Ticinuum builds Ticinuum

Fine-grained roles from viewer to system admin, membership across many orgs, and single sign-on (OIDC) with just-in-time provisioning.

Sign in with email first — Ticinuum offers only the methods you've actually set up: password, passkey (Touch ID / Face ID / a hardware key), a one-time magic link, or your org's SSO.

End every session you hold, across every org, with one click — triggered automatically on a password change or when an admin removes you. Signing out of an SSO org also ends your session at the identity provider, so a shared machine can't silently pick up where you left off.

Tickets drive work end to end — grooming, dispatch, agent runs, review, and merge — orchestrated durably so nothing is lost on a restart. A backlog ticket can also be groomed manually, on demand, from mobile or the console.

Match the right agent to each stage of work, and bundle reusable role-to-agent squads at the org, project, or ticket level.

Per-org dashboards for spend, velocity, agent quality, and flow — with trend insights that flag what moved and why, attributable by ticket type and label.

Every sensitive action lands in an append-only, searchable audit log with CSV, JSONL, and JSON export.

Pick your default model, curate the active model set, and bring your own provider keys, encrypted at rest.

Describe what you want in plain language and Ticinuum drafts a complete, validated ticket spec — attachments included.

Attach repositories to a project from a cached catalog on either GitHub or GitLab; the developer and reviewer act as separate identities on the host, so reviews are a real second signature.

Every project is a workspace with its own Overview, Tickets, Runs, Repositories, Agents, and Settings tabs — reachable by a short project key, not just a UUID. Projects can be archived and restored from Settings without losing any tickets, runs, or artifacts. The /projects index offers a card/table toggle, with the table showing per-project time, cost, tokens, and top labels — searchable, filterable, and sortable.

A global kill switch, per-org daily budgets, per-run token caps, and a prompt-injection safety gate protect every run.

Optional double-opt-in signup that provisions a new organization and its first admin — off by default, flipped on by an operator.

Welcome, invite, password-reset, and confirmation emails — enabled the moment you add a provider token.

Spend budgets and threshold alerts by org, project, user, or team, plus period-close chargeback export (CSV/JSON).

Group people and projects into org-chart teams as cost centers — with per-team daily budgets, reconciling team spend rollups, and a member directory.

Point Ticinuum at an existing pull request it didn't open, for review-only workflows on your own repos.

Cryptographic hash-chaining so the audit trail is provably intact end to end.

Per-agent, per-version attribution so you can finally answer whether a given agent change actually helped.

Turn pull-request review comments into tracked follow-up work automatically, on by default.

Email and in-app inbox alerts when an agent needs your input, a run fails, or spend hits its cap — with per-category preferences and admin broadcasts, on by default. SMS and desktop channels are on the roadmap.

When a run is waiting on your approval, your phone or watch rings with an actionable notification, so the work doesn't sit until you next open the app. Off by default; an operator turns it on.

Facts that aren't events — no live executor, a fleet behind its release, a maintenance window — sit in a banner above every page until they stop being true, instead of scrolling away in the inbox.

Labels at creation time with typeahead, multi-label filtering, and agents that label the work they touch.

See what the platform is doing and where it is under pressure: metrics, distributed traces that follow one ticket across every service, logs, and continuous profiling — exported over OpenTelemetry to your own stack, with a self-hosted Grafana/Loki/Tempo/Mimir/Pyroscope setup and dashboards included. Every role also serves a Prometheus /metrics endpoint you can scrape directly, with no collector to deploy; traces, logs and profiles stay off until you point them at one.

Evidence-backed, confidence-scored findings surface between tickets and feed the same decision surface — triage, dismiss, fan out to tickets, or plan together. The original scheduled-squad execution model has been fully replaced by ticket-plane research tickets and patrols (see "Research tickets" below), which is what now produces these findings. The triage workspace now shows recurrence ("seen 17× · last 4m ago"), a Watching status for findings you don't want to act on today but do want to hear about again, an explainable attention score to rank what needs a look first, likely-related findings clustered into dismissable/splittable suggested groups, a group-by switch, a split-pane detail view, and saved views alongside the bulk triage bar.

