mirror of
https://github.com/boshu2/agentops.git
synced 2026-09-14 15:08:13 +08:00
release: restore prep state and plan zero-trust gate
This commit is contained in:
Boden Fuller
@@ -0,0 +1,39 @@
|
||||
---
|
||||
id: design-2026-05-02-ai-native-zero-trust-release-process
|
||||
type: design
|
||||
date: 2026-05-02
|
||||
goal: "Make the AI-agent-native release process right: zero-trust CI/CD with SIL/VIL/HIL and digital-twin evidence before build/tag/release."
|
||||
verdict: PASS
|
||||
---
|
||||
|
||||
# Design: AI-Native Zero-Trust Release Process
|
||||
|
||||
## Goal
|
||||
|
||||
Make the release process match the product thesis: normal CI/CD assumes a passing
|
||||
pipeline and code shape are enough; an AI-agent-native release must distrust both
|
||||
until realistic environments have been exercised. The release gate should require
|
||||
evidence from SIL, VIL, HIL, and a digital twin before build/tag/publish.
|
||||
|
||||
## Alignment Matrix
|
||||
|
||||
| Dimension | Score | Rationale |
|
||||
| --- | ---: | --- |
|
||||
| Gap Alignment | 3/3 | Directly addresses the Quality-First Maintainer gap: validation gates must block, not advise. |
|
||||
| Persona Fit | 3/3 | Serves maintainers shipping fewer, higher-confidence releases and operators managing agent-produced change. |
|
||||
| Competitive Diff | 3/3 | Strengthens AgentOps' core differentiation: operational discipline for indeterministic coding agents. |
|
||||
| Precedent | 2/3 | The closed `soc-h22t` SIL/VIL/HIL readiness work is a strong base; digital twin is the missing release-specific lane. |
|
||||
| Scope Fit | 2/3 | Broad but appropriate for a release-process epic; must be split into evidence contract, runners, workflow, and audit work. |
|
||||
|
||||
Average: 2.6/3.0
|
||||
|
||||
## Verdict
|
||||
|
||||
DESIGN VERDICT: PASS
|
||||
|
||||
Recommendation: proceed with discovery and planning. Treat this as a second-layer
|
||||
release epic, not a rewrite of the just-closed SIL/VIL/HIL readiness score.
|
||||
|
||||
The product-fit constraint is that the release gate must remain usable. Waivers
|
||||
can exist for unavailable physical targets, but they must be explicit evidence,
|
||||
not a silent bypass.
|
||||
@@ -23,8 +23,8 @@ applicable_languages: ["shell","go"]
|
||||
tier: "local"
|
||||
confidence: "high"
|
||||
ttl_days: 60
|
||||
hit_count: 1
|
||||
last_cited: "2026-04-30T06:58:00Z"
|
||||
hit_count: 2
|
||||
last_cited: 2026-05-02T23:59:59Z
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,253 @@
|
||||
---
|
||||
id: plan-2026-05-02-ai-native-zero-trust-release-process
|
||||
type: plan
|
||||
date: 2026-05-02
|
||||
epic: soc-owed
|
||||
source: ".agents/research/2026-05-02-ai-native-zero-trust-release-process.md"
|
||||
---
|
||||
|
||||
# Plan: AI-Native Zero-Trust Release Process
|
||||
|
||||
## Context
|
||||
|
||||
The user thesis is that normal CI/CD expects code to be in a different shape:
|
||||
it trusts a pipeline's reported success too much. Agent-produced releases need a
|
||||
zero-trust release process: simulate realistic environments and require SIL,
|
||||
VIL, HIL, and digital-twin evidence before build/tag/release.
|
||||
|
||||
Existing closed epic `soc-h22t` added an 8/10 SIL/VIL/HIL readiness score. This
|
||||
plan extends that base with digital-twin evidence, richer attestations, evidence
|
||||
consumption instead of trusted status flags, and pre-publish workflow blocking.
|
||||
|
||||
Applied findings: `f-2026-05-01-021`, `f-2026-05-01-024`,
|
||||
`f-2026-04-30-002`.
|
||||
|
||||
## Files To Modify
|
||||
|
||||
| File | Change |
|
||||
| --- | --- |
|
||||
| `docs/contracts/release-readiness.md` | Upgrade the contract with digital-twin and evidence-first semantics. |
|
||||
| `schemas/release-readiness.v1.schema.json` or replacement v2 schema | Add digital-twin/evidence object references while preserving migration compatibility. |
|
||||
| `scripts/check-release-readiness.sh` | Consume evidence files in official mode instead of trusting supplied statuses. |
|
||||
| `scripts/check-release-digital-twin.sh` | New runner for disposable environment install/upgrade/operator workflow simulation. |
|
||||
| `tests/scripts/release-digital-twin.bats` | New fixtures for digital-twin pass/fail/skipped behavior. |
|
||||
| `scripts/check-release-hil.sh` | Strengthen target evidence beyond arbitrary `ao version`. |
|
||||
| `.github/workflows/release.yml` | Block GoReleaser publish until readiness/security/evidence gates pass. |
|
||||
| `scripts/resolve-release-artifacts.sh` | Require complete official evidence bundle. |
|
||||
| `scripts/validate-release-audit-artifacts.sh` | Validate digital-twin/eval/security/readiness evidence before audit pass. |
|
||||
| `tests/scripts/release-readiness.bats` | Cover evidence-file official mode. |
|
||||
| `tests/scripts/release-hil.bats` | Cover stronger HIL/VIL workflow evidence and weak-evidence rejection. |
|
||||
| `tests/scripts/release-artifacts.bats` | Cover complete proof bundle resolution/audit. |
|
||||
| `tests/scripts/ci-local-release.bats` | Cover release workflow/readiness plumbing markers. |
|
||||
| `docs/RELEASING.md`, `docs/CI-CD.md`, `docs/release-e2e-checklist.md` | Explain zero-trust release proof bundle and operational flow. |
|
||||
|
||||
## Boundaries
|
||||
|
||||
Always:
|
||||
|
||||
- Keep `soc-h22t` readiness score as the foundation; do not duplicate it.
|
||||
- Require official release evidence to be file-backed and schema-validated.
|
||||
- Treat HIL waivers as explicit evidence with reduced score, never silent pass.
|
||||
- Keep public PR CI independent from private physical hosts.
|
||||
|
||||
Never:
|
||||
|
||||
- Tag or publish as part of this work.
|
||||
- Make a passing GitHub workflow the only proof of release readiness.
|
||||
- Treat `ao version` alone as sufficient HIL evidence for an official release.
|
||||
- Generate post-publish readiness assets and call that a pre-publish gate.
|
||||
|
||||
Ask first:
|
||||
|
||||
- Which real hosts/benches are official HIL targets for `v2.40.0`.
|
||||
- Whether the first digital twin should be local-only or include remote VM/container runners.
|
||||
|
||||
## Baseline Audit
|
||||
|
||||
| Check | Evidence |
|
||||
| --- | --- |
|
||||
| Release publisher gate | `.github/workflows/release.yml` publish depends on doc/security jobs but only requires doc success before GoReleaser. |
|
||||
| Publish ordering | GoReleaser runs before SBOM/security/readiness assets are generated. |
|
||||
| Current readiness contract | `docs/contracts/release-readiness.md` defines SIL/VIL/HIL/artifacts/security/evals; no digital twin. |
|
||||
| Current readiness script | `scripts/check-release-readiness.sh` accepts status flags and only special-cases HIL file input. |
|
||||
| Current HIL script | `scripts/check-release-hil.sh` runs arbitrary local/SSH target commands and records pass/fail. |
|
||||
| Current artifact validation | `scripts/validate-release-audit-artifacts.sh` is the right place to fail missing proof bundle artifacts. |
|
||||
| Existing issue history | `soc-h22t` and children are closed; this needs a new epic. |
|
||||
|
||||
## Issues
|
||||
|
||||
### `soc-owed.2` - Define zero-trust release evidence contract with digital twin dimension
|
||||
|
||||
Ownership: `docs/contracts/release-readiness.md`, readiness schema, docs index,
|
||||
`docs/CI-CD.md`, `docs/RELEASING.md`.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- Contract defines digital-twin evidence and evidence-rich SIL/VIL/HIL.
