{"id":"312a8cee-bd08-41bf-9c9a-028d90a695fd","slug":"hzr","kind":"mcp","name":"hzr","summary":"heAdz0r’s Zero-Redundancy engine — a local-first control plane for leaner coding agents.","owner":"heAdz0r","repoUrl":"https://github.com/heAdz0r/hzr","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":6,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-07-31T20:39:33.000Z","addedAt":"2026-10-21T09:24:55.046Z","logoUrl":"https://avatars.githubusercontent.com/u/13683842?u=82b8bb29390d2a39dc80c0c81d7405cc2bada156&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","memory-knowledge"],"tags":["ai-agents","claude-code","codex","developer-tools","local-first","rust","token-efficiency","context-engineering"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T20:04:08.985Z","sample":false,"url":"https://conduits.dev/tools/hzr","language":"Rust","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"# HZR\n\n

\n \"HZR\n

\n\n

\n \"HZR
\n ▶ HZR in 58 seconds — the recorded benchmark, what interception actually removes, the control plane, and the opt-in public-list cost estimate\n

\n\n

\n One local control plane for efficient coding agents.
\n Search once. Remember once. Execute through policy. Measure what actually happened.\n

\n\n

\n\"Version\n \"CI\"\n \"Release\"\n \"Apache\n

\n\nHZR — **heAdz0r's Zero-Redundancy engine** — turns RTK fork-core, grepai, ICM,\nCaveman-derived response density, policy, and observability into one coherent system.\nIt is local-first, project-scoped, and designed to reduce repeated work without hiding\nwhat was filtered, estimated, or left unmeasured.\n\n> The product is not “another wrapper around tools.” HZR is the ownership boundary that\n> prevents those tools from building competing indexes, memories, caches, and accounting.\n\n## The shift\n\nMost agent stacks optimize isolated steps. Each layer scans the same repository, stores\nits own context, compresses output again, and reports a different idea of savings. The\nresult may look efficient while consuming more work and losing observability.\n\nHZR assigns one owner to each concern:\n\n| Before | With HZR | What you get |\n|---|---|---|\n| independent command wrappers | one policy-aware execution route | bounded output and explicit exact recovery |\n| duplicate semantic stores | one grepai index per worktree | no competing scans or watchers |\n| per-client memory processes | one supervised ICM store | durable context without orphan processes |\n| disconnected counters | one typed operation ledger | actual usage kept separate from estimates |\n| opaque background failures | doctor + lifecycle + local observatory | degraded state is visible and actionable |\n\n## Architecture\n\n```mermaid\nflowchart TB\n CC[\"Claude Code
hook · MCP stdio\"]\n CX[\"Codex · IDE · other agents\"]\n CLI[\"hzr CLI\"]\n\n CC --> D\n CX --> D\n CLI --> D\n\n D{{\"HZRD — control plane
policy · workspace identity · supervision · accounting\"}}\n\n D <--> X[\"RTK fork-core
exec router + output filters\"]\n D <--> S[\"grepai
semantic index + symbols\"]\n D <--> M[\"ICM
durable memory\"]\n D <--> C[\"Caveman-derived
response density\"]\n\n D ==> L[(\"Typed operation ledger\")]\n L --> O[\"Doctor · Stats · Session ROI · Observatory\"]\n P[\"Versioned public pricing
opt-in · overridable\"] -. \"preliminary estimate\" .-> O\n O -. \"repair · policy feedback\" .-> D\n\n style D fill:#e64a19,stroke:#7f2704,stroke-width:3px,color:#ffffff\n```\n\nThis architecture gives HZR three properties that a loose tool collection cannot:\n\n1. **A single decision point.** Agent shell work enters through `hzr exec run`; known\n routes are filtered, unsupported paths are tracked, and ambiguous bypasses fail closed.\n2. **A single project identity.** Search, memory, traces, and UI selection use the same\n repository/worktree boundary. One project cannot become another project's fallback.\n3. **A single operational truth.** Engine health, exclusions, estimates, fidelity requests,\n and incomplete accounting remain visible instead of becoming false savings.