discovers native components with it), and the development packages for SQLite, libcurl and OpenSSL's libcrypto (libsqlite3-dev, libcurl4-openssl-dev, libssl-dev on Debian and Ubuntu). The tree-sitter runtime and grammars are vendored.

make && sudo make install

make links ./hyperfide and copies it to ./cg; make install checks that the two are byte-identical and installs both into $(PREFIX)/bin (default /usr/local). make uninstall removes both. Per-project .codegraph/ data is never touched.

Upgrades are safe on existing projects: the database carries a schema version (18 in this tree), and on the first open after an upgrade hyperfide rebuilds only the derived index tables (files, symbols, refs, routes, imports, and the search indexes) — the next sync repopulates them. Memories, git history, leases, attempts, events, and the branch and agent registries are never dropped by a migration. An older binary refuses to open a newer database instead of downgrading it.

Then, in any project:

cd your-project
hyperfide init

On a terminal, hyperfide init, hyperfide index, and hyperfide sync show a live progress line on stderr — phase, files done of files to do, workers, elapsed time, and any lock it is waiting for — erased before the summary. Piped output is unchanged; HYPERFIDE_PROGRESS=plain prints plain lines instead, HYPERFIDE_PROGRESS=0 turns it off. See docs/sync.md.

Environment variables are spelled HYPERFIDE_ throughout. The older CG_ names, and the CODIFY_ names the tree still recognizes (CODIFY_ROOT, CODIFY_INSTALL_DIR, CODIFY_BASE_URL, and the authority, credential, transport, MCP tool-policy and mode variables), are accepted as aliases of the same setting; setting an alias and its HYPERFIDE_ name to different values stops the command with an alias-conflict error instead of picking one.

Command reference

hyperfide help prints the map: every command by group, one line each, fitted to the terminal. hyperfide help (or hyperfide --help, -h) shows one command's usage, subcommands, flags, examples, and related commands; hyperfide help --all prints all of them, and hyperfide help --json gives editors and agents the same table to build menus from. The tables below name the same commands as hyperfide help. The overview also prints the command-name note quoted in the Compatibility paragraph.

| Command | Description | | --- | --- | | hyperfide help [] [--all] [--json] | The grouped overview, one command's detail, every detail, or the whole table as JSON. An unknown name suggests the closest ones and exits 1. Bold and dim only on a terminal (NO_COLOR, TERM=dumb, and HYPERFIDE_COLOR=0\|1 decide); COLUMNS sets the width, never below 60 | | hyperfide version | Print the version (--version too) |