|
||||
- Official release cannot pass on status strings alone.
|
||||
- Contract compatibility and docs gates pass.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash scripts/check-contract-compatibility.sh`
|
||||
- `rg -n 'digital twin|SIL|VIL|HIL|evidence' docs/contracts/release-readiness.md`
|
||||
|
||||
Test levels: L0, L1.
|
||||
|
||||
### `soc-owed.3` - Add digital twin release evidence runner
|
||||
|
||||
Ownership: `scripts/check-release-digital-twin.sh`,
|
||||
`tests/scripts/release-digital-twin.bats`, `docs/release-e2e-checklist.md`.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- Runner simulates realistic post-install operator workflows in disposable environments.
|
||||
- Evidence records workflow results, release version, binary identity, logs, and target identity.
|
||||
- Fixtures cover pass, fail, skipped/waived behavior.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash -n scripts/check-release-digital-twin.sh`
|
||||
- `bats tests/scripts/release-digital-twin.bats`
|
||||
|
||||
Test levels: L1, L2, L3 when remote/real installed target is used.
|
||||
|
||||
### `soc-owed.4` - Make release readiness consume evidence artifacts instead of caller trust
|
||||
|
||||
Ownership: `scripts/check-release-readiness.sh`, readiness schema,
|
||||
`tests/scripts/release-readiness.bats`, `scripts/ci-local-release.sh`.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- Official mode derives readiness from evidence files.
|
||||
- Missing, stale, or wrong-version evidence fails official readiness.
|
||||
- Advisory/fast modes retain cheap feedback without pretending to be release proof.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash -n scripts/check-release-readiness.sh scripts/ci-local-release.sh`
|
||||
- `bats tests/scripts/release-readiness.bats`
|
||||
|
||||
Test levels: L1, L2.
|
||||
|
||||
### `soc-owed.5` - Harden GitHub release publisher to block before GoReleaser publish
|
||||
|
||||
Ownership: `.github/workflows/release.yml`, workflow parity tests/docs,
|
||||
`docs/RELEASING.md`.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- GoReleaser publish is gated by pre-publish readiness/security evidence.
|
||||
- Security failure cannot be ignored for official release publish.
|
||||
- Tests or parity checks prove publish cannot run on doc-only success.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash scripts/validate-ci-policy-parity.sh`
|
||||
- `rg -n 'release-readiness|security-gate|goreleaser' .github/workflows/release.yml`
|
||||
|
||||
Test levels: L1, L2.
|
||||
|
||||
### `soc-owed.6` - Strengthen VIL and HIL evidence beyond ao version smoke
|
||||
|
||||
Ownership: `scripts/check-release-hil.sh`, VIL/digital-twin runner integration,
|
||||
`tests/scripts/release-hil.bats`, `docs/RELEASING.md`.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- HIL/VIL evidence records meaningful install/upgrade/operator workflow checks.
|
||||
- Evidence includes target identity, OS/arch/runtime identity, release version, and logs.
|
||||
- Weak or mismatched target evidence is rejected in official mode.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash -n scripts/check-release-hil.sh`
|
||||
- `bats tests/scripts/release-hil.bats`
|
||||
|
||||
Test levels: L1, L2, L3.
|
||||
|
||||
### `soc-owed.7` - Link eval, security, SBOM, and digital twin evidence into release audit artifacts
|
||||
|
||||
Ownership: `scripts/resolve-release-artifacts.sh`,
|
||||
`scripts/validate-release-audit-artifacts.sh`, `tests/scripts/release-artifacts.bats`,
|
||||
release docs/checklist.
|
||||
|
||||
Acceptance:
|
||||
|
||||
- `release-artifacts.json` links readiness, HIL, VIL/digital-twin, eval, security, and SBOM evidence.
|
||||
- Release artifact resolution requires complete official proof bundles.
|
||||
- Audit validation fails on missing eval/security/twin evidence.
|
||||
|
||||
Validation:
|
||||
|
||||
- `bash -n scripts/resolve-release-artifacts.sh scripts/validate-release-audit-artifacts.sh`
|
||||
- `bats tests/scripts/release-artifacts.bats`
|
||||
|
||||
Test levels: L1, L2.
|
||||
|
||||
## Execution Order
|
||||
|
||||
Wave 1:
|
||||
|
||||
- `soc-owed.2` contract and schema direction.
|
||||
|
||||
Wave 2:
|
||||
|
||||
- `soc-owed.3` digital-twin runner.
|
||||
- `soc-owed.6` HIL/VIL strengthening can begin after the evidence model is stable.
|
||||
|
||||
Wave 3:
|
||||
|
||||
- `soc-owed.4` readiness consumes evidence artifacts.
|
||||
|
||||
Wave 4:
|
||||
|
||||
- `soc-owed.5` pre-publish GitHub release gate.
|
||||
- `soc-owed.7` proof bundle artifact/audit linkage.
|
||||
|
||||
## File Dependency Matrix
|
||||
|
||||
| File | Issues | Serialization |
|
||||
| --- | --- | --- |
|
||||
| `docs/contracts/release-readiness.md` | `.2`, `.4`, `.7` | Contract first, then consumer docs. |
|
||||
| `schemas/release-readiness*.json` | `.2`, `.4` | Schema before readiness consumer. |
|
||||
| `scripts/check-release-readiness.sh` | `.4`, `.7` | Consumer before artifact/audit finalization. |
|
||||
| `scripts/check-release-digital-twin.sh` | `.3` | New file; no parallel writers. |
|
||||
| `scripts/check-release-hil.sh` | `.6` | Coordinate with `.4` evidence schema. |
|
||||
| `.github/workflows/release.yml` | `.5` | After readiness evidence shape stabilizes. |
|
||||
| `scripts/validate-release-audit-artifacts.sh` | `.7` | After manifest fields are defined. |
|
||||
| `docs/RELEASING.md` | `.2`, `.5`, `.6`, `.7` | Contract, workflow, target operation, final proof bundle. |
|
||||
|
||||
## File-Conflict Matrix
|
||||
|
||||
| Shared Surface | Risk | Handling |
|
||||
| --- | --- | --- |
|
||||
| Release readiness schema/script | High | Serialize `.2` then `.4`; do not patch both in parallel. |
|
||||
| Release docs | Medium | Keep contract edits early and checklist edits late. |
|
||||
| Release workflow | High | Patch after tests define pre-publish invariant. |
|
||||
| Artifact validators | Medium | Add tests before validator hardening. |
|
||||
|
||||
## Planning Rules Compliance
|
||||
|
||||
- Mechanical verification: each issue has shell/BATS or parity checks.
|
||||
- Self-assessment: official readiness must be evidence-file-backed.
|
||||
- Propagation: scripts, schemas, docs, workflow, release audit, and tests are all owned.
|
||||
- Rollback/rescue: private host absence remains an explicit waiver path.
|
||||
- Four-surface closure: code/scripts, docs, tests, and release artifacts are included.