\n\nHZR does not invoke every engine on every turn. It selects the smallest sufficient path,\ndeduplicates evidence by identity, and supervises long-lived components centrally.\n\n## Evidence, not slogans\n\nThe 2026-09-25 benchmark reruns the cases an external evaluation measured on a Go repository,\nagainst RAW commands, HZR 0.9.13, HZR 0.10.0 and upstream RTK `v0.50.0`. Each output is also\ncapped at the 30,000 characters Claude Code shows the model, because savings above that window\nnever reach the context.\n\n| 16 cases, host-visible bytes | RAW | HZR 0.9.13 | HZR 0.10.0 | RTK v0.50.0 |\n|---|---:|---:|---:|---:|\n| total | 139,256 | 108,006 | **86,748** | 104,644 |\n| `go test` with a compile failure | 250 | 3,451 | 318 | 275 |\n| `git diff HEAD~5` | 30,000 | 30,000 | **21,187** | 30,000 |\n| `find crates -name '*.rs'` | 6,046 | 6,139 | 965 | 847 |\n| `grep -rn` (lossless) | 10,355 | 10,355 | **8,264** | 10,355 |\n\nHZR 0.10.0 delivers 38% less than RAW and 17% less than upstream RTK v0.50.0 on that set, without\ndropping content silently: every bounded or truncated output names its exact recovery command.\n`git status` is deliberately larger than in 0.9.13, which hid files. Methodology, all cases and a\nreproduction script: [`benchmarks/hzr-vs-rtk-upstream-v0.50.0`](benchmarks/hzr-vs-rtk-upstream-v0.50.0/README.md).\n\nThe earlier 2026-08-01 run against RTK `v0.44.1` reported −23.6% versus upstream, but its largest\nwin (`read README.md`, −95.6%) compared a Markdown outline with the full file — a different\nfidelity, not the same content in fewer bytes ([recorded run](benchmarks/hzr-vs-rtk-upstream-v0.44.1/runs/2026-08-01-v2/RESULTS.md)).\n\nThese values use `ceil(UTF-8 bytes / 4)`. They measure delivered command-output size, not\nprovider billing or total-session savings. In a session dominated by exact file reads\n(`sed -n`, `cat`), which no filter can shrink without loss, the effect on billed input is small;\nHZR's per-turn instruction overhead is 1.6 KB.\n\n## Install\n\nHZR 0.11.5 ships self-contained native bundles for Linux x86_64/ARM64 and macOS\nApple Silicon. Intel macOS is no longer supported. System Git is the only engine prerequisite; Node.js, RTK,\ngrepai, and ICM are bundled. Windows is not currently published.\n\nDownload, inspect, then run the installer:\n\n```bash\ncurl --proto '=https' --tlsv1.2 -fL \\\n https://raw.githubusercontent.com/heAdz0r/hzr/v0.11.5/install.sh \\\n -o /tmp/hzr-install.sh\nsh /tmp/hzr-install.sh\n```\n\nThe installer verifies the release checksum and internal manifest, installs into a\nversioned root, atomically switches `current`, initializes the workspace, and configures\nthe single user service. To separate file installation from agent adoption:\n\n```bash\nHZR_INSTALL_HOOKS=0 sh /tmp/hzr-install.sh\nhzr install --dry-run\nhzr install --force\n```\n\nUseful controls include `HZR_INSTALL_ROOT`, `HZR_BIN_DIR`, `HZR_INSTALL_HOOKS=0`,\n`HZR_INSTALL_SERVICE=0`, `HZR_PROJECT_ONLY=1`, `HZR_FORCE=1`, and `HZR_VERSION`.\n\nOne bundle contains pinned HZR, RTK fork-core, grepai, ICM, caveman-code, Node.js,\nand the Vue operator UI. Exact commits, archive checksums, patch digests, and npm\nintegrity values live in [`engines.lock.toml`](engines.lock.toml).\n\n## First minute\n\nInside a repository:\n\n```bash\nhzr doctor --workspace .\nhzr init --if-needed --workspace .\nhzr daemon status\nhzr search \"where is command policy\" --workspace .\nhzr context plan \"change command policy\" --workspace .\nhzr stats --workspace .\n```\n\nOpen the local observatory at [http://127.0.0.1:47391/](http://127.0.0.1:47391/).\nIt shows the selected project's engine lifecycle, grepai readiness, anonymous memory\ntopology, command routes, exclusions, latency, traces, and accounting posture. Public\nloopback views are bounded and pseudonymized; authenticated detail remains project-scoped.