🇧🇷 Leia em Português

Install in 1 Minute · Documentation Website · Architecture · Testing · Security · Docs Map · References · Contributing

Five autonomous AI agents. Fifty-three governed research skills. Zero cloud dependency. Every trusted insight is source-validated. Agent learning is governed, project-scoped, and auditable. Scale your intelligence: share compute between team members to run more agents simultaneously—a smarter, faster team working as one agentic swarm.

View product screenshots

Intelligent Chat: Talk to your research context. Ask about findings, brainstorm with agents, and get instant answers grounded in your data.

Atomic Research Findings: Extract candidate atoms, validate them against source evidence, then promote accepted nuggets, facts, insights, and recommendations. Every trusted claim stays linked to its original source.

Laws of UX Compliance: Audit your designs against 30+ psychological principles and Nielsen heuristics. See exactly where your UI excels or needs improvement.

Autonomous Task Management: A powerful Kanban board where agents pick up tasks, execute skills, and report progress in real-time while research outputs remain reviewable until approved.

Multi-Agent Assignment: Choose the best agent for the job. Route tasks to specialists like Pixel for UI audits or Sage for UX evaluation.

Interviews & Transcripts: Istara can transcribe, tag, analyze, relate, and generate reports from many interviews at once — including voice messages from WhatsApp and Telegram with automatic Whisper transcription and inter-coder reliability scoring. Find insights shared across your entire participant pool!

Context Engine: Ground your agents in your company culture, project goals, and specific guardrails. The more they know, the better they perform.

Skill Catalog: Over 50 research skills ready to go. From Competitive Analysis to Card Sorting, your agents are equipped for any research challenge.

Agentic Swarm: Meet your team—Cleo, Sentinel, Pixel, Sage, and Echo. Five specialized agents that learn from verified outcomes, project-scoped telemetry, and governed process memory.

Google Stitch & Figma Integration: Generate screens with AI, connect Figma for handoff specs, audit components, and close the gap between design intent and dev implementation.

Messaging Channels: Deploy your research directly to Slack, Telegram, or WhatsApp. Collect data where your users are, managed entirely by your agents.

Survey Integrations: Pull data from SurveyMonkey, Typeform, or Google Forms. Responses enter the same evidence-unit, coding, reliability, review, and report-gate pipeline as interviews and documents.

Autoresearch Engine: Enable sandboxed self-improvement loops. Agents measure candidate prompt, RAG, or model changes, revert them after evaluation, and send successful candidates through governed approval before production use.

Ensemble Health: Trust through verification. Istara uses multi-model coding, reliability metrics, route evidence, adversarial review, debate rounds, and human reconciliation before evidence becomes reportable.

brew install --cask henrique-simoes/istara/istara

Installs all dependencies (Python, Node, LLM provider), sets up the server, and offers to start it:

curl -fsSL https://raw.githubusercontent.com/henrique-simoes/Istara/main/scripts/install-istara.sh | bash

git clone https://github.com/henrique-simoes/Istara.git
cd Istara

# Backend
cd backend
python3 -m venv venv && source venv/bin/activate
pip install -e ".[dev]"
uvicorn app.main:app --host 0.0.0.0 --port 8000

# Frontend (new terminal)
cd frontend
npm install && npm run dev

git clone https://github.com/henrique-simoes/Istara.git && cd Istara
cp .env.example .env
docker compose up -d

curl -fsSL https://raw.githubusercontent.com/henrique-simoes/Istara/main/scripts/uninstall-istara.sh | bash

DMG / EXE Installers: The native desktop installers (.dmg for macOS, .exe for Windows) available on the Releases page are currently experiencing issues and should not be used. Use one of the methods above instead. We are actively working on a fix.

Open http://localhost:3000 after starting. The onboarding wizard guides you through your first project.

Istara's public-release process is now evidence-first. Development runs through Compass Forge work orders, impact analysis, and gates; test history is kept as curated release baselines instead of scattered temporary logs.