|
||||
|
||||
## Verification Commands
|
||||
|
||||
```bash
|
||||
bash -n scripts/check-release-readiness.sh scripts/check-release-hil.sh scripts/ci-local-release.sh scripts/resolve-release-artifacts.sh scripts/validate-release-audit-artifacts.sh
|
||||
bats tests/scripts/release-readiness.bats tests/scripts/release-hil.bats tests/scripts/release-artifacts.bats tests/scripts/ci-local-release.bats
|
||||
bash scripts/check-contract-compatibility.sh
|
||||
bash scripts/validate-ci-policy-parity.sh
|
||||
bash scripts/generate-cli-reference.sh --check
|
||||
scripts/eval-agentops.sh --fast --run-root /tmp/agentops-eval-release-zero-trust
|
||||
scripts/ci-local-release.sh --release-version 2.40.0 --hil-waiver "temporary waiver until official HIL target inventory is approved"
|
||||
```
|
||||
|
||||
## Next Steps
|
||||
|
||||
Run `$agentops:crank soc-owed` after resolving whether the first digital twin is
|
||||
local-only or includes remote VM/container targets.
|
||||
@@ -0,0 +1,41 @@
|
||||
---
|
||||
type: pre-mortem
|
||||
date: 2026-05-02
|
||||
plan: .agents/plans/2026-05-02-ai-native-zero-trust-release-process.md
|
||||
epic: soc-owed
|
||||
verdict: WARN
|
||||
mode: quick
|
||||
---
|
||||
|
||||
# Pre-Mortem: AI-Native Zero-Trust Release Process
|
||||
|
||||
## Verdict
|
||||
|
||||
WARN. The plan is valid, but two risks must be handled during implementation:
|
||||
|
||||
1. Digital twin can become theater if it only runs `ao version` in a temp
|
||||
directory. It must exercise install/upgrade/operator workflows.
|
||||
2. A stricter release workflow can accidentally block public publishing on
|
||||
private host availability. HIL waivers must remain explicit and audited.
|
||||
|
||||
## Checks
|
||||
|
||||
| Pattern | Verdict | Notes |
|
||||
| --- | --- | --- |
|
||||
| Mechanical verification | PASS | Issues include BATS, shell syntax, parity, and artifact audit tests. |
|
||||
| Self-assessment | PASS | Official readiness becomes evidence-file-backed. |
|
||||
| Context rot | PASS | Plan and execution packet are file-backed. |
|
||||
| Propagation blindness | PASS | Workflow, scripts, docs, schemas, and release artifacts are all included. |
|
||||
| Dead infrastructure | WARN | Real HIL targets are not yet selected. Preserve waiver semantics. |
|
||||
| Rollback/rescue | WARN | Retag/release flows need a clear recovery path if pre-publish evidence fails. |
|
||||
| Four-surface closure | PASS | Code, docs, tests, and artifacts are all represented. |
|
||||
|
||||
## Required Hardening
|
||||
|
||||
- `soc-owed.3` must define digital-twin pass criteria before wiring it into
|
||||
official readiness.
|
||||
- `soc-owed.5` must prove GoReleaser cannot publish on doc-only success.
|
||||
- `soc-owed.6` must reject weak HIL evidence such as version-only smoke in
|
||||
official mode unless a waiver is explicitly recorded.
|
||||
|
||||
Proceed with implementation after target inventory decisions are made.
|
||||
@@ -0,0 +1,119 @@
|
||||
---
|
||||
id: research-2026-05-02-ai-native-zero-trust-release-process
|
||||
type: research
|
||||
date: 2026-05-02
|
||||
backend: codex-sub-agent + inline
|
||||
goal: "AI-agent-native zero-trust release process with SIL/VIL/HIL and digital-twin evidence."
|
||||
---
|
||||
|
||||
# Research: AI-Native Zero-Trust Release Process
|
||||
|
||||
## Summary
|
||||
|
||||
AgentOps already has a first-stage release readiness score from `soc-h22t`:
|
||||
`release-readiness.json` scores SIL, VIL, HIL, artifacts, security, and evals.
|
||||
That work is necessary but not sufficient for the user's thesis. The current
|
||||
release process still has ordinary CI/CD assumptions:
|
||||
|
||||
- the GitHub release workflow publishes with GoReleaser before it generates
|
||||
readiness/security/SBOM assets;
|
||||
- release readiness can be recorded from caller-supplied status strings rather
|
||||
than concrete evidence artifacts;
|
||||
- HIL can be as weak as `ao version`;
|
||||
- there is no release-specific digital-twin artifact, runner, schema, or gate.
|
||||
|
||||
The next release-process layer should become evidence-first: produce and verify
|
||||
SIL, VIL, HIL, digital-twin, eval, security, SBOM, and build provenance before
|
||||
build/tag/publish, or at minimum before GoReleaser publishes any artifact.
|
||||
|
||||
## Product Context Applied
|
||||
|
||||
`PRODUCT.md` frames AgentOps as operational discipline for indeterministic
|
||||
workers. The Quality-First Maintainer persona wants fewer, higher-confidence
|
||||
releases, and the core value prop says validation gates block rather than
|
||||
advise. A zero-trust release gate is therefore product-aligned.
|
||||
|
||||
## Prior Knowledge Applied
|
||||
|
||||
- `.agents/plans/2026-05-02-release-readiness-eight-sil-vil-hil.md` and
|
||||
`.agents/research/2026-05-02-release-readiness-eight-sil-vil-hil.md` define
|
||||
the first-stage SIL/VIL/HIL readiness contract.
|
||||
- `.agents/findings/f-2026-05-01-021.md` applies: cross-compile + scp + ssh to
|
||||
target is the known cross-host validation pattern.
|
||||
- `.agents/findings/f-2026-05-01-024.md` applies: live daemon/service proof on
|
||||
production hosts should count as L3 system proof.
|
||||
- `.agents/findings/f-2026-04-30-002.md` is relevant as a warning: gates should
|
||||
detect missing upstream inputs rather than repeatedly failing on empty state.
|
||||
|
||||
## Key Files
|
||||
|
||||
| File | Evidence |
|
||||
| --- | --- |
|
||||
| `.github/workflows/release.yml` | Publish job needs only doc gate success before GoReleaser; security is continue-on-error, and readiness is generated after publish. |
|
||||
| `scripts/ci-local-release.sh` | Local release gate writes artifacts and currently has HIL/readiness phases after build/smoke/security. It also now stamps build version from `release_version()`. |
|
||||
| `scripts/check-release-readiness.sh` | Scores statuses, but official mode still trusts supplied `--sil`, `--vil`, `--security`, and `--eval` values. |
|
||||
| `scripts/check-release-hil.sh` | Captures local/SSH target evidence, but target commands are arbitrary and can be weak. |
|
||||
| `docs/contracts/release-readiness.md` | Defines current 10-point score with SIL/VIL/HIL, but no digital-twin dimension. |
|
||||
| `schemas/release-readiness.v1.schema.json` | Current schema has no evidence object references beyond HIL artifact/waiver. |
|
||||
| `scripts/eval-agentops.sh` | Runs canaries and baseline audit, but release readiness does not link to eval run artifacts. |
|
||||
| `scripts/resolve-release-artifacts.sh` and `scripts/validate-release-audit-artifacts.sh` | Right extension points for complete proof bundle validation. |
|
||||
|
||||
## Current Flow
|
||||
|
||||
1. Local operator runs `scripts/ci-local-release.sh --release-version X.Y.Z`
|
||||
to generate local artifacts and readiness evidence.
|
||||
2. Operator tags and pushes.
|
||||
3. GitHub `release.yml` verifies the tag and token, extracts notes, deletes any
|
||||
existing release, then publishes via GoReleaser.
|
||||
4. After publish, the workflow generates SBOM, security summary, and advisory
|
||||
readiness assets.