\n\n## Daily control plane\n\n```bash\nhzr read README.md --outline\nhzr read README.md --from 120 --to 180\nhzr search \"authorization boundary\" --mode auto\nhzr context plan \"change authorization boundary\"\nhzr write patch app.rs --old @/tmp/old.txt --new @/tmp/new.txt --cas\nhzr memory recall \"release decision\"\nhzr exec run 'cargo test 2>&1 | tail -80'\nhzr stats --evasion --since 7d\n```\n\nBounded reads retain exact-range recovery; writes are atomic and confined. `hzr build` is an\ninherited fork-core command, so build projects through `hzr exec run ''`.\n\n## Observe an agtx board without operating it\n\nHZR can *watch* an existing [agtx](https://github.com/fynnfluegge/agtx) board — its tasks, their\ndependency graph, the transitions HZR sees while it is watching, which sessions belong to which\ntask, and what that work reportedly cost. Monitoring creates no task, starts no agent,\nadvances no phase and answers no permission prompt on agtx's behalf.\n\nThe pinned agtx runtime and read-only observer ship together in HZR. No Rust toolchain or\nseparate agtx installation is needed. Monitoring remains opt-in and is one command; `onboard`\nverifies the bundled observer itself, then enrolls the project:\n\n```bash\nhzr agents onboard --project /absolute/worktree --agtx-data-dir /absolute/agtx/data\n# New board only: open the bundled app once, then run `onboard` again.\nhzr agents board --project /absolute/worktree --agtx-data-dir /absolute/agtx/data\nhzr agents status --json\n```\n\nThe visualizer gains an **Agents** workspace — board, dependency graph, observed timeline and\ntask economics — fed by the same daemon and privacy projections as every other view. Reported\nusage, reported cost and catalog-priced estimates stay separate; nothing is summed into a fake\ntotal, and an unobserved value renders as an em dash with a reason rather than a zero.\nOwnership, protocol, safety and limits are documented in\n[`integrations/agtx/README.md`](integrations/agtx/README.md); the pinned commit, patch digests\nand the confirmed Apache-2.0 licensing provenance are recorded in\n[`integrations/agtx/PROVENANCE.json`](integrations/agtx/PROVENANCE.json).\n\nThings are named, not numbered. The dashboard shows each workspace by its own directory\n(`hzr`, with `~/Programming/hzr` beside it), each ICM topic by its topic name, each memory by\nwhat it says, and each observed agtx task by its title — with the pseudonymous identity kept\nbeside the name as the stable handle. That is the default because a list of a hundred\n`Project 6a1be071` rows cannot be used to find anything. An install whose loopback port other\npeople can reach turns it off and gets the pseudonymous view back:\n\n```toml\n[privacy]\npublish_workspace_names = false\npublish_memory_content = false\npublish_command_summaries = false # 0.9.1: hide `cargo test --locked`-style command summaries\n\n[integrations.agtx]\npublish_task_titles = false\n```\n\n## Session ROI where the agent can see it\n\nHZR does not wait for someone to open a dashboard. At the end of a session it turns the same\naccounting model behind `hzr stats` into a compact ROI card:\n\n```text\nHZR session ROI\nSaved (estimated net): 8000 tokens (66.7%; gross 8000, regression 0; 12000 -> 4000)\nMeasured commands: 7 | Top: hzr read x5\nPolicy: prevented 5 (1 native denial); asked 0; avoidable leakage 0 ops / 0 tokens\nEvidence: prevented output not estimated | top evasion e10-capability-gap | hook events 464\nShadow guard: T3 observe-only | limit 40 ops / 250000 tokens\n```\n\nThe first line is the measured local reduction from commands that actually ran. The policy line\nis different evidence: a prevented bypass has no output to count, so HZR celebrates the catch\nwithout inventing savings. Zero leakage therefore reads as the good result it is; an unavailable\nledger reads `unknown`, never a reassuring fake zero. Top commands are privacy-safe families,\nnot paths, queries, or arguments.