• Testing and evals: see TESTING.md, testing/TESTING_STRATEGY.md, testing/AI_EVALS_STRATEGY.md, and testing/TEST_HISTORY.md. The suite covers backend contracts, frontend build/type/lint/unit checks, relay tests, simulation, orchestration benchmarks, live single-profile LLM checks, RAG, Prompt RAG, LLMLingua, DAG/ReAct, ReasoningBank, Memento Skills, Meta Hyperagents, thinking-output controls, and voice contracts.
• Public testing branch and CI: every feature change is mapped to deterministic obligations by testing/feature_coverage.yml + scripts/check_feature_obligations.py (fail-closed on unowned paths). The long-lived testing branch builds a disposable, provider-agnostic Docker QA artifact (docker-compose.qa.yml, scripts/istara-qa.sh), and promote-testing.yml is the only workflow that may create a promotion PR to main — and only after a protected-environment human approval bound to the exact source SHA. No workflow auto-merges, and CI-generated commits (README badge sync) stay on main only, so testing HEAD is never mutated by CI. The promotion workflow's green-checks verification lists Actions runs with an actions: read-scoped workflow token, enforced by scripts/check_workflow_contracts.py.
• Security: see SECURITY.md, security/SECURITY_BENCHMARK.md, security/RELEASE_SECURITY_READINESS.md, and the current assessment. The release gate maps controls to OWASP ASVS, NIST SP 800-63-4, Better Auth guidance, WebAuthn, OAuth security guidance, OWASP LLM/agentic risks, NIST AI RMF, SSDF, SLSA, OpenSSF Scorecard, and GitHub Artifact Attestations.
• Live LLM testing: live tests use one gitignored OpenAI-compatible profile and the fixed test model id google/gemma-4-e4b. Private endpoints and tokens are never committed, and tests must not probe or autoload multiple heavy models.
• Documentation organization: see DOCUMENTATION.md for the canonical map of current docs, generated docs, compatibility notes, testing history, security evidence, and ignored runtime markdown.

UX researchers deserve tools that respect their data, enforce methodological rigor, and improve through use — not SaaS platforms that upload transcripts to foreign servers, charge per seat, and forget everything the moment you close the tab.

Istara runs entirely on your hardware. It ships with five specialized AI agents, 53 UX research skills, and an evidence-chain methodology grounded in peer-reviewed research. Agents and skills can improve, but only through project-scoped telemetry, verified outcomes, governed proposals, and Research Spine gates.

No cloud. No subscription. Evidence first.

"Let Agents Design Agents" — Zhou et al. (2026)

Istara implements a Memento-inspired agent factory grounded in the insight that the most effective way to extend an AI system is to have it design its own extensions. When an existing agent detects a capability gap — a research task it cannot handle well — it proposes a new specialized agent: defines the persona, selects skills, writes the protocols, and registers it in the orchestration pipeline.

No direct production mutation. The system can propose its own extensions, but governed approval decides what becomes active.

The five built-in agents each carry four evolving persona files:

Each agent's persona is stored in four files — CORE.md (identity), SKILLS.md (capabilities), PROTOCOLS.md (behavioral rules), MEMORY.md (accumulated learnings) — but updates are bounded by project scope, verification, and governance rules. Protected research methodology, reliability thresholds, auth constraints, and report gates are not silently rewritten.

User interaction
      ↓
Agent records project-scoped process signal
      ↓
Telemetry separates tool success · execution success · verification · research quality · reportability
      ↓
Candidate learning tracked: 3+ occurrences · active project context · 30-day window · confidence · success rate
      ↓
Governance check blocks protected methodology/gate/auth mutations
      ↓
Approved or allowed learning is promoted into the appropriate persona memory/protocol surface
      ↓
Future work can use the improvement, still inside Research Spine gates

This is not fine-tuning. It is structured prompt evolution — it works with any local model, including 3B parameter models on modest consumer hardware.