|
||||
|
||||
This is not fully zero-trust because the release publisher does not consume the
|
||||
authoritative evidence bundle before publish.
|
||||
|
||||
## Gap Analysis
|
||||
|
||||
1. **No digital twin lane.** Simulation exists in pre-mortem language, not as a
|
||||
release-environment execution artifact.
|
||||
2. **Status strings are too trusting.** Official readiness should derive status
|
||||
from evidence files with schemas, timestamps, release version, target identity,
|
||||
binary digest, artifact digest, command logs, and pass criteria.
|
||||
3. **Publisher can publish before evidence.** GoReleaser runs before readiness
|
||||
assets are generated in `.github/workflows/release.yml`.
|
||||
4. **HIL/VIL evidence is shallow.** `ao version` proves command execution, not
|
||||
install/upgrade/operator workflow fidelity.
|
||||
5. **Eval/security evidence is under-linked.** Eval fast/baseline audit and
|
||||
security reports should be referenced in `release-artifacts.json` and checked
|
||||
by audit validators.
|
||||
|
||||
## Test Levels
|
||||
|
||||
Required: L0, L1, L2.
|
||||
|
||||
Recommended: L3 when real HIL targets, remote VIL runners, or live daemon/runtime
|
||||
hosts are available.
|
||||
|
||||
Rationale: this touches shell scripts, schemas, docs, GitHub Actions, release
|
||||
artifact resolution, and external target execution. Digital twin evidence is a
|
||||
system simulation lane and should be treated as L2 minimum, L3 when it runs
|
||||
against real installed binaries or remote hosts.
|
||||
|
||||
## Quality Validation
|
||||
|
||||
Coverage checked: release docs, local release gate, GitHub release workflow,
|
||||
current readiness/HIL scripts, schemas, eval wrapper, release artifact validators,
|
||||
prior SIL/VIL/HIL research, and existing bd epic history.
|
||||
|
||||
Depth ratings:
|
||||
|
||||
| Area | Depth | Notes |
|
||||
| --- | ---: | --- |
|
||||
| Release publisher workflow | 3/4 | Publish-before-evidence path is clear. |
|
||||
| Current readiness scoring | 3/4 | Status-score model is mapped. |
|
||||
| Digital twin gap | 2/4 | Absence is clear; implementation shape needs decisions. |
|
||||
| HIL/VIL strengthening | 2/4 | Target inventory remains operator-specific. |
|
||||
| Eval/security linkage | 2/4 | Extension points are clear; exact artifact schema needs plan execution. |
|
||||
|
||||
Critical assumption: the first useful digital twin can be a deterministic
|
||||
disposable local environment that exercises install/upgrade/operator workflows.
|
||||
Remote or hardware-backed twins can be layered after the contract exists.
|
||||
@@ -1,61 +1,50 @@
|
||||
{
|
||||
"schema_version": "1.0",
|
||||
"run_id": "rpi-2026-05-02-ci-parity-pre-push-gate",
|
||||
"objective": "Implement preventive guardrails (S1+S2) against recurring main-branch CI parity-drift failures: a new scripts/check-test-fixture-parity.sh validator wired into scripts/pre-push-gate.sh that mirrors the CI-side hook-coverage scan and bats fake-repo stub completeness assertions, plus making embedded-sync unconditional.",
|
||||
"epic_id": "soc-zkhu",
|
||||
"tracker_mode": "beads",
|
||||
"tracker_health": "healthy",
|
||||
"complexity": "standard",
|
||||
"test_first": true,
|
||||
"discovery_completed": "2026-05-02",
|
||||
"input_research_artifact": ".agents/research/2026-05-02-ci-failure-prevention.md",
|
||||
"discovery_phase": {
|
||||
"design_gate": {
|
||||
"verdict": "SKIPPED",
|
||||
"rationale": "CI hardening is a chore/ops surface, not a product feature; PRODUCT.md design gate doesn't apply."
|
||||
},
|
||||
"brainstorm": {
|
||||
"verdict": "SKIPPED",
|
||||
"rationale": "Goal was concrete (>50 chars, specific surfaces named) — skipped per /discovery STEP 1 contract."
|
||||
},
|
||||
"research_artifact": ".agents/research/2026-05-02-ci-failure-prevention.md",
|
||||
"plan_path": ".agents/plans/2026-05-02-ci-parity-pre-push-gate.md",
|
||||
"pre_mortem_artifact": ".agents/council/2026-05-02-pre-mortem-ci-parity-pre-push-gate.md",
|
||||
"pre_mortem_verdict": "WARN",
|
||||
"pre_mortem_amendments_propagated": [
|
||||
{"issue": "soc-zkhu.1", "findings": ["W1-helper-extraction-regex", "W2-output-format", "W4-bypass-env-var"]},
|
||||
{"issue": "soc-zkhu.4", "findings": ["W3-fixture-not-checkout"]}
|
||||
],
|
||||
"scope_mode": "hold"
|
||||
},
|
||||
"issues": [
|
||||
{"id": "soc-zkhu.1", "title": "I1: Create scripts/check-test-fixture-parity.sh", "wave": 1, "deps": []},
|
||||
{"id": "soc-zkhu.2", "title": "I3: Make embedded-sync unconditional in pre-push-gate.sh", "wave": 1, "deps": []},
|
||||
{"id": "soc-zkhu.3", "title": "I2: Wire parity validator into pre-push-gate.sh", "wave": 2, "deps": ["soc-zkhu.1"]},
|
||||
{"id": "soc-zkhu.4", "title": "I4: Bats coverage for check-test-fixture-parity.sh", "wave": 2, "deps": ["soc-zkhu.1"]}
|
||||
],
|
||||
"test_levels": ["L1", "L2"],
|
||||
"schema_version": 1,
|
||||
"run_id": "20260502T235112Z-ai-native-zero-trust-release",
|
||||
"objective": "Make the AI-agent-native release process right: zero-trust CI/CD with SIL/VIL/HIL and digital-twin evidence before build/tag/release.",
|
||||
"epic_id": "soc-owed",
|
||||
"plan_path": ".agents/plans/2026-05-02-ai-native-zero-trust-release-process.md",
|
||||
"contract_surfaces": [
|
||||
"scripts/check-test-fixture-parity.sh",
|
||||
"scripts/pre-push-gate.sh",
|
||||
"tests/scripts/test-check-test-fixture-parity.bats",
|
||||
"tests/scripts/fixtures/parity-replay-5da522e9/"
|
||||
"docs/contracts/release-readiness.md",
|
||||
"schemas/release-readiness.v1.schema.json",
|
||||
".github/workflows/release.yml",
|
||||
"docs/RELEASING.md",
|
||||
"docs/CI-CD.md"
|
||||
],
|
||||
"validation_commands": [
|
||||
"bash -n scripts/check-release-readiness.sh scripts/check-release-hil.sh scripts/ci-local-release.sh scripts/resolve-release-artifacts.sh scripts/validate-release-audit-artifacts.sh",
|
||||
"bats tests/scripts/release-readiness.bats tests/scripts/release-hil.bats tests/scripts/release-artifacts.bats tests/scripts/ci-local-release.bats",
|
||||
"bash scripts/check-contract-compatibility.sh",
|
||||
"bash scripts/validate-ci-policy-parity.sh",
|
||||
"bash scripts/generate-cli-reference.sh --check",
|
||||
"scripts/eval-agentops.sh --fast --run-root /tmp/agentops-eval-release-zero-trust"
|
||||
],
|
||||
"tracker_mode": "beads",
|
||||
"tracker_health": {
|
||||
"healthy": true,
|
||||
"mode": "beads",
|
||||
"reason": "bd ready/list succeeded; epic soc-owed and six child issues created"
|
||||
},
|
||||
"done_criteria": [
|
||||
"scripts/check-test-fixture-parity.sh exists and exits 0 on current main",
|
||||
"Replay-regression fixture exits 1 with named missing entries",
|
||||
"Pre-push gate 5b runs under needs_check hook||shell",
|
||||
"Embedded-sync gate at pre-push-gate.sh:535 no longer wrapped in needs_check hook",
|
||||
"tests/scripts/test-check-test-fixture-parity.bats: 4/4 cases pass",
|
||||
"Validate workflow on main: bats-tests + cli-integration green for at least one push"
|
||||
],
|
||||
"boundaries_out_of_scope": [
|
||||
"S3 cli-docs-parity pre-push",
|
||||
"S4 command/test pairing",
|
||||
"warn-only job triage (agentops-eval-advisory, security-toolchain-gate)",
|
||||
".github/workflows/validate.yml CI-side changes",
|
||||
"Go code or cli/ changes"
|
||||
"Official release readiness is evidence-file-backed, not status-string-backed.",
|
||||
"Digital twin evidence is a first-class release readiness dimension or linked evidence artifact.",
|
||||
"GitHub release publish cannot run GoReleaser before readiness/security evidence passes.",
|
||||
"HIL/VIL evidence exercises realistic install/upgrade/operator workflows, not only ao version.",
|
||||
"Release audit artifacts link readiness, HIL/VIL, digital twin, eval, security, and SBOM evidence."
