Pensiero Profondo

What it adds to plain Claude Code is the method: who is allowed to claim a number, what happens to a number after it is claimed, how a second agent is made to disagree on purpose, and what has to be true before anything leaves the machine under your name.

Six ideas

1. Agents contradict, they do not split. A crew is not a pipeline; when a member states a result, the tool's default next step is to make another member try to break it.
2. A number has a life. A claim is declared, attacked, re-derived blind, and measured on the artifact with the canonical tool, each stage a blackboard entry with an author and a clock time.
3. The blackboard is untrusted by construction. Every entry a member receives is framed as text written by another session, not by the owner, and it authorizes nothing on its own.
4. Authorizations do not carry over. Anything outward needs the owner's words for that specific thing; a proposal collects consents and expires, and silence is not consent.
5. Time comes from the clock. Every entry is stamped by the server at write time; agents may estimate anything except when something happened.
6. Roles pull reasoning out. A model asked whether a claim is right hedges; the same model told it is the lookout whose job is to refute finds the flaw.

Roles

How a crew works

1. Set the studio goal: what would satisfy you. Every Captain's round starts from it.
2. Sign on a member: pick a role, a machine, a working directory, and write a brief. A session starts; its first message is the goal, the brief, and how to use the board.
3. Members declare (preso), work, report numbers (numero with a value, a unit, a source), and finish (fatto). Anything addressed to a member, its role, or everyone is delivered into its session inside the frame.
4. You attack a number. The Lookouts' verdicts land as attacco entries under it; the ritual closes when they have all answered.
5. Nothing leaves the machine because an agent said so. A proposta collects explicit consenso entries and waits for your words in the UI; a previous yes does not carry over.

Install

Node 20 or newer and a working claude login. The sessions run under your own Claude Code subscription or API key; pensiero has no account and sends nothing anywhere.

git clone https://github.com/nerln/pensiero-profondo.git
cd pensiero
npm install
npm run build
npm link            # gives you the `pensiero` command

Then, in the directory of the project your crew will work on:

pensiero init         # creates .pensiero/ with the studio, the default roles and a token
pensiero hub          # starts the hub, the UI and a worker for this machine

Open http://127.0.0.1:4177. To attach another machine:

pensiero worker --hub ws://HUB_HOST:4177/ws/worker --token TOKEN --name nuc

The token is in .pensiero/config.json. A browser on the hub's own machine gets it from the page; a browser on another host adds ?token=TOKEN to the URL once. Bind the hub to a non-loopback host with pensiero hub --host 0.0.0.0 only on a network you trust.

From inside Claude Code

Add pensiero as an MCP server and drive the crew without leaving the terminal:

claude mcp add pensiero -- node dist/cli.js mcp .

For the desktop app's browser pane, a launch configuration starts the hub and opens the UI:

{
  "version": "0.0.1",
  "configurations": [
    {
      "name": "pensiero-profondo",
      "runtimeExecutable": "node",
      "runtimeArgs": ["dist/cli.js", "hub", "."],
      "port": 4177
    }
  ]
}

Security model

The board carries text from one session into another. That is the feature and the risk. Four things hold regardless of what an entry says: every delivery goes through one frame; every quoted line starts with | ; entries are capped at 700 characters and deliveries at 12; and the hub never executes anything found on the board. The frame's wording is the fifth defence and the weakest, which is why it is listed last.

Every API call and every UI socket presents the token, loopback included: a web page open on the owner's machine is loopback too, and without the token it could sign on members or read transcripts. The page served on loopback carries the token, and another origin cannot read that page because the hub never sends CORS headers; a browser on another host adds ?token= once. Worker sockets carry the token in their first message and are refused if they come from a browser. A worker may only speak for members on its own machine. There is no other authentication.

Status

v0.1. Working: init, hub, local and remote workers, live transcripts, send, interrupt, model change, the board with frames and caps, the Attack ritual, budget cap. The Cartographer and the Boatswain exist as roles you sign on by hand; their rituals (blind re-derivation, arbitration) are not automated yet. Not yet in the UI: council and consent rituals, gates, a Captain adapter for non-Claude models, a permission approval flow for tool calls. Until that flow exists, a tool call that would ask for permission is allowed for roles under acceptEdits and denied for roles under dontAsk, so a role that must stay narrow lists its tools or uses dontAsk.