Graph

| Command | Description | | --- | --- | | hyperfide init [--nested] [--force] | Create .codegraph/ and build the initial index; inside a linked git worktree of an initialized repository, join the shared graph under this branch instead. Refuses inside an enclosing project (--nested makes this directory its own) and in your home directory (--force) | | hyperfide sync [paths] [--max-age MS] [--background] [--wait MS] [--auto] [--workers N] | Incremental index: coalesces into a pass already running (--wait, default 2000 ms), skips when fresh, and walks only the paths named; --auto marks an implicit sync that [sync] auto = false skips | | hyperfide index [--full] [--workers N] | The blocking form of sync that always walks, waiting for a pass already running. --workers N (on both) beats HYPERFIDE_INDEX_WORKERS and [index] workers in the project configuration. Exits 75 when the database stays busy past the lock wait | | hyperfide index-status [--json] | Indexed file and symbol counts for the current branch; --json adds the total counts plus per-file paths and symbol counts | | hyperfide branches | Every branch indexed into the shared graph, with its worktree, head, base, and file count | | hyperfide search [-n N] | Symbol and full-text search (default 20 results; --path, --lang, --kind, --name, --no-tests narrow it): a phrase matches names (export memory finds memory_export and exportMemory), doc comments and bodies, ranked in that order with source before tests; file hits show the matching line. Definitions answer, never their prototypes; a bounded typo fallback applies when exact and segment matches find nothing (docs/retrieval.md) | | hyperfide grep [-E] [-i] | Line search instead of a shell grep: a literal (or -E regex) found through the trigram index, read from disk, each hit placed in its enclosing symbol, ranked and capped by -n and --budget with the omitted tail; --path, --lang, --no-tests, --symbol, --kind, -C, --files, --count (docs/retrieval.md) | | hyperfide symbol | Definition, snippet, and reference count | | hyperfide impact [-d N] [--budget N] | Transitive callers and callees to depth N (default 3), fitted to a token budget (default 8000) | | hyperfide flow [target] | Bounded typed-relation traversal with source evidence, dynamic boundaries and explicit limits: --depth (1 to 8), --max-nodes (up to 256), --max-edges (up to 512), --max-ms (up to 2000), --max-output bytes | | hyperfide inspect | Hierarchy and cautious unreferenced-code inspection; see the subcommands below | | hyperfide inspect hierarchy [-n N] | Bounded ancestors, subtypes, and implementations from typed relations | | hyperfide inspect unused [-n N] [--path GLOB] | Unreferenced symbols and bounded reachability from known roots, with exclusion reasons; never a deletion verdict | | hyperfide context [--budget N] [-n K] | One-call context bundle for agents: memories, symbols, entry points, routes — top K symbols (default 8), filled to a token budget (default 4000) with explicit omitted counts and, in --json, tokens_used. A file path gets the file's outline (purpose, symbols, imports, dependents); a directory gets its files | | hyperfide survey [path\|query] [--budget N] | The tier below bodies: file purpose lines and symbol docs with signatures across ~100 files per call — never a body. Uncovered files and symbols are named, and anything cut by the budget (default 16000) is an explicit omitted count | | hyperfide files [pattern] [--dirs] [--depth N] [-n N] | Files by glob (src/*/.go), by the words of their path (sync gate), or by directory, each with language, lines and symbol count; --dirs maps directories with file and line counts and dominant language. --path, --lang and --no-tests narrow it, as they narrow search, context and survey | | hyperfide anchors [--stale] [--uncovered] | Anchor health: docs whose code moved on, and uncovered symbols ranked by coordination score (fan-out × extent × referencing files) — the backfill work list | | hyperfide routes [filter] | URL pattern to handler table | | hyperfide show [--full] | Just that symbol's body — by name, or by the cursor position an editor holds; long bodies truncate with a … (+N more lines, use --full) marker | | hyperfide why | Provenance: the commits that changed it, the tasks they implemented, the decisions recorded | | hyperfide test-impact [symbol] | Tests referencing a symbol — or every symbol in your uncommitted changes | | hyperfide watch [--debounce MS] [--fleet] | Auto-sync on native filesystem events (debounce default 300 ms); --fleet watches every worktree the graph knows, each under its own branch | | hyperfide root | The project root hyperfide resolves to from here; --json adds the shared project, the worktree flag, and the branch | | hyperfide info | Machine profile, pipeline sizing (the worker count and its origin), the bound project root and branch, branch-scoped index coverage, and the parser inventory | | hyperfide config [init\|get K\|set K V\|check] [--json] | Project configuration in hyperfide.kvx (a legacy codify.kvx is still read): every setting with its origin, the commented defaults, one key read or written in place, and a check for unknown keys and bad values. Works before hyperfide init. See docs/config.md |

Version control

Snapshots are content-addressed with SHA-256 and blobs are deduplicated.

| Command | Description | | --- | --- | | hyperfide commit -m | Snapshot the working tree, synced first and auto-tagged with the in-progress task; --task names the task, --amend replaces the last snapshot, --git also makes a real git commit with the same spec tag | | hyperfide log [-n N] / hyperfide status | Snapshot history (default 20), and worktree versus HEAD with branch-scoped index coverage and pending reconciliation | | hyperfide diff [A] [B] | LCS line diff between snapshots or the worktree | | hyperfide checkout [--force] | Restore a snapshot | | hyperfide changes [--limit N] | Impact radius of uncommitted edits: the symbols you touched plus their external callers — capped by default (40 symbols, 8 callers each) with (+N more) markers; --limit overrides | | hyperfide git-sync [-n N] | Ingest git history (default 2000 commits) — commits, authors, per-file churn — which then ranks search and context and answers hyperfide why | | hyperfide events [--since N] [--kind K,..] [-n N] [--follow [--for S]] [--head] | The event log: every task, claim, attempt, agent, fleet, supervisor, drift and approval change by sequence number. --kind takes a comma list where a trailing . is a prefix (fleet.); --follow streams; --json is one object per line. See docs/events.md |

Hyperfide's snapshots do not replace git. .gitignore is honoured alongside .cgignore, hyperfide git-sync reads your real history, and hyperfide commit --git writes to both, so adopting Hyperfide is never all-or-nothing.

Changelog

hyperfide changelog renders release notes from git history. A release starts at a tag or at the commit that changed the project's version — CG_VERSION in src/cg.h, a VERSION file, or package.json — so a project that never tags still gets one section per version. What came after the last one is named by the version the working tree carries when that is new (the release being prepared), by --tag NAME, and only otherwise [Unreleased]. A group is the commit-subject prefix, and the [spec:/] that hyperfide commit appends becomes a task reference on the bullet. Commit and compare links come from git remote get-url origin; with no remote, a bullet reads - Add gauge (497c30a) and the footer links are left out.