|
||||
],
|
||||
"complexity": "standard",
|
||||
"pre_mortem_verdict": "WARN",
|
||||
"test_levels": {
|
||||
"required": [
|
||||
"L0",
|
||||
"L1",
|
||||
"L2"
|
||||
],
|
||||
"recommended": [
|
||||
"L3"
|
||||
],
|
||||
"rationale": "Release process changes span scripts, schema, GitHub Actions, docs, artifact validators, and live target evidence. L3 applies when HIL or realistic installed digital-twin targets are available."
|
||||
},
|
||||
"ranked_packet_path": ".agents/rpi/ranked-packet.json",
|
||||
"discovery_runtime_attempts": 1
|
||||
"discovery_timestamp": "2026-05-02T23:51:12Z"
|
||||
}
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
# Phase 1 Summary: Discovery
|
||||
|
||||
- **Goal:** Make the AI-agent-native release process right: zero-trust CI/CD with SIL/VIL/HIL and digital-twin evidence before build/tag/release.
|
||||
- **Epic:** `soc-owed`
|
||||
- **Issues:** 6
|
||||
- **Complexity:** standard
|
||||
- **Pre-mortem:** WARN (attempt 1/3)
|
||||
- **Brainstorm:** skipped; goal was specific and prior SIL/VIL/HIL brainstorm existed
|
||||
- **Design gate:** PASS
|
||||
- **History search:** prior `soc-h22t`, release-readiness research, and live-host findings applied
|
||||
- **Status:** DONE
|
||||
- **Timestamp:** 2026-05-02T23:51:12Z
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"goal": "Release readiness >=8/10 with SIL/VIL/HIL evidence in the release process",
|
||||
"generated_at": "2026-05-02T15:08:39-04:00",
|
||||
"goal": "AI-native zero-trust release process with SIL/VIL/HIL and digital-twin evidence before build/tag/release",
|
||||
"generated_at": "2026-05-02T23:51:12Z",
|
||||
"applied_findings": [
|
||||
{
|
||||
"path": ".agents/findings/f-2026-05-01-024.md",
|
||||
@@ -12,21 +12,25 @@
|
||||
"reason": "Cross-host install-and-smoke pattern maps to remote HIL targets."
|
||||
},
|
||||
{
|
||||
"path": ".agents/findings/f-2026-05-01-025.md",
|
||||
"reason": "Use quick lifecycle gates for multi-phase discovery."
|
||||
},
|
||||
{
|
||||
"path": ".agents/findings/f-2026-05-02-005.md",
|
||||
"reason": "Implementation must verify tracked file edits and diffs after edits."
|
||||
"path": ".agents/findings/f-2026-04-30-002.md",
|
||||
"reason": "Release gates should detect missing upstream evidence inputs instead of repeatedly failing on empty state."
|
||||
}
|
||||
],
|
||||
"prior_art": [
|
||||
".agents/research/2026-04-24-agentops-evaluation-environment.md",
|
||||
".agents/research/2026-04-29-eval-suite-triage.md",
|
||||
".agents/research/2026-04-26-state-since-v2.38.0.md",
|
||||
".agents/research/2026-05-02-release-readiness-eight-sil-vil-hil.md",
|
||||
".agents/plans/2026-05-02-release-readiness-eight-sil-vil-hil.md",
|
||||
".agents/council/2026-05-02-pre-mortem-release-readiness-eight-sil-vil-hil.md",
|
||||
"docs/contracts/release-readiness.md",
|
||||
"docs/contracts/eval-environment.md",
|
||||
"docs/RELEASING.md",
|
||||
"docs/CI-CD.md"
|
||||
],
|
||||
"next_work": []
|
||||
"next_work": [
|
||||
"soc-owed.2",
|
||||
"soc-owed.3",
|
||||
"soc-owed.4",
|
||||
"soc-owed.5",
|
||||
"soc-owed.6",
|
||||
"soc-owed.7"
|
||||
]
|
||||
}
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"run_id": "20260502T235112Z-ai-native-zero-trust-release",
|
||||
"objective": "Make the AI-agent-native release process right: zero-trust CI/CD with SIL/VIL/HIL and digital-twin evidence before build/tag/release.",
|
||||
"epic_id": "soc-owed",
|
||||
"plan_path": ".agents/plans/2026-05-02-ai-native-zero-trust-release-process.md",
|
||||
"contract_surfaces": [
|
||||
"docs/contracts/release-readiness.md",
|
||||
"schemas/release-readiness.v1.schema.json",
|
||||
".github/workflows/release.yml",
|
||||
"docs/RELEASING.md",
|
||||
"docs/CI-CD.md"
|
||||
],
|
||||
"validation_commands": [
|
||||
"bash -n scripts/check-release-readiness.sh scripts/check-release-hil.sh scripts/ci-local-release.sh scripts/resolve-release-artifacts.sh scripts/validate-release-audit-artifacts.sh",
|
||||
"bats tests/scripts/release-readiness.bats tests/scripts/release-hil.bats tests/scripts/release-artifacts.bats tests/scripts/ci-local-release.bats",
|
||||
"bash scripts/check-contract-compatibility.sh",
|
||||
"bash scripts/validate-ci-policy-parity.sh",
|
||||
"bash scripts/generate-cli-reference.sh --check",
|
||||
"scripts/eval-agentops.sh --fast --run-root /tmp/agentops-eval-release-zero-trust"
|
||||
],
|
||||
"tracker_mode": "beads",
|
||||
"tracker_health": {
|
||||
"healthy": true,
|
||||
"mode": "beads",
|
||||
"reason": "bd ready/list succeeded; epic soc-owed and six child issues created"
|
||||
},
|
||||
"done_criteria": [
|
||||
"Official release readiness is evidence-file-backed, not status-string-backed.",
|
||||
"Digital twin evidence is a first-class release readiness dimension or linked evidence artifact.",
|
||||
"GitHub release publish cannot run GoReleaser before readiness/security evidence passes.",
|
||||
"HIL/VIL evidence exercises realistic install/upgrade/operator workflows, not only ao version.",
|
||||
"Release audit artifacts link readiness, HIL/VIL, digital twin, eval, security, and SBOM evidence."
