{"id":"f922f608-0986-42a8-9a36-2e9d116cac9e","slug":"curia","kind":"skill","name":"curia","summary":"An open-source Digital Office of the CEO. Communications, scheduling, research, and knowledge work with governance-first architecture.","owner":"josephfung","repoUrl":"https://github.com/josephfung/curia","license":"MIT","licenseTier":"permissive","trust":"community","stars":9,"match":null,"fewStars":false,"format":"skill","createdAt":"2026-03-23T23:34:58.000Z","addedAt":"2026-10-21T17:02:55.378Z","logoUrl":"https://avatars.githubusercontent.com/u/114566?u=45be95df84f1d77f79e1dbd0c7e963afb047d437&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["databases","memory-knowledge"],"tags":["agent","multi-agent","postgresql","single-tenant","typescript","assisstant","assistant-system"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T17:21:16.844Z","sample":false,"url":"https://conduits.dev/tools/curia","language":"TypeScript","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<p align=\"center\">\n  <img src=\"docs/assets/logo-curia-wordmark.svg\" alt=\"Curia\" height=\"48\" />\n</p>\n\n<p align=\"center\">\n  <strong>An open-source Digital Office of the CEO — communications, scheduling, research, and knowledge work with governance-first architecture.</strong>\n</p>\n\n<p align=\"center\">\n  <a href=\"CHANGELOG.md\"><img src=\"https://img.shields.io/badge/version-0.44.0-blueviolet\" alt=\"Version: 0.44.0\" /></a>\n  <img src=\"https://img.shields.io/badge/license-MIT-blue\" alt=\"License: MIT\" />\n  <img src=\"https://img.shields.io/badge/node-%3E%3D24-brightgreen\" alt=\"Node >= 24\" />\n  <img src=\"https://img.shields.io/badge/typescript-ESM-blue\" alt=\"TypeScript ESM\" />\n  <a href=\"https://securityscorecards.dev/viewer/?uri=github.com/josephfung/curia\"><img src=\"https://api.securityscorecards.dev/projects/github.com/josephfung/curia/badge\" alt=\"OpenSSF Scorecard\" /></a>\n  <a href=\"https://www.bestpractices.dev/projects/13136\"><img src=\"https://www.bestpractices.dev/projects/13136/badge\" alt=\"OpenSSF Best Practices\" /></a>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://meetcuria.com\">Website</a> &middot;\n  <a href=\"https://docs.meetcuria.com\">Documentation</a> &middot;\n  <a href=\"CONTRIBUTING.md\">Contributing</a> &middot;\n  <a href=\"SECURITY.md\">Security</a>\n</p>\n\n---\n\n## What Is Curia?\n\nCEOs of knowledge-work companies are buried in digital operations — email, scheduling, research, information processing. The traditional answer is an executive assistant, but the cycle is brutal: hire, invest six months training, watch the institutional knowledge walk out the door when they leave.\n\nCuria is a coordinator and team of specialist agents that handle your communications, scheduling, research, and knowledge work — running continuously on your own server, with institutional memory that compounds over time and never walks out the door. Define agents in YAML, extend with custom skills, connect any channel.\n\nEvery action is logged. Every decision is traceable. Every agent stays in its lane.\n\n| | Typical Agent Framework | Curia |\n|---|---|---|\n| **Security model** | \"Trust the agent\" | Hard-enforced layer separation — channel adapters *physically cannot* invoke tools |\n| **Self-modification** | Agents can edit their own prompts, tools, and code at runtime | Agents cannot modify themselves — new skills, agents, and prompts always require human approval |\n| **Audit trail** | Console.log | Append-only Postgres with causal tracing across every event |\n| **Institutional memory** | Conversation history + flat files (lost or stale across restarts) | Knowledge graph + entity memory + temporal decay (survives restarts, ages gracefully) |\n| **Error handling** | Retry and hope | Error budgets, state continuity, pattern detection — agents resume, not restart |\n| **Agent coordination** | Agents work in isolation | The Bullpen — structured, auditable, threaded inter-agent discussions |\n| **Multi-channel** | Many channels, often without consistent security boundaries | Email, Signal, CLI, HTTP API — every channel shares the same security model and audit trail |\n| **Autonomy** | All or nothing | Five configurable bands — from advisory-only to fully independent, with intent drift detection |\n\n---\n\n## Architecture\n\nFive layers connected by a message bus — four domain layers with hard security boundaries, plus a System layer for trusted cross-cutting infrastructure. No layer can call another directly. Every event is audited.\n\n<p align=\"center\">\n  <img src=\"docs/assets/architecture-overview.png\" alt=\"Curia Architecture — 5 layers connected by message bus\" width=\"800\" />\n</p>\n\n**[Full architecture guide →](https://docs.meetcuria.com/core-concepts/architecture)**\n\n---\n\n## What It Looks Like\n\nAgents are defined in YAML. No code required for simple agents:\n\n```yaml\nname: expense-tracker\ndescription: Tracks and categorizes expenses from receipts and emails\n\nsystem_prompt: |\n  You are an expense tracking assistant for the principal.\n  Extract amounts, vendors, categories, and dates from receipts.