## [0.3.0] - 2026-09-28
Features
Add gauge (497c30a)
Documentation
Explain gauges (191d0c8)
[0.2.0] - 2026-09-28
Bug fixes
parser: Handle empty input (682f9f8, task demo/1.2)
[0.3.0]: https://github.com/acme/demo/compare/0.2.0...0.3.0
[0.2.0]: https://github.com/acme/demo/compare/0.1.0...0.2.0

Highlights. With CENTRA_API_KEY in the environment or the project's .env (or HYPERFIDE_CHANGELOG_KEY), each release also gets a ### Highlights block: two to five sentences, and a few bullets for a large release, written by a model from that release's grouped commits. The derived bullets are never changed, and the prompt tells the model not to invent anything the commits do not say. The default endpoint is https://gateway.centra.ag/v1/chat/completions with the model openrouter/anthropic/claude-haiku-5.5; HYPERFIDE_CHANGELOG_ENDPOINT and HYPERFIDE_CHANGELOG_MODEL point it anywhere OpenAI-compatible. Answers are cached under .codegraph/changelog-cache/ by the release's commits and the model, so regenerating the file asks only about releases that changed. --summarize insists (and says so when no key is found), --no-summarize keeps the model out, and a failed call prints highlights for skipped — on stderr and writes the notes without prose.

hyperfide changelog -o CHANGELOG.md        # every release, highlights when a key is present
hyperfide changelog --unreleased           # only the newest section and its footer line
hyperfide changelog --tag 1.2.0            # name the newest section 1.2.0, dated today
hyperfide changelog --no-summarize -n 3    # the plain record, three newest releases

-n N caps the release sections, and -o FILE writes the file relative to the repository root and reports how many highlights were written and how many came from the cache. --snapshots — and any project without a .git — falls back to the snapshot renderer, whose output is a symbol-level diff per snapshot rather than a release history. cliff.toml at the repository root is the matching git-cliff configuration; git-cliff only knows tags, so the two produce the same file only for a tags-only repository with no version file and no model key. This repository's CHANGELOG.md is generated with hyperfide changelog -o CHANGELOG.md.

Recap

hyperfide recap writes the brief a fresh agent needs to pick a project back up: what the project is, what changed in the last weeks, what the recent sessions did, the facts that would otherwise be lost, and the next step. Its raw material is the transcripts Claude Code and Codex already keep on the machine (~/.claude/projects//.jsonl and ~/.codex/sessions//rollout-.jsonl, matched to this repository by working directory), which are the only record of why between commits and far too long to hand over whole.

Two models do two different jobs. Each transcript is cut into statements — a user request, one paragraph or bullet of the assistant's answer, a file edited, a command that committed or tested — and handed in small chunks to Solar Decide, Upstage's System One decision model, through the Centra gateway (openrouter/upstage/solar-decide at https://gateway.centra.ag/v1/systemone, the same request schema as Jev). For every statement it answers three typed questions with calibrated probabilities and no prose: which kind it is (goal, decision, constraint, fact, done, open thread, dead end, noise), whether it still held when the session ended, and whether a resuming agent needs it. The statements that clear the bar, ranked by the product of those probabilities and cut to --budget characters, form the decided log: every line quoted from a session, none written by a model. That log, with facts read from the repository (the active feature and its task statuses, the recent commits, the stored memories), goes to the gateway chat model hyperfide changelog already uses, which writes the brief itself. The decided log is kept at .codegraph/recap/decided.md so any sentence in the brief can be checked against what was actually said.

hyperfide recap                              # 6 newest sessions of the last 21 days → <context>/recap.md
hyperfide recap --sessions 10 --since 45     # wider window
hyperfide recap --decided                    # stop at the picked statements; print them, write no prose
hyperfide recap --facts                      # the repository facts alone; no key, no model
hyperfide recap -o - --agents codex          # to stdout, Codex sessions only

Both calls use CENTRA_API_KEY (or HYPERFIDE_CHANGELOG_KEY) from the environment or the project's .env; without it the command stops with a clear error, since neither half has a local stand-in. The endpoint bills every question against the whole state, so chunks are small (6 statements, HYPERFIDE_RECAP_CHUNK) and several run at once (HYPERFIDE_RECAP_PARALLEL, default 6). Time and cost depend on the session and the gateway; this revision does not state a measured figure. Decisions are cached per chunk under .codegraph/recap-cache/, so a rerun asks only about sessions that are new. What never reaches a model: thinking blocks, tool output, harness notifications and reminders, code fences, and sessions from other projects. HYPERFIDE_RECAP_DECIDE_MODEL, HYPERFIDE_RECAP_DECIDE_ENDPOINT and HYPERFIDE_RECAP_MODEL point either half elsewhere; HYPERFIDE_RECAP_CLAUDE_DIR and HYPERFIDE_RECAP_CODEX_DIR say where to look. The brief is written to recap.md in the context directory: .codify/recap.md by default, .hyperfide/context/recap.md when the project has a hyperfide.kvx.

