Private-first, public-shaped: designing our first public product
Two days between a manual fleet sweep and a buildable spec: the market check, the four design decisions that mattered, and the dogfood gate behind muster.
The last post ended with a manual experiment: Claude sweeping sixteen live agent sessions and handing me one owner-tagged list of everything waiting on someone. This post is about the two days between that sweep and a buildable spec, because the decisions made in those two days are the reason the thing exists as a product and not another private script in my dotfiles.
The decision to go public at all
My ecosystem is full of internal tooling. Skills, hooks, daemons, sync machinery. None of it is published, and that’s deliberate; most of it is shaped like me. The fleet sweep felt different for one reason: the problem isn’t shaped like me. Anyone running multiple agent sessions has follow-ups rotting in scrollback. The herd is getting bigger everywhere.
So the first move after the sweep wasn’t code, it was a market check. We swept the herdr plugin marketplace for prior art. A PR tracker validated the poll-and-scrape pattern. A telemetry bridge validated the append-only feed shape. A todo plugin handled capture, but in-session and single-session only. A status pane showed which agents were alive but nothing about what they were carrying. Nothing did fleet-wide follow-up extraction. The niche was open, and adjacent plugins had already proven every mechanism we’d need. That’s about as inviting as a market check gets.
The posture we settled on has a name I keep reusing: private-first, public-shaped. The repo was born with a plugin manifest, a real README, MIT license, and secret scanning wired in, exactly as if it were public. But it stays private until it survives at least seven consecutive days of real use on my own fleet. The publish step is a gate with written criteria, not a mood. If it can’t survive my own daily use for a week, nobody else should be running it.
And the name: muster. Claude coined it during the greenlight session and I ratified it the next day. Mustering is gathering the herd; a muster is also the roll-call report. For a plugin that gathers herdr sessions and reports who’s waiting on whom, I have yet to find a word that works harder.
The design session
The spec came out of a brainstorming session the next evening, and I can compress it to the four decisions that mattered.
An event log is the only source of truth. Every capture, every ack, every snooze is one appended line of NDJSON. A reducer folds the log into the current board state, and that derived file is disposable: delete it and it rebuilds from the log. Nothing ever mutates state directly, including me. When I dismiss an item, that’s just another event, stamped as human. This one decision quietly bought us most of the product: the board, replay-based testing, an audit trail, and safe recovery from mistakes. It also cost us something real, and a later post about our first dogfood day covers the accidental-ack story that exposed the tradeoff.
The floor must work with no LLM and no cooperation. This is the decision I’d defend hardest. Capture is tiered. Sessions that cooperate can self-report through a hook, which is the highest-trust lane. But the floor underneath is a deterministic parser over pane scrollback: no model calls, no API keys, no requirement that a session do anything at all. A public plugin cannot assume its users have a frontier model on tap, and a follow-up tracker that silently misses sessions is worse than none. The optional model-assisted lane exists in the design, off by default. The floor is the product; everything above it is enrichment.
The feed is the truth; Todoist gets a photograph of it.
One feed, many sinks. The feed doesn’t care who consumes it. The herdr sidebar shows each session’s headline: owner tag, open count, top item. A board TUI shows the full fleet list, grouped by court, and enter jumps you to the source pane. A notify hook pushes to whatever you wire it to. And Todoist gets snapshots on demand, never a live mirror. That last clause is a scar from years of tool-sync pain: two systems that both claim to be current are a lie waiting to happen. The feed is the truth; Todoist gets a photograph of it.
Trust is a document, not a vibe. A plugin that reads your terminal scrollback deserves suspicion. So the repo — still private until the gate clears — carries a TRUST.md that states exactly what muster reads, what it writes, and what it never does, including the unflattering parts: captured text is stored verbatim, so if a secret is on your screen it’s in the feed. No network calls of its own. No LLM calls, period, until you explicitly opt in to a lane that doesn’t ship yet. Writing the limits down honestly felt like the price of asking strangers to run this next to their work.
Success criteria, in advance
The spec closes with the test the product has to pass, written before any code existed: the sidebar shows per-session state with zero manual effort; the board answers “what’s waiting on whom” fleet-wide in under five seconds; the phone buzzes on exactly three classes of event and never repeats itself; the floor works with zero LLM configured; and it publishes only after the seven-day dogfood gate.
Writing that list before building turned out to matter more than I expected, because the build didn’t happen the way builds normally happen. Sixteen tasks, a plan on disk, and a decision that felt slightly reckless at 1am: let the agents build the whole thing overnight while I slept. That’s the next post.