Skills also self-evolve. Every invocation records quality per model × skill combination:

ModelSkillStats(
    project_id="project-123",
    model_name="llama-3.2-3b",
    skill_name="thematic_analysis",
    success_rate=0.94,
    avg_quality_score=4.2,
    execution_count=47,
    last_improvement_proposed="2026-03-15"
)

When quality drops below threshold, Istara surfaces a diff between the current prompt and the proposed revision. You approve or reject. Skills that consistently produce verified, spine-valid outcomes earn higher health scores and priority routing inside that project. Raw tool success alone does not improve a skill.

All self-improvement now runs through an Improvement Governance contract and DGM-H Archive. Reasoning memories and telemetry can be recorded automatically, while behavior-changing updates to prompts, configs, skills, agents, UI, integrations, compute, or backend code become visible proposals with evidence, metrics, approval state, lineage, parent-selection scores, and rollback/revert tracking.

References: Zhou et al. (2026) "Memento-Skills: Let Agents Design Agents" arXiv:2603.18743; Zhang et al. (2026) "Hyperagents: DGM-H Metacognitive Self-Modification for Cross-Domain Transfer" arXiv:2603.19461; Ouyang et al. (2026) "ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memory" arXiv:2509.25140

"Improving Factuality and Reasoning in Language Models through Multiagent Debate" — Du et al. (2024)

Research findings produced by a single LLM are unreliable. Istara employs a compute-aware validation pipeline that prefers distinct authorized models when they are healthy, falls back to dual-run validation when only two models are available, and uses Self-MoA-style single-model variation only when compute is constrained. The system records route evidence, model identities where available, coded evidence-unit reliability metrics, disagreement state, and human review state instead of treating one model answer as research fact.

Sources (transcripts, surveys, notes, tickets, diaries, analytics)
      ↓
Stable evidence units with source span, participant, method, project provenance
      ↓
Inductive/open coding calibration → draft codebook → governed codebook freeze
      ↓
Distinct project-authorized models independently code the same evidence units
      ↓
Fleiss/Cohen/Krippendorff reliability over coded evidence-unit matrices
      ↓
Debate, adversarial review, and human reconciliation resolve disagreement
      ↓
Accepted/reconciled source-grounded atoms/nuggets feed Facts → Insights → Recommendations
      ↓
Only approved Done tasks can create report-ready findings
      ↓
Report with evidence chain, reliability status, route evidence, and review state

Research findings are evidence-constrained, not magic-proof. Istara stores source links, task review state, consensus scores, and dissent metadata so researchers can reject weak work. Reports draw from approved Done task evidence; tasks still in review are deliberately excluded.

The research-validity contract lives in docs/architecture/research-validity-contract.md. The self-improvement contract lives in docs/architecture/self-improvement-governance-contract.md. Fleiss' Kappa, Cohen's Kappa, and Krippendorff's Alpha are applied to coded evidence-unit matrices. Qualitative coding is not keyword tagging: models receive a protected coding protocol, codebook, inclusion/exclusion criteria, examples, evidence-unit schema, reliability policy, and promotion gate before they code. Autoresearch, ReasoningBank, Memento Skills, Meta-Hyperagent, self-evolution, RAG/GraphRAG, Prompt-RAG, and LLMLingua may improve process quality, but they cannot become report evidence or bypass the Research Spine.

When three or more distinct healthy project-authorized models exist, Istara defaults to multi-model coding/validation. With two distinct models it uses a two-coder reliability path. With one model it can run a Self-MoA-style fallback, but that result is marked lower assurance and cannot be represented as full ensemble reliability.

