Own your context. Carry it between agents.

How Pantheon works

Every agent starts empty. Pantheon stores a conscience — the real conversation, the durable facts, and the files you made — in your selected vault. Developers can use a private GitHub repository; writers, researchers, designers, and product teams can use a Pantheon Vault folder in Google Drive. A project conscience is called a space: a short name you choose, like preorders or annotation-design.

This is not a transcript copier. Handoff archives the conversation verbatim and writes a distilled packet on top of it — the packet is a layer, never a replacement. Hand the same chat off twice and only the new turns are added; hand off a different chat and it joins the space as another session. Nothing a space has ever held is overwritten.

Your context belongs to you

Your provider vault is the source of truth—not a backup or export. Pantheon's database stores account and pairing records plus the credentials needed to connect to your vault, but never your conversations, memories, decisions, or artifact contents.

Provider refresh credentials are encrypted before server storage. Hosted operations process vault files temporarily and do not create a second conversation-content database. See the privacy page for exact scopes, processing, cache, and revocation details.

Disconnect and deletion

Disconnecting erases your Pantheon account, paired machines, tokens, and provider access. A Google Drive vault folder is retained by default; deleting it requires an explicit checkbox. GitHub keeps its existing choice to retain the repository or delete it together with the account.

Disconnecting does not pretend to recall copies another person exported. Revoked shared spaces disappear from their managed local cache on the next sync. Review all details under Settings → Account.

Context continuity

A context window is temporary working memory. Context continuity is the system property that carries the state of the work across a fresh chat, a model switch, or a different agent application—and reconstructs only the part the next task needs.

Long context stores more tokens inside one run. Continuity preserves the project when that run ends. The research page reviews the evidence from long-context and long-term-memory benchmarks and documents Pantheon's design boundaries.

Resume and retrieval

Resume does not pour the archive into the model — that would spend the context window it is trying to save. It hands over a complete map and lets the agent fetch what it needs. That map is synthesized orientation, not exact evidence, so project-state and decision claims still resolve to archived turns before the agent presents them as verified history.

For one historical question, you do not need to resume the whole conscience first. This shortcut refreshes the space, ranks connected evidence from every session, verifies the strongest exact turns, and answers with session_id#turn_id citations:

/pantheon-retrieve my-project Why did we reject the first navigation layout?

Every historical answer includes an Evidence line. Each returnedevidenceId uses the same session_id#turn_id format; paste it into the Context search box to open that exact turn, its surrounding conversation, and the highlighted source.

Empty queries, sync status, and handoff receipts are operational results, not historical claims. They report their status without inventing an evidence citation.

Retrieval is bounded: the agent may make at most two narrower follow-up queries when evidence is incomplete. Every natural-language question starts with pantheon_retrieve, even when you are asking for an unknown name, file, command, or quote. pantheon_search is only for exact text you supplied or retrieval already discovered. If an agent sends a question to search anyway, Pantheon automatically routes it through ranked retrieval.

sessions and story are what stop a thin handoff hiding a long project. handoff.md is written for the space rather than the last chat — its totals, its stored files, its most recent turns wherever they happened — so ten minutes of tidying cannot overwrite the account of a month’s work. Resume also reports the total turn count across the space and names every conversation in it, so the agent knows the rest exists and can open it.

When the packet does not cover what you are asking about, the agent searches rather than guessing. pantheon_search reads tool calls as well as messages — a file is findable by name even if nobody typed that name in prose — and takes a context window so a hit comes back with the turns around it. From a hit it can widen with pantheon_get_turns or read a whole conversation with pantheon_get_session.

If a resumed agent says it has no context for something you know you discussed, ask it to search the space. Missing context is nearly always unsearched rather than unsaved.

Skills

A skill is a lesson this project already learned, written down so the next agent starts with it. Memory is fetched when an agent goes looking; resume hands over every promoted skill's name and trigger, then the agent fetches the body only when the work matches. That is the whole difference, and it is why there are never many.

When a successful handoff adds turns, the agent compares recurring signals with existing live and draft lessons, reads the cited turns, and batch-saves at most five justified drafts without interrupting you. Run this command to review again at any time:

/pantheon-skills my-project

What it reads: the corrections you had to repeat across conversations, the commands that recur across sessions, and any failure that hit more than once. It also checks your AGENTS.md and README, and will not write something they already say.

The strongest evidence usually is not in the vault at all. Most agents record which tools they called but not what came back — Cursor writes no tool results to disk — so what a command actually printed when it failed exists only in the live conversation. That is why the review runs during handoff, where the agent can weigh what it saw alongside what was stored.

Drafts wait on the space's own page in this app, under Skills, with the turns each one cites listed beside it. Promote one and every future resume of that space names it; retire it and it stops being served. An agent reads the guidance itself with pantheon_get_skill when it is about to work in an area a skill covers — resume only carries the names and triggers, so an unopened skill costs a line rather than a page.

Pantheon Notes

The web notes editor is coming soon. The Notes page is paused until it ships. Context — spaces, handoff, resume, and retrieval — is unchanged.

