Tend

Coding agents are good at completing individual tasks. Running them unattended across multiple repositories is a systems problem.

Work needs to be prioritised, scoped, approved, isolated, reviewed and resumed after failure, all while staying within provider quotas. I built Tend to manage that operational layer without giving an agent unrestricted access to my repositories.

Running on a Mac mini, it plans work, manages a global queue, dispatches isolated coding workers and leaves completed pull requests ready to review by morning.

GitHub as the control surface

A PRD begins as a GitHub issue. Tend breaks it into bounded implementation issues, but does not start work until I approve them by changing a label.

The workflow stays deliberately constrained:

PRD → draft issues → human approval → implementation → checks and review → ready to merge

Planning, maintenance, orchestration and implementation are separate roles. This keeps approval, scheduling and repository mutation independent instead of burying the entire workflow inside one prompt.

Bounded autonomy

The central design challenge was making Tend’s autonomy legible and limited.

Workers operate only on approved issues, never write to my working copy and leave uncertain decisions for me. Tend allows three concurrent workers, with only one active worker per repository. Each receives a fresh worktree, allowlisted checks and an isolated environment without ambient credentials or shell configuration.

Before unattended work begins, Tend verifies executable paths, workspace ownership, credentials, backend permissions and GitHub mutation settings. If those checks fail, it stops.

Quota-aware routing

Tend routes work through Codex CLI, Claude Code or Cursor according to availability and remaining quota. Provider accounts and coding backends are modelled separately, so a task is not permanently coupled to one route.

When a quota is exhausted, Tend preserves the worker’s context and prepares a handoff. A constrained-budget mode applies tighter dispatch limits and rejects routes whose quota state is unknown or too close to its cap.

Recovery by design

Overnight automation must assume processes, networks and provider sessions will fail.

Tend records worker heartbeats, branches, pull requests, backend sessions, checks and workstream notes. After a restart, it reconstructs state from GitHub and resumes only when the next action is unambiguous.

GitHub remains the source of truth. Local SQLite state improves visibility and recovery speed, but never overrides repository state or discards unpushed work.

An operational interface

A local dashboard shows active and queued work, items needing attention, pull requests ready to merge, backend quotas, checks, reviews, service health and run history.

A morning digest summarises completed work, blocked issues, provider usage and anything requiring intervention. The interface is operational rather than conversational: what is running, what needs me and what happened overnight?

Outcome

Tend is now a working macOS service with real GitHub mutation, isolated worktrees, backend routing, quota telemetry, crash recovery, review handling, structured logs and an automated test suite.

It is not a general-purpose agent platform. It is a focused personal workflow for safely turning approved intent into reviewable software while I am away.