References: Fleiss (1971) "Measuring nominal scale agreement among many raters"; Cohen (1960) "A coefficient of agreement for nominal scales"; O'Connor & Joffe (2020) "Intercoder Reliability in Qualitative Research"; MacQueen et al. (1998) "Codebook Development for Team-Based Qualitative Analysis"; Wang et al. (2024) "Mixture-of-Agents Enhances Large Language Model Capabilities"; Du et al. (2023) "Improving Factuality and Reasoning in Language Models through Multiagent Debate"; Li et al. (2025) "Rethinking Mixture-of-Agents"; Zheng et al. (2023) "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena"

"LLMLingua: Compressing Prompts for Accelerated Inference" — Jiang et al. (2023)

Long research sessions accumulate more context than any model's window can hold. Istara manages this with a six-level hierarchical context system combined with LLMLingua-inspired prompt compression that achieves 30–74% token reduction while preserving semantic fidelity.

Level 1 — Immediate: current turn (full resolution)
Level 2 — Session: active conversation (lightly compressed)
Level 3 — Project: cross-session research state (DAG-summarized)
Level 4 — Domain: persistent knowledge about your research area
Level 5 — Agent: persona + accumulated learnings
Level 6 — System: platform capabilities + skill registry

The DAG Context Summarizer (inspired by MemWalker, Chen et al. 2023) builds a directed acyclic graph of conversation segments, enabling hierarchical retrieval without information loss. Old summaries collapse into higher-level nodes; recent context remains at full resolution. The system navigates the graph to retrieve the most relevant past context for each new query.

Prompt RAG (Pan et al., 2024) retrieves relevant past context snippets at inference time, injecting them into the current prompt — turning a limited context window into an effectively unlimited research memory.

In research workflows, context tools stay subordinate to the Research Spine. Prompt RAG can add supporting context, but mandatory coding methodology, codebook criteria, reliability policy, and promotion gates are injected deterministically by the relevant services. LLMLingua-style compression preserves protected protocol, codebook, evidence schema, reliability, promotion, and auth blocks during compression and final trimming.

References: Jiang et al. (2023) "LLMLingua: Compressing Prompts for Accelerated Inference of Large Language Models" EMNLP 2023; Chen et al. (2023) "Walking Down the Memory Maze: Beyond Context Limit through Interactive Reading" arXiv:2310.05029; Pan et al. (2024) "From RAG to Prompt RAG" ACL 2024

"Petals: Collaborative Inference and Fine-tuning of Large Models" — Borzunov et al. (2022/2023)

Your team's idle hardware is a cluster waiting to be used. Istara's Compute Relay implements a WebSocket-based whole-request inference network where team members donate spare GPU or CPU capacity to a project-scoped pool. Inference requests are routed to available nodes with priority-based scheduling, automatic capability detection, route counters, and failover.

It is Petals-inspired in the collaboration sense, but it is not Petals-equivalent transformer layer sharding. Istara donates and routes complete chat, embedding, and model-server requests through authorized nodes.

Research Agent (needs inference)
      ↓
Compute Router: query available nodes
      ↓
Node A: MacBook Pro M3 (local, latency 2ms)    — priority: HIGH
Node B: Linux workstation RTX 4090 (LAN, 8ms) — priority: HIGH
Node C: Relay server (WAN, 120ms)              — priority: MEDIUM
      ↓
Route to highest-priority available node
      ↓
Automatic failover if node drops
      ↓
Result streamed back to requesting agent

Connect your entire team with a single string:

rcl_<signed-user-or-compute-invite>

User invite strings no longer contain a pre-minted login JWT; they redeem into a server-backed session and one-time recovery codes.

References: Borzunov et al. (2022) "Petals: Collaborative Inference and Fine-tuning of Large Models" arXiv:2209.01188; Borzunov et al. (2023) "Distributed Inference and Fine-tuning of Large Language Models Over the Internet" NeurIPS 2023

"autoresearch: autonomous experiment loops for AI systems" — Karpathy (2026)

Istara includes an autonomous research optimization engine inspired by Karpathy's autoresearch framework. It runs controlled, project-scoped experiments to improve process quality — testing RAG retrieval parameters, skill prompt templates, model temperature settings, and related configuration without letting the experiment mutate production state.