Sharing a space

You can give one space to another Pantheon user from Settings → Sharing. GitHub users share with their GitHub username. Google Drive users share with the Pantheon handle on their Account page — there is no Google username. Sharing looks that handle up exactly, then asks you to confirm the name and account before anything is granted. They get every packet, the durable facts, every archived conversation and the stored files, and their agents resume it by name like any other space.

It shows up in their list marked Shared by @you, and on their machine it lands beside their vault rather than inside it, so nothing of yours is ever written into their provider storage.

/pantheon-resume preorders/pantheon-resume obirikan/preorders/pantheon-retrieve obirikan/preorders What decision did we make?

A bare name is enough when only one space matches. If a shared space has the same name as one of your own, yours wins; if two people have shared a space of that name with you, resume asks which rather than guessing. Qualifying it with the owner's handle settles it either way.

Shared spaces refresh with pantheon sync, and before any handoff, resume, retrieval, or search, so the copy an agent reads is current. The first pull of a large space fetches every file and takes a moment; after that only what changed comes down.

Data fidelity: what gets saved

Every handoff starts in server-controlled auto mode. Pantheon captures highest-fidelity history only through a verified adapter for the calling client. If none is available, it asks the agent to retry automatically with every conversation turn still visible in its context.

A model-supplied transcript can omit older turns that have already fallen outside the client's context window, and may not include hidden tool activity. Pantheon marks that boundary instead of presenting it as local capture.

Supported apps

Every listed integration supports handoff, resume, direct ranked retrieval, and exact search. Pantheon chooses the safest available source at runtime: verified local capture first, then an agent-supplied visible transcript.

Remote clients discover Pantheon's OAuth 2.1 sign-in automatically. Authorization uses browser consent, PKCE, short-lived access tokens, rotating refresh tokens, and an account-bound MCP resource. Static bearer tokens remain available for clients that support custom headers but not MCP OAuth.

The complete desktop instructions live at the top under Get started, so there is one setup sequence to follow. After changing any MCP configuration, reload MCP or restart the app before the first handoff.

ChatGPT.app and Codex share ~/.codex/config.toml. ChatGPT Classic is the legacy app and cannot start a local MCP server.

Command reference

/pantheon-handoff <space>

/pantheon-resume [space]

/pantheon-resume-note [note]

/pantheon-retrieve <space> <question>

/pantheon-park <space>

/pantheon-remember <space> <fact>

/pantheon-spaces

/pantheon-skills <space>

/pantheon-help

Naming spaces

A space is the short name you give a conscience. Letters, numbers, dots, underscores, hyphens — one token, not a sentence.

• Handoff, park, remember — if you typed the name, the agent calls the tool. First write creates the space. It must not say the space “still needs to be created.”
• Resume — existing spaces only. If you omit the name the agent lists live spaces and asks which one; if the name is not in the vault it should say so rather than pick a neighbour.
• /pantheon-spaces — the live vault list and nothing else. Never memory, this chat, or another app.

Files

If the chat produced a PDF, letter, CV, or spreadsheet, handoff attaches it as an artifact. Naming a .pdf without attaching it is rejected, so a space never promises a file it does not hold. Desktop agents pass an existing local path, agents without a shared filesystem can pass a downloadable HTTPS URL, and inline base64 remains a fallback. Pantheon never needs the agent to regenerate or convert a file for handoff. Named code fences are stored automatically.

Resume lists file names without loading their bytes into the context window. When one is needed, pantheon_get_artifact returns the actual file as an MCP resource. A local desktop agent can instead restore it into the current workspace with save_to; Pantheon confines the destination to that workspace and will not overwrite an existing file.

Host it yourself

The control plane is a Next.js app backed by Postgres. It stores accounts, tokens, and paired machines — never a separate archive of conversation content, which lives in the user's GitHub or Drive vault. GitHub uses a revoked one-time creation token and a repository-scoped App installation; Google uses encrypted refresh credentials and the drive.file scope.

1. Create a Supabase project and copy the Transaction pooler URI — port 6543, not the direct connection, which resolves to IPv6 only.
2. Put it in DATABASE_URL, then create the schema. Tables live in a dedicated pantheon schema so Supabase never exposes them through PostgREST.

cd apps/webpnpm db:migrate

3. Set NEXT_PUBLIC_APP_URL to your HTTPS origin before building — it is compiled into the client bundle, not read at runtime.
4. Point the GitHub App callback to https://your-domain/api/github/callback and the setup URL to https://your-domain/api/github/setup.
5. On Vercel, set the root directory to apps/web and leave “include files outside the root directory” on — the app depends on workspace packages, so the install has to run at the repo root.

Confirm it came up. A green check here means Postgres is reachable, not merely that HTML is being served.

curl https://your-domain/api/health

Free Supabase projects pause after about a week of inactivity, so point an uptime check at that endpoint — it runs a real query, which keeps the project awake.

Troubleshooting

Open the one that matches what you are seeing.

/mcp

pantheon_handoff

which pantheon

pantheon_local_sessionspantheon_forget_session

/pantheon-retrieve my-project Why did we choose this approach?

/pantheon-resume-note Interview highlights

pantheon sync