Your dashboard, board, and ticket pages update the moment status, runs, or activity change — pushed live, with no manual refresh and no waiting on a timer.

View transitions across the app for faster, calmer movement between screens.

Link parent and child tickets, create a prefilled sub-task in one click, and hand the agent the reference material a ticket points at.

Child tickets inherit their parent's owner, so planner-created work arrives already assigned instead of waiting on manual triage.

Retune operational settings — budgets, feature toggles, and the execution controls — from an admin console at runtime, with no redeploy.

The whole HTTP API — token bootstrap included — under one committed OpenAPI contract, with a built-in, version-accurate reference at /ui/api-docs and the raw contract downloadable for client generators.

Let Claude Code on your laptop read and act on your tickets, initiatives, findings, runs and projects as you, over an authenticated, revocable credential — and declare which ticket its work belongs to. Connect by URL and sign in through your browser, with no secret to copy and paste. Off by default; an operator turns it on.

Meter the AI spend your engineers cause running Claude Code on their own laptops, attributed to the same tickets and initiatives autonomous runs report against — so a cost figure finally covers both halves of the work. Off by default; an operator turns it on.

The ticket page reads top to bottom as Understand → Observe → Investigate: one status/health strip and result card up top answer state and outcome at a glance, a single needs-you block replaces what used to be seven separate banners, execution telemetry (runs, work items, cost & time) sits in its own Observe layer, and artifacts/logs/dependencies/audit trail sit in Investigate — every panel remembers whether you left it open or closed.

A failed run reads as a plain headline, detail, and next step instead of a raw error string — the original message stays one click away under "Show technical detail". Turn on AI-explained errors (off by default) for a cheap-model rewrite that loads only when you scroll to it, never on page load, and never spends anything until you opt in.

/tickets, /runs, /findings, and /projects each open on a one-line verdict, a small set of at-a-glance stat chips, and a short, ranked list of what needs your attention — every item deep-links straight into the filtered table below it. The full filterable, sortable table stays exactly as it was underneath, unchanged.

Ticinuum reads your repository's own AGENTS.md, CLAUDE.md, Cursor rules, Copilot instructions, and SKILL.md files and hands them to the agent as clearly-labeled reference material — never as instructions it blindly obeys. A discovered SKILL.md is listed by name and description up front, with its full content fetched only if the agent decides it's actually needed.

When an action like "Address on this ticket" can't run right now (a run is in progress), the control shows exactly why instead of letting you click into an error. Where the reason is temporary, you can queue it instead — "Do it when the run finishes" — and it runs automatically the moment that becomes true, with a cancel option while it waits.

A planning or investigating agent can hand off a bounded sub-task to a persona-pinned child, under the same tree depth/count caps, lease, and budget as the ticket it runs on. The child work item shows nested under the run that delegated it, right on the ticket page, and an autonomous ticket starts the child straight away and waits on it, while a supervised one holds the child until you promote or decline it.

Your repository declares its load-bearing parts — schema, public API, shared config — and a change that touches one says so on the ticket, attaches what changed, and can ask a specialist to look or a person to approve before it lands.

Every per-org choice lives in one settings registry with one API: an operator makes a feature available, your admin elects it — with a plain-language disclosure for anything that spends money or acts on its own — and features mature from opt-in to default without a migration on your side.

A platform release never strands your executors: older versions keep working within a published compatibility window, a run that needs a newer one waits rather than failing, and an executor that falls out of the window is shown as out of date rather than silently missing.

Fold a duplicate into the ticket that survives: a preview first, then links, scope and history carried across, with the merged ticket pointing to its survivor and the audit trail recorded on both.

Every open ticket says what it is waiting on, how long it has waited, and whether that is on track, at risk or off track compared with similar work in your own org — so a stuck ticket is visible before anyone has to ask.

Findings carry the same labels tickets do, plus two shared vocabularies — what kind of problem it is and what it puts at risk — so you can filter, count and act on findings by concern and impact.