Experiments are sandboxed, rate-limited, reversible, and non-reportable. A successful experiment becomes a governed proposal, not an automatic production change.

Measure current system performance baseline
      ↓
Generate experiment hypothesis (e.g., "reduce chunk overlap from 200 to 100 tokens")
      ↓
Run controlled A/B test on held-out evaluation set
      ↓
Measure quality delta (retrieval precision, skill output scores)
      ↓
If improvement ≥ threshold: revert sandbox mutation and create proposal_ready candidate
      ↓
Governance review approves, rejects, or archives the proposal with rollback evidence
      ↓
Repeat: next hypothesis

The system maintains a Skill Health Monitor dashboard showing per-skill performance trends, which experiments are running, which proposals are awaiting review, and which governed changes have been approved. Autoresearch artifacts are process evidence only; they cannot become research findings or report evidence.

Reference: Karpathy (2026) "autoresearch" github.com/karpathy/autoresearch

"The Atomic Research model" — Sharon & Gadbaw (2018)

Every insight Istara produces is expected to remain traceable because it is connected to a verified evidence chain with source references and task review state. This implements the Atomic Research methodology developed at WeWork (Sharon & Gadbaw, 2018) as a computational pipeline.

Raw source quote or observation
      ↓  creates: source evidence unit with exact text + provenance
Candidate atom/nugget
      ↓  requires: independent extraction/coding + grounding + reliability/reconciliation
Accepted atom/nugget
      ↓  promotes: verified pattern, fact, insight, recommendation
Report evidence
      ↓  requires: accepted/reconciled evidence on a human-approved Done task

No reportable recommendation without an accepted insight. No accepted insight without accepted facts. No accepted fact without accepted atoms/nuggets. No accepted atom/nugget without source-grounded validation.

Every level of the chain is stored as a discrete database record with foreign key relationships enforcing the hierarchy. Atomic Research artifacts are not trusted merely because a model wrote them; raw model outputs remain candidate/provisional until the Research Spine accepts or reconciles them. Reports use findings from approved Done tasks; task outputs still in review are not report evidence. When you export a research report, every recommendation should hyperlink back through the chain to the exact interview passage, survey response, or observation that supports it.

Reference: Sharon & Gadbaw (2018) "Atomic Research" WeWork Research Operations

"Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks" — Lewis et al. (2020)

Pure vector search misses exact terminology. Pure keyword search misses semantic similarity. Istara uses Reciprocal Rank Fusion to blend both:

Query
  ├── LanceDB vector search (cosine similarity on embeddings)  → ranked list A
  └── BM25 keyword search (term frequency × inverse doc freq) → ranked list B
                    ↓
         Reciprocal Rank Fusion
         score(d) = Σ 1/(k + rank_i(d))
                    ↓
         Merged ranking: 70% vector weight · 30% BM25 weight
                    ↓
         Top-k results injected into agent context

This means Istara finds semantically similar content ("participant struggled with navigation") AND exact terminology matches ("information architecture"). Switch to pure vector or pure keyword mode per-query when you need it.

Hybrid RAG is Istara's exact-evidence retrieval layer. BM25 fallback preserves evidence_unit_id, document/source span, review status, reliability status, and provenance; when that provenance is missing, the result is marked non-promotional. Evidence Graph / GraphRAG is the synthesis and traceability layer, used for cross-document relationships and dependency questions, but graph answers must backfill exact evidence through Hybrid RAG before anything can be promoted.

LanceDB is embedded — no separate vector database process, no network overhead, no configuration.