Code map

hyperfide codemap writes CODEMAP.md at the repository root: the one file a new agent (or person) reads to know what the project is, how to build and test it, where things live, and which symbols the rest of the code leans on. It is built from the graph, never from a model. Purpose lines are the code's own file comments and READMEs, and a directory with neither gets none. Symbols are ranked by the calls that resolve to them. The same graph gives the same bytes, and the map never counts itself, so hyperfide codemap --check works as a CI gate. hyperfide brief names the map and says whether it is current; the MCP codemap tool returns it without writing. See docs/codemap.md.

hyperfide codemap                  # write CODEMAP.md (8000-token budget)
hyperfide codemap --budget 3000    # tighter: least-referenced entries go first, each section counts what it left out
hyperfide codemap --check          # exit 1 when CODEMAP.md is missing or stale; writes nothing
hyperfide codemap -o - --json      # the same map as structured data

Memory

Durable agent notes, stored in the same SQLite database as the graph. Memories written while a spec task is in progress link themselves to it, and hyperfide spec done records outcomes automatically. Never store secrets in them.

| Command | Description | | --- | --- | | hyperfide remember | Save a memory — --type decision\|constraint\|outcome\|preference\|fact (default fact), --task (defaults to the in-progress spec task), optional --symbols / --files anchors, --supersedes to retire a reversed decision | | hyperfide recall [query] | Search memories: full-text over the body, ranked by relevance then recency; filter with --task, --type, -n N, or --near for anchored retrieval | | hyperfide forget | Delete a memory | | hyperfide memory compact | Collapse duplicate memories (--dry-run to preview) | | hyperfide memory classify [\|--all\|--unclassified] | Ask Jev what each note is — skill, decision, constraint, fact, noise — with a confidence, and store it on the memory. No argument does the unclassified ones; -n N caps the batch | | hyperfide memory export [-o FILE] | Write memories as JSONL — a header line, then one object per memory keyed by a content id — to stdout or FILE; select with --task (a tag or prefix), --type, --branch, --since DAYS | | hyperfide memory import | Add the memories this graph does not hold yet, by content id, in one transaction: creation time, class, and supersession travel; --dry-run reports without writing, --keep-branch keeps branch names this graph does not track, --retask OLD=NEW rewrites a task-tag prefix. --from DIR reads another Hyperfide project's graph read-only instead of a file. See docs/memory-transport.md | | hyperfide skills list\|promote \|render | The memories classed skill, promoted into .agents/skills//SKILL.md, and kept current with the note they came from |

A superseded memory is never deleted — the reversal is history worth keeping. It simply stops leading the results, so a session meets the current decision first.

A classified memory carries its class everywhere it appears — class skill 0.82 in hyperfide recall, [decision/skill] in hyperfide brief, class and confidence in both --json. Promotion writes a generated file that says so: it carries an ownership marker and a link back to the memory, a file without that marker is never overwritten, and hyperfide skills render refreshes the ones whose note has moved on. See docs/jev.md.