|
||||
],
|
||||
"complexity": "standard",
|
||||
"pre_mortem_verdict": "WARN",
|
||||
"test_levels": {
|
||||
"required": [
|
||||
"L0",
|
||||
"L1",
|
||||
"L2"
|
||||
],
|
||||
"recommended": [
|
||||
"L3"
|
||||
],
|
||||
"rationale": "Release process changes span scripts, schema, GitHub Actions, docs, artifact validators, and live target evidence. L3 applies when HIL or realistic installed digital-twin targets are available."
|
||||
},
|
||||
"ranked_packet_path": ".agents/rpi/ranked-packet.json",
|
||||
"discovery_timestamp": "2026-05-02T23:51:12Z"
|
||||
}
|
||||
@@ -6,13 +6,13 @@
|
||||
},
|
||||
"metadata": {
|
||||
"description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
|
||||
"version": "2.38.0"
|
||||
"version": "2.39.0"
|
||||
},
|
||||
"plugins": [
|
||||
{
|
||||
"name": "agentops",
|
||||
"description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
|
||||
"version": "2.38.0",
|
||||
"version": "2.39.0",
|
||||
"source": "./",
|
||||
"author": {
|
||||
"name": "Boden Fuller",
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"name": "agentops",
|
||||
"version": "2.38.0",
|
||||
"version": "2.39.0",
|
||||
"description": "The operational layer for coding agents. Bookkeeping, validation, and flows that compound knowledge between sessions.",
|
||||
"author": {
|
||||
"name": "Boden Fuller",
|
||||
|
||||
@@ -15,6 +15,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
- **GitHub eval advisory setup** — the `agentops-eval-advisory` job now installs the deterministic canary toolchain (`jq`, `ripgrep`, `bats`, `bd`, and `gocyclo`) and initializes a disposable bd database before running `scripts/eval-agentops.sh --fast`, matching the local environment expected by the public canaries.
|
||||
|
||||
## [2.39.0] - 2026-04-27
|
||||
|
||||
### Added
|
||||
|
||||
- **`ao agents` command group** - added `ao agents inspect`, `ao agents lint`, and `ao agents doctor` for `.agents/` write-surface introspection, linting, orphan reporting, and combined health checks.
|
||||
- **Dream finding-generator pipeline** - added generator sidecar recording, aggregation, external-watchlist candidate emission, RFC 0001 authoring docs, and an `external_watchlist_emitted` fitness counter.
|
||||
- **RPI next-work v1.4 metadata** - promoted `status`, `requires`, `dedup_key`, and external-watchlist routing into first-class next-work contract fields, validators, and skill documentation.
|
||||
- **Goals measurement filtering** - added `ao goals measure --exclude-tag` and tagged `flywheel-compounding` as `long-cycle` / `corpus-state` so long-cycle corpus state can be excluded from selected measurements.
|
||||
- **`.agents/` write-surface contract** - catalogued repo memory write surfaces, added a lint gate, and added production-code smoke coverage for the allowlisted surfaces.
|
||||
- **Harvest nested artifact support** - harvest now recurses into nested artifact directories and emits real rig metadata.
|
||||
|
||||
### Changed
|
||||
|
||||
- **Codex runtime packaging** - refreshed Codex skills for GPT-5.5, aligned Codex plugin metadata with the marketplace schema, regenerated manifests and shared hashes, converted remaining skill references to `$skill` notation, and reduced skill-catalog context footprint.
|
||||
- **Hook runtime backend** - refactored hooks around a managed runtime backend and refreshed native Codex hook/runtime proof gates.
|
||||
- **Docs and release governance** - restored `docs/index.md`, renamed the full catalog to `docs/documentation-index.md`, added `.agents/` operator and comparison docs, and accepted RFC 0001 for finding-generator parallelism.
|
||||
- **Release gate coverage** - CI/local gates now cover command/test pairing, next-work schema rows, Codex RPI contracts, assertion-density scope, agents write surfaces, standards-injector completeness, and release audit artifact references.
|
||||
- **Goals parsing internals** - reduced markdown parser complexity by extracting table-cell helpers without changing behavior.
|
||||
- **Bootstrap behavior** - `/bootstrap` now recommends installing `bd` instead of attempting automatic installation.
|
||||
|
||||
### Fixed
|
||||
|
||||
- **CLI output safety** - fixed JSON and UTF-8 truncation bugs, command catalog drift, commit-review redaction, stale docs links, and temp-directory walk-up behavior in `FindAgentsDir`.
|
||||
- **Security and scanner false positives** - closed the harvest TOCTOU path with `os.OpenRoot`, excluded safe regexp literals from broad secret scans, and split secret-regex construction so release gates do not flag their own patterns.
|
||||
- **Codex/runtime drift** - fixed Codex skill chaining defaults, native hook manifest install, quiet session-start behavior, hook test gaps, `$skill` notation, and vibe language-gated complexity.
|
||||
- **RPI, triage, and coverage edges** - repaired partial-batch lifecycle drift, pinned coverage-anchor parsing, isolated RPI supervisor test state, added inject/ratchet/harvest/overnight regressions, and normalized stale next-work bookkeeping.
|
||||
- **Release blockers** - aligned the next-work schema contract with current queue enums and paired new command changes with regression tests so the release gate passes cleanly.
|
||||
|
||||
## [2.38.0] - 2026-04-22
|
||||
|
||||
### Added
|
||||
|
||||
@@ -15,6 +15,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
- **GitHub eval advisory setup** — the `agentops-eval-advisory` job now installs the deterministic canary toolchain (`jq`, `ripgrep`, `bats`, `bd`, and `gocyclo`) and initializes a disposable bd database before running `scripts/eval-agentops.sh --fast`, matching the local environment expected by the public canaries.
|
||||
|
||||
## [2.39.0] - 2026-04-27
|
||||
|
||||
### Added
|
||||
|
||||
- **`ao agents` command group** - added `ao agents inspect`, `ao agents lint`, and `ao agents doctor` for `.agents/` write-surface introspection, linting, orphan reporting, and combined health checks.
|
||||
- **Dream finding-generator pipeline** - added generator sidecar recording, aggregation, external-watchlist candidate emission, RFC 0001 authoring docs, and an `external_watchlist_emitted` fitness counter.
|
||||
- **RPI next-work v1.4 metadata** - promoted `status`, `requires`, `dedup_key`, and external-watchlist routing into first-class next-work contract fields, validators, and skill documentation.
|
||||
- **Goals measurement filtering** - added `ao goals measure --exclude-tag` and tagged `flywheel-compounding` as `long-cycle` / `corpus-state` so long-cycle corpus state can be excluded from selected measurements.
|
||||
- **`.agents/` write-surface contract** - catalogued repo memory write surfaces, added a lint gate, and added production-code smoke coverage for the allowlisted surfaces.
|
||||
- **Harvest nested artifact support** - harvest now recurses into nested artifact directories and emits real rig metadata.
|
||||
|
||||
### Changed
|
||||
|
||||
- **Codex runtime packaging** - refreshed Codex skills for GPT-5.5, aligned Codex plugin metadata with the marketplace schema, regenerated manifests and shared hashes, converted remaining skill references to `$skill` notation, and reduced skill-catalog context footprint.
|
||||
- **Hook runtime backend** - refactored hooks around a managed runtime backend and refreshed native Codex hook/runtime proof gates.
|
||||
- **Docs and release governance** - restored `docs/index.md`, renamed the full catalog to `docs/documentation-index.md`, added `.agents/` operator and comparison docs, and accepted RFC 0001 for finding-generator parallelism.
|
||||
- **Release gate coverage** - CI/local gates now cover command/test pairing, next-work schema rows, Codex RPI contracts, assertion-density scope, agents write surfaces, standards-injector completeness, and release audit artifact references.
|
||||
- **Goals parsing internals** - reduced markdown parser complexity by extracting table-cell helpers without changing behavior.