References: Lewis et al. (2020) "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks" NeurIPS 2020; Cormack et al. (2009) "Reciprocal rank fusion outperforms condorcet and individual rank learning methods" SIGIR 2009; Robertson & Zaragoza (2009) "The Probabilistic Relevance Framework: BM25 and Beyond" Foundations and Trends in Information Retrieval 3(4)

"AURA: Adaptive User Research Assistant" — arXiv:2510.27126

Istara supports AURA-style adaptive interview workflows and credentialed setup paths for messaging and survey channels. Live participant channels require the relevant provider credentials or bounded test simulators; without them, Istara documents the setup/error path rather than pretending a real participant deployment occurred.

Researcher designs interview guide in Istara
      ↓
Deploy to: WhatsApp Business · Telegram Bot · Typeform · SurveyMonkey · Google Forms
      ↓
Participant receives message in their preferred app
      ↓
Adaptive agent conducts interview: asks follow-ups, probes interesting answers,
adjusts question order based on prior responses
      ↓
Responses stream back to Istara in real time
      ↓
Register raw source → extract evidence units → create candidate atoms/codes
      ↓
Run reliability, grounding, reconciliation, and review gates
      ↓
AI-Detection check flags responses that appear machine-generated

The adaptive interview engine is intended to adjust question phrasing and order based on prior answers, producing richer qualitative data than static survey forms when the channel integration is configured. Imported responses do not become trusted findings directly; they enter the same Research Spine as documents, interviews, and manual notes.

Reference: AURA: Adaptive User Research Assistant, arXiv:2510.27126

Istara bridges research and design in a single workflow:

• Figma Integration: Import design files, extract design system tokens, link design decisions to accepted/reconciled research evidence, run compliance checks against UX Laws
• Google Stitch MCP: Generate screen wireframes and UI concepts from accepted insights and clearly marked candidate evidence — describe what users need, get design proposals
• Design Briefs: Auto-generate design briefs from reportable findings, with UX Law references attached to each recommendation
• Evidence-to-Design Traceability: Every reportable design decision links back to accepted atoms/nuggets and source evidence that motivated it

"Laws of UX: Design Principles for Persuasive and Ethical Products" — Yablonski (2020)

Run any interface description, design file, or user flow through Istara's UX Law compliance auditor and receive a scored report against all 30 Laws of UX — including Fitts's Law, Hick's Law, Jakob's Law, Miller's Law, the Peak-End Rule, and 25 more.

Input: interface description / Figma file / user flow diagram
      ↓
Compliance check against 30 Laws of UX
      ↓
Per-law score: PASS / WARN / FAIL + evidence + severity
      ↓
Aggregate compliance score
      ↓
Prioritized recommendations with research citations
      ↓
Export: PDF report / JSON for CI pipeline integration

Integrate compliance checking into your CI/CD pipeline — catch UX violations before they ship to production.

Reference: Yablonski (2020) Laws of UX: Design Principles for Persuasive and Ethical Products O'Reilly Media

Drop any file into Istara and the document pipeline activates automatically:

Upload (PDF · DOCX · TXT · transcript · spec)
      ↓
Auto-classify: research report / interview transcript / survey data /
               design spec / competitive analysis / academic paper
      ↓
Extract source evidence units → draft candidate atoms/codes → validate/reconcile before tasks
      ↓
Link findings back to exact source passages with page/line references
      ↓
Index in hybrid RAG for future retrieval

External folder linking connects Google Drive, Dropbox, or any local folder without copying files — Istara watches for changes and syncs automatically. Cloud-aware: detects when files are stored remotely and adapts ingestion accordingly.

Istara speaks both dominant agent interoperability standards:

Model Context Protocol (MCP) — Anthropic's open standard for tool-augmented LLM interactions. Istara exposes an MCP server (disabled by default, http://localhost:8001/mcp when enabled) with 8 tools:

list_skills()         list_projects()       get_findings()
search_memory()       execute_skill()       deploy_research()
create_project()      get_deployment_status()

Agent-to-Agent Protocol (A2A) — Google's standard for agent discovery and communication. Istara publishes a discovery manifest at /.well-known/agent.json enabling any A2A-compliant agent framework to discover and invoke Istara's capabilities.