\n\nThe same session boundary can now translate potentially avoided model-input tokens into a\n**preliminary public-list price estimate**. It is opt-in, labels the exact catalog identity and\npricing method, and is never presented as a provider invoice:\n\n```toml\n[billing]\npublic_estimate_enabled = true\nharness = \"codex\"\nprovider = \"openai\"\nmodel = \"gpt-5.6-terra\"\nmethod = \"standard_short_context_lte_272k\"\nrequest_input_tokens = 100000\npricing_basis = \"input\"\n# pricing_file = \"/absolute/path/to/private-pricing.json\"\n```\n\nRun `hzr billing catalog` before selecting a model. The built-in, versioned catalog covers\ncurrent public API prices from OpenAI, Anthropic, Google, DeepSeek, Qwen, Mistral, and xAI.\n`request_input_tokens` is the actual priced request/session input, not the model's maximum\ncontext capacity; tiered prices fail closed when that evidence is absent or outside the method.\nSet `pricing_file` to an absolute JSON path to merge strict overrides by exact pricing key.\nHZR fails closed on an unknown model, method, currency, or expired price; it performs no FX\nconversion. Receipt imports remain a separate evidence class and are labelled user-supplied\nunless a trusted adapter verifies their provenance. Public prices never turn an estimate into a\nprovider bill.\n\n## Make the efficient path the easy path\n\nHaving a good filter is not enough if an agent can reach a familiar RAW command faster. HZR 0.6\ncloses that incentive gap: the normal route needs less judgment than the bypass.\n\n```text\neffective managed route exists → use it; RAW is forbidden\nno equivalent route exists → tracked fallback; no invented savings\nexact bytes are truly required → explicit reason + bounded fidelity allowance\nnative bypass is still observed → E10 finding + zero credit + named replacement\n```\n\n`hzr exec run` accepts the original shell string and chooses the first-class implementation. It\nlooks through common shell and environment wrappers, so wrapping `rg`, `git`, `curl`, or another\nmanaged command does not turn it into an invisible escape hatch. If `hzr exec rewrite` proves an\n`allow_rewrite` decision, an unfiltered route cannot override it.\n\nThis is more than a warning in a prompt. Avoidable bypass is recorded outside the optimized\nbucket, contributes zero reduction, lowers visible coverage, and returns the HZR command that\nshould replace it. A genuinely unsupported operation remains available and auditable instead of\nbeing falsely called optimized.\n\n## Exactness is a controlled capability\n\nBounded output must identify what it represents, what was omitted, and how to recover\nauthoritative evidence. Exact ranges and structured recovery stay first-class. Fully\nunfiltered execution requires an explicit fidelity marker and one closed reason:\n\n```bash\nHZR_RAW_FIDELITY=1 \\\nHZR_RAW_FIDELITY_REASON=machine_protocol \\\nhzr exec run ''\n```\n\nAllowed reasons are `binary`, `checksum`, `machine_protocol`, `complete_log`,\n`full_patch`, and `verbatim_source`. Requests are budgeted before execution; uncertain\npost-execution state stays visible for operator reconciliation. RAW receives zero savings\ncredit. If a managed equivalent exists, the direct bypass remains forbidden.\n\n## One workspace, one index, one memory plane\n\nHZR derives identity from the Git common directory and worktree, or from the canonical path\nbefore `git init`. It owns one grepai store per worktree, one centrally supervised ICM database,\nand one typed ledger with positive project/global namespace checks.\n\nLegacy and foreign stores are diagnosed, never silently adopted. `doctor` is read-only by\ndefault; `doctor --fix` only applies bounded, unambiguous repair paths with backups and CAS.\nFleet reconciliation can migrate one unambiguous root store transactionally. Ambiguous nested\nduplicates require an explicit `hzr migrate archive-index --dry-run`, followed by `--force`\nafter reviewing the source, hash manifest, and retained backup. If a source is recreated at the\nsame path, HZR reports an explicit conflict and makes no mutation; an old manifest cannot hide it.\n\nUse `hzr install --project-only --dry-run` when global activation is undesirable; explicit\n`hzr enable` and `hzr disable` keep that scope visible.