|
||||
- **Bootstrap behavior** - `/bootstrap` now recommends installing `bd` instead of attempting automatic installation.
|
||||
|
||||
### Fixed
|
||||
|
||||
- **CLI output safety** - fixed JSON and UTF-8 truncation bugs, command catalog drift, commit-review redaction, stale docs links, and temp-directory walk-up behavior in `FindAgentsDir`.
|
||||
- **Security and scanner false positives** - closed the harvest TOCTOU path with `os.OpenRoot`, excluded safe regexp literals from broad secret scans, and split secret-regex construction so release gates do not flag their own patterns.
|
||||
- **Codex/runtime drift** - fixed Codex skill chaining defaults, native hook manifest install, quiet session-start behavior, hook test gaps, `$skill` notation, and vibe language-gated complexity.
|
||||
- **RPI, triage, and coverage edges** - repaired partial-batch lifecycle drift, pinned coverage-anchor parsing, isolated RPI supervisor test state, added inject/ratchet/harvest/overnight regressions, and normalized stale next-work bookkeeping.
|
||||
- **Release blockers** - aligned the next-work schema contract with current queue enums and paired new command changes with regression tests so the release gate passes cleanly.
|
||||
|
||||
## [2.38.0] - 2026-04-22
|
||||
|
||||
### Added
|
||||
|
||||
@@ -18,7 +18,7 @@ permalink: /comparisons/agentops-vs-claude-flow
|
||||
|--------|-------------|----------|
|
||||
| **Philosophy** | "Swarm intelligence at scale" | "Operational layer for coding agents; technically a context compiler" |
|
||||
| **Core strength** | Multi-agent orchestration, WASM performance, 314 MCP tools | Cross-session memory, validation gates, knowledge flywheel |
|
||||
| **Latest** | v3.5.65 (April 2026, rebranded to Ruflo) | v2.38.0 (April 2026) |
|
||||
| **Latest** | v3.5.65 (April 2026, rebranded to Ruflo) | v2.39.0 (April 2026) |
|
||||
| **GitHub stars** | 11,400+ | 240+ (growing rapidly) |
|
||||
| **Downloads** | 500,000+ | — |
|
||||
| **Primary use** | Enterprise orchestration | Ongoing codebase work |
|
||||
|
||||
@@ -19,7 +19,7 @@ permalink: /comparisons/agentops-vs-compound-engineer
|
||||
| **Philosophy** | "Each unit of engineering work should make subsequent units easier" | "Operational layer for coding agents; technically a context compiler" |
|
||||
| **Core strength** | Full ideate-to-compound loop, cross-runtime portability, configurable review agents | Git-tracked memory, validation gates, knowledge flywheel with scoring |
|
||||
| **GitHub** | EveryInc/compound-engineering-plugin | boshu2/agentops |
|
||||
| **Latest** | Active development (April 2026) | v2.38.0 (April 2026) |
|
||||
| **Latest** | Active development (April 2026) | v2.39.0 (April 2026) |
|
||||
| **Scale** | 45+ skills, 25+ agents, 10 runtime targets | 50+ skills, compiled CLI, hooks, schemas |
|
||||
| **Primary use** | Standardized engineering workflow with knowledge capture | Ongoing codebase work with persistent memory and validation |
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ permalink: /comparisons/agentops-vs-gsd
|
||||
| **Philosophy** | "Ship fast — fresh context per agent" | "Operational layer for coding agents; technically a context compiler" |
|
||||
| **Core strength** | Multi-agent orchestration with context isolation, multi-runtime support | Cross-session memory, validation gates, knowledge flywheel |
|
||||
| **GitHub** | glittercowboy/get-shit-done | boshu2/agentops |
|
||||
| **Latest** | v1.34.2 (April 2026) | v2.38.0 (April 2026) |
|
||||
| **Latest** | v1.34.2 (April 2026) | v2.39.0 (April 2026) |
|
||||
| **Scale** | 53 commands, 46 workflows, 16 agents | 50+ skills, compiled CLI, hooks, schemas |
|
||||
| **Primary use** | Spec-driven development with phased execution | Ongoing codebase work with persistent memory |
|
||||
|
||||
|
||||
+1
-1
@@ -156,7 +156,7 @@ Every skill works alone. Compose flows for end-to-end cycles.
|
||||
| [`/dream`](skills/dream.md) | You want overnight knowledge compounding that never mutates source code |
|
||||
|
||||
!!! info "Full catalog"
|
||||
[:octicons-book-24: **All 69 skills**](skills/catalog.md) — complete reference with source links and descriptions.
|
||||
[:octicons-book-24: **All 70 skills**](skills/catalog.md) — complete reference with source links and descriptions.
|
||||
[:octicons-routes-24: **Decision tree**](skills-decision-tree.md) — "which skill do I need next?"
|
||||
|
||||
---
|
||||
|
||||
@@ -40,7 +40,7 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "cli-command-headings: top=58 sub=140 all=198"},
|
||||
{"type": "stdout_contains", "value": "cli-command-headings: top=62 sub=152 all=214"},
|
||||
{"type": "stdout_contains", "value": "cli-help-matrix-ok"}
|
||||
],
|
||||
"dimensions": ["correctness", "runtime_compatibility", "artifact_quality"],
|
||||
|
||||
@@ -105,7 +105,7 @@
|
||||
"kind": "artifact_check",
|
||||
"objective": "Ensure the public product contract still describes curation, quality measurement, feedback, and promotion as part of the compounding control plane.",
|
||||
"expectations": [
|
||||
{"type": "artifact_contains", "target": "../../PRODUCT.md", "value": "ao inject`, `ao lookup`, `ao forge`, `ao curate`, `ao defrag`, and `ao memory sync` manage learning capture, retrieval, freshness decay, and promotion"},
|
||||
{"type": "artifact_contains", "target": "../../PRODUCT.md", "value": "ao inject`, `ao lookup`, `ao forge`, `ao curate`, `ao defrag`, `ao memory sync` manage learning capture, retrieval, freshness decay, promotion"},
|
||||
{"type": "artifact_contains", "target": "../../docs/curation-pipeline.md", "value": "Each agent is an experiment. Each experiment produces data. The data gets curated."},
|
||||
{"type": "artifact_contains", "target": "../../docs/curation-pipeline.md", "value": "Existing pool pipeline: pending -> staged -> promoted"},
|
||||
{"type": "artifact_contains", "target": "../../docs/curation-pipeline.md", "value": "After promotion, artifacts enter the MemRL utility tracking system."},
|
||||
|
||||
@@ -62,7 +62,7 @@
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "Results: 3 PASS, 0 FAIL"},
|
||||
{"type": "stdout_contains", "value": "PASS: Codex-native install flow verified"},
|
||||
{"type": "stdout_contains", "value": "skills tested: 69"}
|
||||
{"type": "stdout_contains", "value": "skills tested: 70"}
|
||||
],
|
||||
"dimensions": ["correctness", "runtime_compatibility", "process_adherence", "artifact_quality"],
|
||||
"critical": true
|
||||
|
||||
@@ -17,7 +17,7 @@ top_count="$(rg -c '^### `ao ' "$DOCS_PATH")"
|
||||
sub_count="$(rg -c '^#### `ao ' "$DOCS_PATH")"
|
||||
all_count="$(rg -c '^#{3,4} `ao ' "$DOCS_PATH")"
|
||||
|
||||
if [[ "$top_count" != "58" || "$sub_count" != "140" || "$all_count" != "198" ]]; then
|
||||
if [[ "$top_count" != "62" || "$sub_count" != "152" || "$all_count" != "214" ]]; then
|
||||
printf 'unexpected command heading counts: top=%s sub=%s all=%s\n' "$top_count" "$sub_count" "$all_count" >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -25,7 +25,7 @@ fi