See how much work waited and why — queue times, peak demand against your ceilings, and a clear answer on whether executors, throughput, or placement labels are holding you back.

Point a read-only agent at a question about a repository and get evidence-backed findings back, running on the same guardrails and grants as every ticket. The one-shot investigation is built, and a patrol console lets you schedule a recurring one — create it, run it once or on a cron schedule, pause/resume it, and review its firing history, with a distinct persona per question in the roster. The older missions console and its scheduled-execution engine are fully retired, mission tables included.

A "What are you trying to accomplish?" front door ahead of "+ New", behind an opt-in toggle — anything vague births an Initiative, a thin intent container matured through a cheap-model sparring conversation that treats killing a bad idea cheaply as a success, not a failure. It matures into a versioned Objective and forks three ways — Plan, RFC, or Reject (a rationale-backed decision not to build, scored as a success) — each commissioning real tickets or closing the initiative out. The circle closes: when every commissioned ticket finishes, the initiative concludes delivered, and a human-directed revise run can propose a new Objective version back onto it. A finding from the findings triage queue can also start an initiative directly, rather than only becoming a ticket. The older mission execution path this replaces is fully retired, mission tables included; the semantic-similarity layer the post-firing overlapping-findings digest was waiting on now exists (see "Findings" above), and each patrol digest refreshes the same finding-group suggestions automatically.

Choose, per kind of artifact — your repository snapshot, diffs, run logs, and more — whether it stays with Ticinuum or is never produced at all. Settings → Data residency offers presets plus an advanced per-family matrix, with what-you'd-lose disclosure and an irreversibility warning before you turn one off; enforcement holds at both the storage gateway and the agent itself, which is told never to produce a declined artifact's bytes in the first place. You can also point Ticinuum at your own S3-compatible bucket: once you have configured and verified it, your artifacts, run logs, repository surveys, attachments and webhook payloads are written there and read back from there, and every record remembers which bucket holds it — so turning this on later, or changing it, never orphans anything written before. A read-only key is optional: without one we show each artifact's type, lineage and location rather than its contents, and say so plainly instead of showing an empty panel. Bring-your-own-storage currently applies to every artifact kind at once; choosing it per kind is still ahead.

Postpone a ticket until a date, another ticket, or a stewardship signal, with a review date so a parked ticket is never forgotten. Postponed work drops out of the attention lists and health signals, and the time it sat parked is taken out of lead and queue time, so a deliberate wait does not read as a slow team.

Instead of one generic box above every table, each page's header now shows what that page's job actually calls for: Tickets leads with a stage-by-stage flow read, Runs shows live progress on every in-flight run, and Projects carries a live state line and a create action right in the header. Patrols and the audit trail are still catching up to the same treatment.

Every change in flight gets a stable identity, a graph shows how in-flight changes overlap, conflict or depend on each other, and related changes land together in a deliberate order rather than one pull request at a time.

Treat a project's repositories as one workspace: one ticket can change the service, its docs and its mobile app together, with every pull request reviewed and revised on its own and the ticket landing only when all of them are ready.

Pick a named profile — how wide a plan fans out, which model each role uses, how much context carries between runs, how hard review looks — per org, project or ticket, see an estimate before anything spends, and compare profiles on real outcomes afterwards.

A ticket's size and risk decide who builds and who reviews it, a failure climbs to a stronger model instead of repeating, and a ticket closes only for what was actually delivered — the rest becomes its own follow-up.

Every change that merges was reviewed in full, never just the part that fit. How hard the reviewer looks, and what it looks for — security, data, performance — is chosen from the change's own facts.

New models and price changes appear without waiting for a Ticinuum release, a retired model keeps its history and points to its successor, and tier names like "fast" or "best" always resolve to a current model.

When a check fails for a reason a change didn't cause — a broken main branch, a flaky dependency — it is reported once, fixed once ahead of the work it holds up, and everyone waiting on it is told when it clears.