\n\nSemantic search needs a local embedding provider. The index is configured for\n[Ollama](https://ollama.com) at `http://localhost:11434` with `nomic-embed-text`\n(`ollama pull nomic-embed-text`); Ollama is not bundled. Without it every search still works\nthrough the lexical ripgrep fallback, and each result names the backend that produced it\n(`ForkRgaiGrepai` or `ForkRgaiRipgrep`). `hzr doctor` probes the provider and reports\n`embedding_provider` as a warning when semantic search is unavailable. Memory recall uses ICM's\nFTS5 lexical retrieval; embeddings for memory are disabled in this release.\n\n## MCP without a second control plane\n\nClients without hooks launch the stateless stdio gateway:\n\n```bash\nhzr init # exact Codex project pin\nhzr mcp config --client claude-code --workspace \"$PWD\" # worktree .mcp.json\nhzr mcp config --client claude-desktop --workspace \"$PWD\" --apply\nhzr mcp status\n```\n\nCodex and Claude Code support exact project scopes. For linked Claude Code worktrees, use the\ngenerated `.mcp.json`/`-s project` registration; HZR never retargets shared local state. Claude\nDesktop is different: it has one selected workspace. In every other project doctor reports\n`unavailable_for_this_workspace` with a retarget-or-CLI action instead of pretending one global\npin can serve the whole fleet. Every mismatched MCP session still fails closed.\n\nThe user-level Codex entry is only a dynamic fallback; every initialized repository keeps its\nexact pin in `.codex/config.toml`. A global install preserves an existing valid Claude Desktop\nselection instead of silently retargeting it. Change that singleton deliberately with\n`hzr mcp config --client claude-desktop --workspace \"$PWD\" --apply`, then reconnect the client.\n\nThe gateway exposes 13 schema-validated tools for context, search, confined read/write,\nmemory lifecycle, managed execution, observability, doctor, and codec operations. It owns\nno database and starts no internal engine; every project-scoped operation goes through the\nsame `hzrd` boundary. The executable contract is\n[`contracts/agent-capabilities.json`](contracts/agent-capabilities.json).\n\n| Capability | MCP tools |\n|---|---|\n| context and code | `hzr_context_plan`, `hzr_search`, `hzr_read` |\n| confined mutation and execution | `hzr_write`, `hzr_exec` |\n| durable memory | `hzr_memory_recall`, `hzr_memory_get`, `hzr_memory_store`, `hzr_memory_update`, `hzr_memory_forget`, `hzr_memory_prune` |\n| operations | `hzr_observability`, `hzr_doctor`, `hzr_codec` |\n\n`hzr_codec` distinguishes four coverage states: `applied`, `shadow_measured`, `instructed`, and\n`unavailable`. A transformed tool/CLI payload is observable and may receive estimated token\ncredit. Claude and Codex cannot let HZR replace every final assistant response, so managed\ninstructions and SessionStart ask for concise generation instead of a post-hoc transform: sending\nfinished prose back through the codec cannot refund tokens already emitted. `hzr_codec` stays an\nexplicit-request and `shadow` evaluation tool, and global-response coverage receives zero credit\nuntil a trusted host confirms replacement. Provider-billed `$` is never inferred from it.\n\nClaude Bash hooks rewrite commands only when an allow rule for the original command is\nconfirmed or the host explicitly reports `bypassPermissions`. Otherwise, including Auto mode\nwithout a confirmed allow rule, HZR leaves the command unchanged for Claude to evaluate. Such\ncalls are unfiltered and receive no savings credit. No broad shell-wrapper allowlist is needed;\nexplicit ask and deny decisions remain enforced.