\n\npinned_skills:\n  - email-parser\n  - spreadsheet-writer\n\nmemory:\n  scopes: [expenses, vendors, budgets]\n\nschedule:\n  - cron: \"0 9 * * 1\"\n    task: \"Generate weekly expense summary\"\n\nerror_budget:\n  max_turns: 20\n  max_cost_usd: 1.00\n```\n\nNeed custom logic? Add a TypeScript handler — same config, plus hooks for `onTask`, `onToolResult`, and `beforeRespond`.\n\nSkills come in two flavours (local handlers and MCP servers) behind a single interface. Agents discover new skills automatically; sensitive skills require your approval on first use.\n\n**[Agents →](https://docs.meetcuria.com/agents/how-agents-work)** &middot; **[Skills →](https://docs.meetcuria.com/skills/how-skills-work)** &middot; **[Channels →](https://docs.meetcuria.com/channels/how-channels-work)** &middot; **[Security →](https://docs.meetcuria.com/security/overview)**\n\n---\n\n## Quickstart\n\n### Operator install (image)\n\n**Prerequisites:** [Docker](https://docs.docker.com/get-docker/) (with the Compose plugin), `curl`, and an [Anthropic API key](https://console.anthropic.com). No Node or pnpm required.\n\n```bash\nmkdir curia && cd curia\ncurl -fsSL https://github.com/josephfung/curia/releases/latest/download/install.sh -o install.sh\n# Review the script, then:\nbash install.sh\n```\n\nThe installer pulls the published image, generates secrets, runs migrations inside the container, and prints your bootstrap secret. Curia will be running at `http://localhost:3000`.\n\nBy default it installs the **latest release** — both the config files and the image come from it. To pin a specific version, prefix the run with `CURIA_VERSION` (this pins the config *and* the image together):\n\n```bash\nCURIA_VERSION=v0.40.1 bash install.sh\n```\n\nSave the bootstrap secret to a password manager and use it on the login page to create your account.\n\n**To update:** Back up your database first, then pull and restart. Migrations apply\nautomatically on boot; re-running when already up to date is a safe no-op.\n\n```bash\n# 1. Back up the database (custom-format dump, restorable with pg_restore)\ndocker compose exec -T postgres pg_dump -U curia -Fc curia > curia-backup-$(date +%Y%m%d).dump\n\n# 2. Pull new images and restart — the app migrates the schema on startup\ndocker compose pull && docker compose up -d\n```\n\nIf an update misbehaves, restore the backup: stop the app, restore in place\n(`--clean --if-exists` drops and recreates objects), then bring the stack back up.\n\n```bash\ndocker compose stop curia\ndocker compose exec -T postgres pg_restore -U curia -d curia --clean --if-exists < curia-backup-YYYYMMDD.dump\ndocker compose up -d\n```\n\n### Developer install (source)\n\nFor contributing or hacking on the code. Requires Node >= 24, pnpm, and [Docker](https://docs.docker.com/get-docker/) (with the Compose plugin) for the Postgres container.\n\n```bash\ngit clone https://github.com/josephfung/curia.git\ncd curia\npnpm run setup\n```\n\n**[→ Full installation guide](https://docs.meetcuria.com/get-started/installation)**  \n(channels, production deploy, configuration reference)\n\n### Verifying release artifacts\n\nEvery published release is signed with [cosign](https://github.com/sigstore/cosign) (keyless, via GitHub OIDC — no long-lived signing key). The SBOM, source tarball, and the install bundle's `SHA256SUMS` manifest each ship with a `.sigstore` bundle, verifiable against GitHub's OIDC issuer:\n\n```bash\ngh release download vX.Y.Z --dir verify && cd verify\n\ncosign verify-blob --bundle sbom.spdx.json.sigstore \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  --certificate-identity-regexp '^https://github.com/josephfung/curia/.github/workflows/release.yml@' \\\n  sbom.spdx.json\n```\n\nThe install bundle (`install.sh`, `docker-compose*.yml`, `env.example`, `Caddyfile`, `setup-common.sh`) is covered by one signed manifest — verify it, then check the files against it:\n\n```bash\ncosign verify-blob --bundle SHA256SUMS.sigstore \\\n  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n  --certificate-identity-regexp '^https://github.com/josephfung/curia/.github/workflows/release.yml@' \\\n  SHA256SUMS && sha256sum -c SHA256SUMS\n```\n\n`cosign verify-blob` prints `Verified OK` on success and exits non-zero on failure — the `&&` above ensures a failed signature check stops before `sha256sum -c` (which only checks hashes, not authenticity) can print a misleading pass. If either command fails, do not trust the downloaded assets.\n\n---\n\n## Contributing\n\nCuria is in early development and welcomes contributions — including AI-assisted ones.\n\n- Read the **[Contributing Guide](CONTRIBUTING.md)** for dev setup, code standards, and how to add channels, skills, and agents\n- Read **[CLAUDE.md](CLAUDE.md)** for repo-level conventions (if you're using Claude Code, these load automatically)\n- See **[GOVERNANCE.md](GOVERNANCE.md)** for project roles, maintainers, and how decisions are made\n- Check **[open issues](https://github.com/josephfung/curia/issues)** — look for `good first issue` labels\n- Report security vulnerabilities via **[SECURITY.md](SECURITY.md)** — not public issues\n\nWe evaluate code quality, not authorship. AI-generated contributions are held to the same review standards as human-written code. See the [AI contributions policy](CONTRIBUTING.md#ai-assisted-contributions) for details.\n\n---\n\n## License\n\n[MIT](LICENSE)\n"}