Both interfaces are gated by MCPAccessPolicy with per-tool permissions, JWT authentication, and full audit logging.

References: Model Context Protocol (2025) "MCP Specification" modelcontextprotocol.io; Agent2Agent Project (2026) "A2A Protocol Specification" a2a-protocol.org

Istara is zero-trust by default:

• JWT authentication on every API endpoint — no unauthenticated access
• Better Auth-inspired account hardening — first admin receives one-time recovery codes during onboarding, passkey setup is offered immediately, users can change username/profile/password from Settings, and admin-created users receive one-time recovery codes
• Two-factor options — password sign-in can be protected with TOTP, recovery codes are the fallback factor, and WebAuthn/passkeys provide phishing-resistant passwordless sign-in; Istara does not use SMS or email OTP factors
• Fernet field encryption on sensitive database fields — secrets are encrypted at rest
• Admin-managed file and backup encryption — when enabled, managed uploads, stored document text, and future backup archives are encrypted at rest; backups are written as .tar.gz.enc and require the correct file-encryption key to restore
• Secure key handling — the file-encryption key should live in a secrets manager or macOS Keychain, with an owner-only local key-file fallback for source installs; losing the key is destructive for encrypted files and backups
• Local-first architecture — LLM inference runs on your hardware via LM Studio or Ollama; no data transmitted to external APIs unless you explicitly configure one
• MCP server OFF by default — external agent access requires conscious opt-in
• SQLite database — a single portable file you control completely
• No phone-home telemetry — Istara records local process, route, quality, and governance events for audits, but never sends them to an external service

┌─────────────────────────────────────────────────────────────────────┐
│                        FRONTEND (Next.js 14)                        │
│  Chat · Kanban · Findings · Documents · Skills · Agents · Settings  │
│  22 views · Contextual onboarding per view · Dark/light mode        │
│  Zustand state · WCAG 2.1 AA compliant · Tauri system tray          │
└────────────────────────────┬────────────────────────────────────────┘
                             │ REST (400+ endpoints) + WebSocket (16 events)
┌────────────────────────────▼────────────────────────────────────────┐
│                         BACKEND (FastAPI)                           │
│                                                                     │
│  ┌────────────┐  ┌────────────┐  ┌─────────────┐  ┌─────────────┐  │
│  │ 400+ REST  │  │ WebSocket  │  │ MCP Server  │  │ A2A Protocol│  │
│  │  endpoints │  │  Manager   │  │  (opt-in)   │  │  Discovery  │  │
│  └──────┬─────┘  └──────┬─────┘  └──────┬──────┘  └──────┬──────┘  │
│         └───────────────┴───────────────┴─────────────────┘        │
│                                    │                                │
│  ┌─────────────────────────────────▼──────────────────────────┐    │
│  │                        CORE ENGINE                         │    │
│  │                                                            │    │
│  │  MetaOrchestrator (A2A message routing)                    │    │
│  │  Context Hierarchy (6 levels) + DAG Summarizer             │    │
│  │  Hybrid RAG: LanceDB + BM25 + RRF + provenance status      │    │
│  │  Evidence Graph / GraphRAG traceability and synthesis      │    │
│  │  LLMLingua Compressor with protected Research Spine blocks │    │
│  │  Self-Improvement Governance + Skill Health Monitor        │    │
│  │  Sandboxed Autoresearch proposals, not live mutations      │    │
│  │  Multi-model Coding/Validation (Kappa/Alpha + route proof) │    │
│  │  Resource Governor + Priority Scheduler                    │    │
│  │  Accepted Atomic Chain (Atom→Fact→Insight→Rec)             │    │
│  └─────────────────────────────────┬──────────────────────────┘    │
│                                    │                                │
│  ┌──────────────────┐  ┌───────────▼──────────┐  ┌──────────────┐  │
│  │  Agent Personas  │  │      Data Layer       │  │  LLM Layer   │  │
│  │  CORE.md         │  │  SQLite (51+ models)  │  │  LM Studio   │  │
│  │  SKILLS.md       │  │  LanceDB (vectors)    │  │  Ollama      │  │
│  │  PROTOCOLS.md    │  │  Fernet encryption    │  │  Any OpenAI- │  │
│  │  MEMORY.md       │  │  JWT auth             │  │  compatible  │  │
│  └──────────────────┘  └───────────────────────┘  └──────────────┘  │
│                                                                     │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │                    INTEGRATIONS                             │   │
│  │  Compute Relay (WebSocket swarm · Petals-inspired)          │   │
│  │  Survey Channels (WhatsApp · Telegram · Typeform · Forms)   │   │
│  │  Design Tools (Figma · Google Stitch MCP)                   │   │
│  │  Notifications (Slack · Telegram · WhatsApp)                │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