|
||||
# shellcheck disable=SC2016 # literal backticks delimit generated Markdown command headings.
|
||||
mapfile -t commands < <(rg '^#{3,4} `ao ' "$DOCS_PATH" | sed -E 's/^.*`([^`]+)`.*/\1/')
|
||||
|
||||
if [[ "${#commands[@]}" -ne 198 ]]; then
|
||||
if [[ "${#commands[@]}" -ne 214 ]]; then
|
||||
printf 'unexpected command matrix size: %s\n' "${#commands[@]}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
@@ -94,7 +94,7 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "Total: 212"},
|
||||
{"type": "stdout_contains", "value": "Total: 222"},
|
||||
{"type": "stdout_contains", "value": "Fail: 0"},
|
||||
{"type": "stdout_contains", "value": "ALL PASSED"}
|
||||
],
|
||||
|
||||
@@ -41,8 +41,8 @@
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "Hook preflight PASSED"},
|
||||
{"type": "stdout_contains", "value": "Registered: 34 of 48"},
|
||||
{"type": "stdout_contains", "value": "Unregistered: 14"},
|
||||
{"type": "stdout_contains", "value": "Registered: 36 of 51"},
|
||||
{"type": "stdout_contains", "value": "Unregistered: 15"},
|
||||
{"type": "stdout_contains", "value": "JSON-emitting (WARNING): 0"},
|
||||
{"type": "stdout_contains", "value": "context-guard.sh"},
|
||||
{"type": "stdout_contains", "value": "precompact-snapshot.sh"},
|
||||
@@ -115,7 +115,7 @@
|
||||
"timeout_seconds": 60,
|
||||
"inputs": {
|
||||
"cwd": "../..",
|
||||
"shell": "jq -e '[.. | .command? // empty] as $cmds | ($cmds | length == 38) and ($cmds | map(capture(\"(?<script>[^/ ]+\\\\.sh)$\").script) | unique | length == 33) and (($cmds | map(select(test(\"ao-inject\\\\.sh\"))) | length) == 0)' hooks/hooks.json >/dev/null && echo hook-manifest-counts-ok"
|
||||
"shell": "jq -e '[.. | .command? // empty] as $cmds | ($cmds | length == 41) and ($cmds | map(capture(\"(?<script>[^/ ]+\\\\.sh)$\").script) | unique | length == 35) and (($cmds | map(select(test(\"ao-inject\\\\.sh\"))) | length) == 0)' hooks/hooks.json >/dev/null && echo hook-manifest-counts-ok"
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
|
||||
@@ -40,10 +40,10 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "1..27"},
|
||||
{"type": "stdout_contains", "value": "ok 5 pre-push-gate.sh passes when no Go changes"},
|
||||
{"type": "stdout_contains", "value": "ok 19 pre-push-gate.sh clears GIT env for skill CLI snippets"},
|
||||
{"type": "stdout_contains", "value": "ok 20 pre-push-gate.sh clears GIT env for CLI docs parity"}
|
||||
{"type": "stdout_contains", "value": "1..29"},
|
||||
{"type": "stdout_contains", "value": "ok 6 pre-push-gate.sh passes when no Go changes"},
|
||||
{"type": "stdout_contains", "value": "ok 21 pre-push-gate.sh clears GIT env for skill CLI snippets"},
|
||||
{"type": "stdout_contains", "value": "ok 22 pre-push-gate.sh clears GIT env for CLI docs parity"}
|
||||
],
|
||||
"dimensions": ["correctness", "runtime_compatibility", "safety"],
|
||||
"critical": true
|
||||
|
||||
@@ -74,8 +74,8 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "1..28"},
|
||||
{"type": "stdout_contains", "value": "ok 28 validate-release-audit-artifacts skips older missing local artifact dirs"}
|
||||
{"type": "stdout_contains", "value": "1..33"},
|
||||
{"type": "stdout_contains", "value": "ok 33 validate-release-audit-artifacts skips older missing local artifact dirs"}
|
||||
],
|
||||
"dimensions": ["correctness", "process_adherence", "artifact_quality"],
|
||||
"critical": true
|
||||
|
||||
@@ -78,9 +78,9 @@
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--cite string Citation type to record for returned artifacts: retrieved, reference, applied (default \"retrieved\")"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--no-cite Skip citation recording"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "### `ao inject`"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--no-cite Disable citation recording"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--apply-decay Apply confidence decay before ranking"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--session string Session ID for citation tracking (auto-generated if empty)"}
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--no-cite Disable citation recording"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--apply-decay Apply confidence decay before ranking"},
|
||||
{"type": "artifact_contains", "target": "../../cli/docs/COMMANDS.md", "value": "--session string Session ID for citation tracking (auto-generated if empty)"}
|
||||
],
|
||||
"dimensions": ["artifact_quality", "runtime_compatibility", "process_adherence"]
|
||||
},
|
||||
|
||||
@@ -40,7 +40,7 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "69 skills checked"},
|
||||
{"type": "stdout_contains", "value": "Total Skills: 76"},
|
||||
{"type": "stdout_contains", "value": "OVERALL: PASS"}
|
||||
],
|
||||
"dimensions": ["correctness", "artifact_quality", "process_adherence"],
|
||||
@@ -76,7 +76,7 @@
|
||||
},
|
||||
"expectations": [
|
||||
{"type": "exit_code", "value": 0},
|
||||
{"type": "stdout_contains", "value": "All 69 skill(s) passed schema validation"}
|
||||
{"type": "stdout_contains", "value": "All 70 skill(s) passed schema validation"}
|
||||
],
|
||||
"dimensions": ["correctness", "artifact_quality"],
|
||||
"critical": true
|
||||
|
||||
@@ -430,14 +430,11 @@ run_go_build_only() {
|
||||
|
||||
run_release_binary_validation() {
|
||||
local version
|
||||
version="$(git describe --tags --always --dirty 2>/dev/null || true)"
|
||||
if [[ -z "$version" ]]; then
|
||||
version="v$(jq -r '.version' .claude-plugin/plugin.json)"
|
||||
fi
|
||||
version="$(release_version)"
|
||||
|
||||
(
|
||||
cd cli
|
||||
make build
|
||||
make build VERSION="$version"
|
||||
)
|
||||
|
||||
./scripts/validate-release.sh "$REPO_ROOT/cli/bin/ao" "$version"
|
||||
|
||||
@@ -104,7 +104,7 @@ echo "--- End status output ---"
|
||||
echo "✓ status runs (exit code ignored)"
|
||||
|
||||
# Check commit count since last tag (warning, not failure)
|
||||
LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
|
||||
LAST_TAG=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' --sort=-v:refname | head -n 1 || true)
|
||||
if [[ -n "$LAST_TAG" ]]; then
|
||||
COMMIT_COUNT=$(git log "${LAST_TAG}..HEAD" --oneline 2>/dev/null | wc -l | tr -d ' ')
|
||||
if [[ "$COMMIT_COUNT" -gt 15 ]]; then
|
||||
|
||||
@@ -107,6 +107,10 @@ teardown() {
|
||||
# provenance depends on artifacts being written to a dated directory.
|
||||
run grep -q 'ARTIFACT_DIR=' "$SCRIPT"
|
||||
[ "$status" -eq 0 ]
|
||||
run grep -q 'version="$(release_version)"' "$SCRIPT"
|
||||
[ "$status" -eq 0 ]
|
||||
run grep -q 'make build VERSION="$version"' "$SCRIPT"
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
@test "script wires HIL and release readiness gates" {
|
||||
|
||||
Reference in New Issue
Block a user