\n\n## Keeping a fleet of projects current\n\nEvery registered workspace carries a managed contract block. When the contract moves, those\nblocks go stale, and a report that can only name 158 stale files across 79 projects is a chore,\nnot a fix. One command repairs them:\n\n```bash\nhzr doctor --reconcile-fleet --dry-run # exact files first\nhzr doctor --reconcile-fleet\nhzr doctor --reconcile-fleet --fix # also stop orphaned engines, prune deleted worktrees,\n # clear failed index watchers\n```\n\nSince 0.8.3 the first session on a new HZR version schedules this pass once, detached from the\nSessionStart hook, and `hzr update` runs it in the foreground. `runtime/reference-state.json`\nand the `reference_state` doctor check report whether it completed, is still running, or ended\nwith findings. Registrations whose worktree directory was deleted are pruned; a root whose parent\ndirectory is also absent is retained in case the volume is unmounted.\n\nIt refreshes stale blocks and creates missing managed Claude/Codex instruction surfaces and\nCodex project MCP pins for already registered workspaces. Claude Code `.mcp.json` remains an\nexplicit project registration. HZR does not register arbitrary directories. Canonical-root\nand symlink-confinement checks keep every write inside its intended workspace, while user-authored\ndirectives outside the block are preserved and reported. Run it from an installed HZR: a binary\nstarted inside a source checkout would hand every other project a contract path only that checkout\nhas, so the command refuses instead.\n\nDoctor also validates the runtime path, not just the presence of index files. A typed semantic\nreadiness probe catches an incompatible grepai configuration, supervised ICM failures stay\nvisible, and a stale cache cannot masquerade as a healthy search plane. Completed global install\njournals become global facts only after their schema, exact terminal stage receipts, and state\nvalidate; incomplete recovery remains bound to its owning\nworkspace. The same auditable waiver rules apply to both current-workspace and fleet checks.\n\nSessionStart uses the same audit for the current project and user-global Claude/Codex surfaces.\nIf it repairs drift or finds a conflict it cannot safely rewrite, the agent receives an immediate\nalert to run `hzr doctor` before continuing. A fleet cannot depend on someone remembering to open\ndoctor after the instructions have already diverged.\n\n## When a project genuinely cannot route through HZR\n\nSome repositories have to name an engine directly: a benchmark whose measured subject *is*\nRTK, or the engine's own source tree. Rewriting those instructions would destroy the thing\nthey measure. Such a project declares a waiver instead of being quietly skipped:\n\n```toml\n# .hzr/policy.toml\nschema_version = 1\n\n[[exemption]]\nrule = \"direct-rtk\"\nreason = \"benchmark-subject\"\njustification = \"This checkout is the upstream RTK baseline that HZR measures itself against.\"\n```\n\nA waiver covers only the named instruction rule, requires an auditable justification, and is\nreported under `fleet_instruction_exemptions`. It never waives the managed block or execution\npolicy: no repository file can buy an exception to a bypass HZR could replace at runtime.\n\n## Honest boundaries\n\n| Guarantee | 0.11.5 posture |\n|---|---|\n| one versioned control plane and pinned engine bundle | implemented |\n| one canonical index owner per worktree | implemented |\n| actual provider usage separated from preliminary public-list estimates | implemented |\n| fidelity bypasses receive zero savings credit | implemented |\n| commands, paths, queries, and raw identifiers excluded from public telemetry | implemented |\n| provider-verified invoice attribution | **not inferred from public prices** |\n| Windows release artifact | **not available** |\n\nHZR never upgrades an estimate into a billing claim. A daemon-free fallback can preserve\ncommand policy but cannot invent a missing ledger receipt; `doctor` and `stats` report the\naccounting gap. Generic semantic equivalence is not inferred merely because output became\nsmaller.\n\nSince 0.6.5 those completeness contracts are executable rather than editorial. Every filtered\nroute declares what it may never drop — exit status, failure lines, warnings, changed files — and\n`fork-core/rtk/tests/must_keep_contract.rs` proves it by running the real filters against output\ncarrying each class. Exact recovery remains available when a proof is absent.