See Install above for all installation methods. Prerequisites:

• Python 3.12+ and Node 20+ (the shell installer handles these automatically)
• LM Studio or Ollama with at least one model loaded

After installing, start the server and open http://localhost:3000:

istara start

Screenshots are intentionally omitted until the public deployment assets are stable. Additional architecture and process references are listed in DOCUMENTATION.md.

istara/
├── backend/                   # FastAPI backend (Python 3.12)
│   └── app/
│       ├── api/               # 400+ REST endpoints + WebSocket manager
│       ├── agents/            # Agent personas (CORE, SKILLS, PROTOCOLS, MEMORY)
│       ├── core/              # Orchestrator, RAG, evolution engine, autoresearch
│       ├── models/            # 51+ SQLAlchemy 2.0 models
│       ├── services/          # Survey, MCP, channel, compute relay integrations
│       └── skills/            # Skill base class, factory, 53 implementations
├── frontend/                  # Next.js 14 (React, Tailwind CSS, Zustand)
│   └── src/
│       ├── components/        # 22 views + shared UI components
│       ├── stores/            # Zustand state management
│       └── lib/               # API client, route helpers, shared types
├── desktop/                   # Tauri v2 system tray application
├── installer/                 # macOS DMG + Windows NSIS + Linux AppImage configs
├── relay/                     # Compute donation WebSocket relay server
├── skills/                    # Skill definition files (SKILL.md per skill)
├── security/                  # Security benchmark matrix, release checklist, assessments
├── testing/                   # Testing, eval, benchmark, and historical baseline strategy
├── tests/
│   └── simulation/            # 76-scenario E2E simulation test suite
└── scripts/                   # Integrity checks, agent MEMORY.md updaters

Istara is MIT-licensed and actively welcomes contributions. High-impact areas:

• New research skills — Add a SKILL.md + JSON definition. No Python required for most skills.
• LLM adapters — Support for new local inference backends
• Channel integrations — Discord, Microsoft Teams, Signal, etc.
• UI components — Accessibility improvements, new research views
• Research methodology — Improved prompts and validation logic, with protected protocol/gate changes governed
• Academic citations — Connect features to relevant research literature

# Run the backend test suite
pytest tests/

# Run the 76-scenario E2E simulation agent
node tests/simulation/run.mjs

# Verify system integrity before committing
python scripts/check_integrity.py

# Verify CI/CD governance and production rehearsal
python scripts/check_ci_governance.py
python scripts/security_benchmark.py --fail-on-threshold
python scripts/production_rehearsal.py --json

# Run deterministic property and mutation gates
pytest tests/test_property_contracts.py -q
python scripts/run_backend_mutation.py
(cd frontend && npm run test:unit && npm run test:mutation)

See CONTRIBUTING.md for setup instructions, code style guide, and the change checklist. See TESTING.md, SECURITY.md, and DOCUMENTATION.md before release-sensitive changes.

MIT © 2026 Istara Contributors — see LICENSE.