agentic-os

The /bootstrap, /review, and /ship above are plain text prompts — your agent maps them to the workflow files in the repo, so they run the same in Cursor or Codex as in Claude Code.

Or run a gate yourself, no install — the credential scan that catches a leaked key before it reaches git history:

bash demo/run.sh          # Windows (PowerShell): pwsh demo/run.ps1

  An AI agent wrote this file and reported: "Done — config added."
  ----------------------------------------------------------------
    DB_HOST=prod.internal
    aws_access_key_id = AKIA****************
  ----------------------------------------------------------------

  Without a gate, that commit lands and the key is in git history forever.
  Agentic OS runs this before the commit is allowed:

    $ scan_credentials.py config.env

CREDENTIAL PATTERN(S) DETECTED (values redacted):
  config.env:2: aws-access-key-id
Rotate the exposed secret, remove it from the change, then retry.

  Commit BLOCKED. The agent said "done"; the machine said no — and it
  redacted the value instead of echoing your secret back at you.

Your agent can still cut a corner. What it can't do is get a leaked secret past the hook, or a failing test past CI, once they're on — those run whether it cooperates or not. Reviews are checked from the work trail the agent writes: a missing review record fails the local check, a faked one does not. The key above is generated at runtime and redacted on output, so the demo never stores a real secret.

Usable on day one

Three parts work before you wire up anything:

• A standalone credential gate. scan_credentials.py scans the files you give it, a staged diff (--staged) or a commit range (--range), with redacted output — the demo above. Two lines from the installer's output make it your pre-commit hook.
• Memory that survives a new session. Each task keeps a work log of decisions, evidence and gate receipts, and /handoff writes a resume block, so the next session or agent picks up from the log instead of the chat.
• 14 expert checklists, attached by task type — an auth-security pass on login code, forward-only checks on a migration. The list is under What you get.

Rules vs. enforcement

A rules file — Cursor Rules, a plain AGENTS.md — is a prompt the agent can ignore. Agentic OS keeps that discipline (plan before editing, no unasked-for refactors) and adds a layer the agent doesn't control. A fresh install runs nothing by itself; the installer ends by printing the commands that turn it on.

The second row is the part a rules file can't reach: validate.sh parses each task's work log and fails if a required phase was skipped or its evidence is missing. That check runs where the work logs are: on your machine, by hand or in the opt-in pre-commit hook, which --no-verify can skip. Work logs are gitignored, so CI cannot run it. What a required CI job can enforce is the credential scan, your test suite, and validate.sh's structural checks of the framework files; mark those jobs required in branch protection. In this repo that floor is three required checks (Framework Validation, ShellCheck, Check Markdown Links); the security scanning jobs (credential scan, SAST, dependency audit) run on every PR but are not required merge checks unless you add them to branch protection. The Security badge above is this repo running the same credential and SAST gates on its own every push.

Sits under what you already have

Agentic OS is the enforcement layer. A rules file or a skill pack tells your agent how to behave; this is the part that checks - a secret scan and your tests in your git hooks and CI, which don't take the agent's word, plus a local validator that fails when its work trail is missing a phase. Already have those? Keep them. This sits underneath and turns the discipline they ask for into a check that can fail your commit or your build.

Gated phases, scaled to risk

Every task runs a gated workflow, and the rigor scales to the risk. Skip a phase and validate.sh fails — but a typo doesn't run the same gauntlet as a feature:

  tiny-fix    classify --> execute --> evidence --> done
  quick-win   bootstrap --> plan --> implement --> evidence --> ship
  feature     bootstrap --> spec --> plan --> implement --> review --> test --> ship

  And the ship gate is not a formality:

  ship attempt --> [ no review/test evidence ] --> BLOCKED
  ship attempt --> [ evidence on record ]      --> SHIPPED

  The agent can still cut a corner. It just can't cut this one
  past a check it doesn't control.

The full set of paths, by classification:

What you get