A question, an approval or a choice can be put to a person, a team or a role about any ticket, finding or initiative — with a deadline, reminders and an escalation — and answered from the web, mobile or Claude Code.

When something you elected is no longer in force — a consent that expired, a feature an operator turned off, a changed default, a new agreement to accept — every surface says so until it is fixed.

Every queue reports how many items wait and how long — median, slowest and oldest — and a backlog ticket that has gone stale is put back to its owner to confirm, rather than rotting or being closed as a failure.

Set org-wide rules for which changes need a person's approval, who may approve (including separation of duties), how long an approval may wait, and who is told — composed with what each repository declares.

Restart, upgrade, move or retire an executor and its in-flight work drains or hands off to another one instead of failing — and you're told ahead of time, by name, before a platform release would leave any of your executors behind.

Download the executor and the tici CLI straight from the app and install with a single command on Linux or macOS, with an installer for every platform to follow.

Connect more than one GitHub account or organization to a Ticinuum org, with each run's access drawn from the account that owns the repository — or bring your own GitHub App.

See the dependency graph a planner produced for a feature — its critical path, how much could run side by side, and where retries landed — so you know whether more executors or a different plan would finish it sooner.

Executors declare what they can run — a browser, services, a test stack — and each change is routed to an environment that can actually verify it, with a QA stage that exercises the change before review.

A guided first run — connect GitHub, create a project, and dispatch your first ticket in minutes — plus clean account and workspace teardown when it's time to leave.

Everything you can do in the web app — promote and run a ticket, approve a gate, answer a question an agent is waiting on, approve a review, and, for admins, manage settings and budgets — from Claude Code or any MCP client, as you, with your own role's permissions. Actions that spend your budget or can't be undone ask before they act.

See the money, time, volume, and outcome for an entire feature — not just one ticket — including what failed attempts cost, from a ticket panel or a dedicated Features tab. A read that can't reach the numbers says so plainly instead of showing a misleading zero. Behind an opt-in toggle; a cross-portfolio view and mobile are still ahead.

A new Analytics → Efficiency page tracks tokens, dollars, and time per ticket by stage against your org's own recent baseline, with candidate causes marked on the trend. Every canned alert — a stage that shows up out of nowhere, one that stops producing usable results, a cost or time step-change, a pricier model tier — is on by default and configurable from Settings → Budget & limits → Alerts, delivered in-app and by email. A custom-rule builder and full validation against real-world history are still ahead.

When agents write database migrations, each one lands in order against the latest schema, is re-verified if the base moved, and removes anything only after a deprecation period.

Type what you want in one place. Ticinuum checks it against your projects and past work, proposes where it belongs and whether it is a ticket, a plan, a question to verify, or something you already have — then creates it in two keystrokes, or asks one question first. Requests, findings and patrol output all pass through the same intake, where they are scanned, sorted and approved before they become work.

A hostile-by-default intake lane that turns raw customer reports into safe, triaged, actionable work. A signed support webhook already turns reports into scanned requests at intake; a dedicated portal is ahead.

Teach agents your conventions with repo-scoped knowledge files injected right into their context.

Prove you own an email domain with a DNS record, and route that domain's sign-ins to your identity provider with confidence.

Ticinuum renders its own emails and can deliver them through any SMTP server you already run — useful for on-premises and air-gapped installs.

Stronger sandboxing that further isolates agent execution from platform secrets and other tenants.

Deployment options spanning shared to fully isolated per-tenant databases and workflow namespaces.

Authenticator apps, passkeys and recovery codes as a second step at sign-in, an org policy that can require them, and a fresh check before the actions that matter most.

Keep your agent personas and squad in a .ticinuum/ directory in the repository itself, reviewed like any other code and approved by an admin before it takes effect.

Move a project and its tickets, runs and history to another org: previewed first, accepted by both admins, with ticket keys unchanged and the audit trail left where it happened.

A daily reading — Build, Build and pay down, or Pay down first — computed from your own findings, rewrites and breakages, shown at the moment someone commits new work.