Agentic

| Command | Description | | --- | --- | | hyperfide mcp | Run as an MCP stdio server (it reports itself as hyperfide): 71 tools, hyperfide:// resources for the workflow, each feature spec and the agent context (legacy codify:// URIs are still read), and the prompts orient, start-work, review-change and close-task | | hyperfide lsp | Run as a Language Server (stdio) — every editor, not just VS Code | | hyperfide serve | One JSON-RPC connection (stdio) for an editor: every MCP tool, any hyperfide command (exec), cancel, and pushed event subscriptions from a sequence number. Idle, it holds no lock and runs no index pass. See docs/events.md | | hyperfide tool list \| call [json] | Run one MCP tool from a shell, without an MCP client | | hyperfide integrate detect\|plan\|apply\|doctor [--no-plugin] | Capability-aware setup for Codex, Claude Code, Copilot/VS Code, Cursor, Gemini CLI, OpenCode, Zed, Windsurf, Cline, and Continue; detect is the default, planning is read-only, apply is idempotent and backed up with .codify.bak copies | | hyperfide mcp-install | Compatibility alias for hyperfide integrate apply | | hyperfide hook install | Wire agent and git hooks so the graph stays fresh and scope drift surfaces on its own | | hyperfide hook post-edit | The wired edit hook itself: reads the host's payload on stdin and does one targeted background sync plus a guard of the edited path — one process per edit, not two full syncs | | hyperfide hook event | The wired lifecycle hook (--host claude\|codex): records the host's own sessions and the subagents its Agent tool spawns in the agents registry with their worktree, branch, task, and last tool, emits agent.native.* events, and feeds the payload to hyperfide event ingest; always exits 0 | | hyperfide hook pre-bash | The wired Bash hook: when a command runs grep, rg, ag, ack, find, fd, or ls -R over the tree, answers with the hyperfide grep or hyperfide files equivalent as context, once per session per command; never a permission decision, silent under HYPERFIDE_SHELL_ADVICE=0 or [hooks] shell_advice = false; always exits 0 | | hyperfide changelog [-n N] [-o FILE] [--unreleased] [--tag NAME] [--snapshots] [--summarize\|--no-summarize] | Release notes from git history: a release per tag or version bump, the newest named by the working tree's version, groups from the commit-subject prefix, [spec:/] rendered as a task reference, and model-written Highlights per release when CENTRA_API_KEY is set (see Changelog). --snapshots, or a project with no .git, renders from the snapshot chain instead, with symbol-level diffs: added and removed functions, new routes | | hyperfide recap [--sessions N] [--since DAYS] [--budget CHARS] [-o FILE] [--agents claude,codex] [--decided] [--facts] | Resume brief from past Claude Code and Codex sessions: Solar Decide (System One, via the Centra gateway) picks the statements a resuming agent needs, the gateway chat model writes recap.md in the context directory; the picked statements stay in .codegraph/recap/decided.md. Needs CENTRA_API_KEY (see Recap) | | hyperfide agentmd [--write] | Generate graph orientation as agent-context.md in the context directory (.codify/ by default, .hyperfide/context/ with a hyperfide.kvx); root AGENTS.md and CLAUDE.md remain owned by hyperfide spec render | | hyperfide codemap [-o FILE\|-] [--budget N] [--force] [--check] [--json] | Write CODEMAP.md, the repository map an agent reads first: overview with build and test commands, layout, entry points, modules with their most-referenced symbols, directory dependencies, tests, workflow pointers. Byte-stable, fitted to a token budget (default 8000), never overwrites a file it did not generate; --check exits 1 when it is missing or stale (see Code map) |

Agent control plane

Hyperfide keeps four independent authorities explicit: Git state, Hyperfide snapshot state, declared spec state, and live fenced attempts. hyperfide state shows them together without treating one as proof of another; hyperfide spec reconcile diagnoses orphaned declarations and mutates only with --repair.

Native host hooks feed JSON to hyperfide event ingest. Each event gets a stable semantic identity, occurrence fingerprint, session/attempt identity, exact workspace revision, and evidence delta. hyperfide event progress classifies repeated failure, repeated observation, A-B patch oscillation, and no-evidence windows. Recovery is finite—warn, re-plan, bounded experiment, handoff, waiting for input, optional stop—and advisory unless HYPERFIDE_PROGRESS_ENFORCE=1 explicitly enables the terminal policy.

hyperfide work open composes the objective, criteria, allowed scope, independent state, memories, focused graph context, tests, and latest event into one packet. Its opaque revision feeds hyperfide work update, which returns only changed state, evidence, and workspace paths. hyperfide work close pairs every criterion with durable evidence or marks it unverified.

The adapter registry reports native, portable, or unavailable capabilities for MCP, instructions, skills, hooks, sessions, and cloud execution. Portable assets live under .agents/ and the context directory (.codify/ by default, .hyperfide/context/ with a hyperfide.kvx); existing host configs are merged with recoverable .codify.bak copies, and integrate apply also renders the Claude Code plugin under ~/.codify/plugins/claude-code and writes .codex/hooks.json (--no-plugin skips both). Integrations execute the local hyperfide binary, runtime records stay in .codegraph/graph.db, and none of it makes a network call or sends telemetry.

Governance

These four are what make Hyperfide present at every step rather than only at the bookends. All of them advise by default; only --strict makes them fail.

| Command | Description | | --- | --- | | hyperfide brief | Session state in one call: root, active task with its criteria, uncommitted paths, recent decisions, and whether CODEMAP.md is current | | hyperfide ask raise