\n\nThe delivered-byte benchmark above measures output size, not what a provider bills. The paired\n[billed-input benchmark](benchmarks/hzr-billed-input-prefix-cache-v0.6.5/README.md) tests the\nstrongest objection to it — that a mid-turn filter invalidates a cached request prefix, so billed\ninput can rise while delivered bytes fall. That harness ships in 0.6.5 and **has not been run**;\nit refuses to report a figure without paired provider receipts.\n\n## Built from practical RTK experience\n\nHZR is built by **heAdz0r, an RTK contributor** who has worked directly with the filtering\ntechniques this system extends. The fork is not a reduced reimplementation: HZR preserves\nthe complete imported engine, its provenance, and a deterministic parity contract while\nevolving it behind a broader architecture.\n\nThe immutable `v0.1.0` baseline records the original RTK worktree. Current fork development\nlives in `fork-core/rtk`; provenance and regression rules are documented in\n[`FORK_PARITY.md`](FORK_PARITY.md).\n\n## Frontier planning with Flash workers\n\nKeep your chosen Codex or Claude model as planner and reviewer, and send bounded\nroutine tasks to a cheaper worker through the same HZR tools:\n\n```sh\nhzr settings login --provider opencode-go\nhzr settings delegation --provider opencode-go --model deepseek-v4.1-flash --enabled true\nhzr delegate --file task.md\n```\n\nDelegation is off by default. Each user supplies their own protected key; settings\ncontain no credentials. The worker ends every run with a report (status, changed paths,\nverification commands with exit codes, risks) and one summary line with its tokens; its turn\nquota is extended while it makes progress, and a run without a report exits 2 with a report\nHZR writes from what the worker actually did.\n\n**Delegation sends repository content to the selected provider.** The worker's system prompt\ncarries the repository's `AGENTS.md` and `CLAUDE.md`, the pre-fetched context plan, and every\n`hzr_read`, `hzr_search` and `hzr_exec` result the worker requests travels to that provider's\nAPI (`opencode.ai`, `openrouter.ai` or `api.deepseek.com`). Enable it only for repositories whose\ncontent may leave the machine under that provider's terms. The allowed-file list is an\ninstruction to the worker, not a filesystem sandbox. OpenRouter and direct DeepSeek are also available, with\nan explicit model, turn limit and timeout. Disable with\n`hzr settings delegation --enabled false`. The parent model is unchanged.\n\nWorkers run under the repository's own `AGENTS.md` and `CLAUDE.md`. Rules larger than the\n24 KiB preload budget are preloaded head-first and read on demand, so delegation works in\nevery repository rather than only in small ones. `hzr doctor` reports both the worker\ncredential and that split.\n\nThe visualizer's **Delegation** tab shows real worker activity, exact provider/model,\nand observed token usage. Open its local URL with `?view=delegation` inside Codex.\nWorker completion still requires parent review; no unmeasured savings are claimed.\n\nSee [configuration and permission boundaries](HZR.md#optional-delegation).\nThe [upstream orchestration pattern](integrations/astra-flash-orchestrator/README.md)\nis adapted to HZR's bundled runtime. No external Router, Python, npm or additional\nruntime download is required. These workers appear in HZR's panel inside Codex,\nnot in Codex's native subagent tree.\n\n## Build and contribute\n\nSource builds require Rust 1.85+, Go, Git, Bash, curl, and standard Unix tools:\n\n```bash\nscripts/build-bundle.sh \"$PWD/dist\"\nscripts/package-release.sh \"$PWD/dist\" \"$PWD/dist-release\"\n```\n\nSee [`CONTRIBUTING.md`](CONTRIBUTING.md), [`RELEASE_NOTES.md`](RELEASE_NOTES.md),\n[`CHANGELOG.md`](CHANGELOG.md), [`SECURITY.md`](SECURITY.md), and the immutable\n[`release archive`](docs/releases/).\n\nThe HZR control plane is Apache-2.0. Fork-core and bundled engines retain their own\nlicenses and provenance; see [`NOTICE`](NOTICE) and [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).\n"}