the-gibson

agent
Guvenlik Denetimi
Basarisiz
Health Gecti
  • License — License: Apache-2.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 40 GitHub stars
Code Basarisiz
  • fs module — File system access in .github/workflows/sensor-health.yml
  • rm -rf — Recursive force deletion command in adapters/goose/session.sh
Permissions Gecti
  • Permissions — No dangerous permissions requested

Bu listing icin henuz AI raporu yok.

SUMMARY

A portable, self-improving SDLC harness for agent fleets — plan → issues → build → test → review → UX-eval → security → ship, on any runtime (Claude Code, Codex, Grok, Hermes). Apache-2.0.

README.md

The Gibson: a G made of two rings around an amber core, with the tagline The governance harness for your coding agents

The Gibson

The governance harness for your coding agents.

A portable, self-improving SDLC harness for agent fleets: describe what you want in
plain language, and the fleet plans, builds, tests, reviews, and ships it under gates
you can audit.

Start here, based on who you are:

Everything in this repo follows one interaction rule, the Ask Contract:
whenever the system asks a human for anything, it says what it's asking, what
it does, why, and the risks
— in plain language, with every technical term
explained. If any doc here fails that standard, that's a bug: open an issue.

Point it at any repo. Give it a well-scoped plan. The fleet decomposes the plan into
issues, builds, tests, reviews, security-scans, UI/UX-grades against live deployments,
and ships to Vercel — and does not stop unless a human gate requires it. Every failure
that happens twice becomes a permanent improvement to the harness itself.

"Agent = Model + Harness." The model is rented. The harness is yours, and it
compounds. — after Fowler, Harness Engineering

Named for the supercomputer in Hackers (1995) — which shares its name with
William Gibson, who said "The future is already here — it's just not evenly
distributed."
The Gibson is a piece of that unevenly-distributed future. It's
Apache-2.0 so it doesn't have to stay that way. You don't hack The Gibson.
The Gibson hacks the backlog.

What it is

The Gibson is a doctrine + tooling repo that gets installed into target projects.
It is deliberately agent-agnostic: the canonical harness is plain Markdown, shell
scripts, and GitHub Actions — things every runtime (Claude Code, OpenAI Codex, Grok,
Hermes, pi) can read and every CI can enforce. Vendor-specific ergonomics (Claude
skills, Codex configs, Grok loop drivers) are thin adapters over the same core.

Three layers:

Layer What Where
Doctrine Binding contract in AGENTS.md; role/job playbooks are conditional dispatch prompts; docs/ is on-demand explanation AGENTS.md (authority), playbooks/ (conditional), docs/ (non-normative)
Enforcement Deterministic gates that don't care who wrote the code ci/, scripts/, target-repo CI
Memory Versioned lessons, decisions, incidents — the self-improvement substrate memory/

The Gibson is the harness. Mission Control
remains the runtime control plane (task queue, telemetry, cross-vendor dispatch).
They compose: Mission Control decides who works; The Gibson decides how they work.

The pipeline at a glance

PLAN ─▶ DECOMPOSE ─▶ BUILD ─▶ TEST ─▶ REVIEW ─▶ UI/UX EVAL ─▶ SECURITY ─▶ MERGE ─▶ DEPLOY ─▶ RETRO
 │         │           │        │        │          │            │          │         │        │
 spec +    GitHub      worktree green    multi-lens Playwright   SAST/DAST/ human     Vercel   lessons →
 design    issues w/   + scope  gate     tiered,    vs. preview  authz/     gate on   promote  harness
 language  contracts   claims            x-vendor   deployment   secrets    Tier C    + verify PRs
flowchart LR
  subgraph doctrine["Doctrine"]
    AG["AGENTS.md"]
    DOCS["docs/01–19"]
    PB["playbooks/"]
  end
  subgraph pipeline["SDLC pipeline"]
    P[Plan] --> D[Decompose]
    D --> B[Build]
    B --> T[Test]
    T --> R[Review]
    R --> U[UX eval]
    U --> S[Security]
    S --> M[Merge]
    M --> V[Deploy + verify]
    V --> H[Retro / historian]
    H -.->|ratchet| AG
  end
  subgraph enforce["Enforcement"]
    SCR["scripts/"]
    CI["ci/"]
  end
  subgraph memory["Memory"]
    LES["LESSONS.md"]
    DEC["DECISIONS.md"]
  end
  subgraph external["Control plane"]
    MC["Mission Control\nqueue + telemetry"]
  end
  AG --> P
  PB --> B
  PB --> R
  PB --> U
  SCR --> B
  CI --> R
  H --> LES
  MC -.->|dispatch| B
  MC -.->|dispatch| R
Piece Job
Roles planner · decomposer · builder · test-engineer · reviewer · ux-evaluator · security · release · historian — contracts in AGENTS.md; explanation in docs/03
Stores Gibson memory/ (durable) + MC memory table (runtime) — docs/09
MC Who works; Gibson = how they work

Full detail: docs/02-sdlc-pipeline.md

Core principles (the short version)

  1. Guides + Sensors. Feedforward controls steer agents before they act (docs,
    conventions, scaffolds); feedback controls catch and correct after (linters, tests,
    review agents). Both are harness artifacts, both are improvable.
  2. Never grade your own homework. Generation and evaluation are separate agents,
    ideally separate vendors. Evaluators are tuned to skepticism and verify against
    running software, not diffs.
  3. Primitives, not features. A minimal core any runtime can execute; everything
    else is an extension. (After pi.dev.)
  4. The ratchet. A failure that happens twice is a harness bug, not a model bug.
    It must become a new guide or sensor — often authored by the agent that hit it.
  5. Agent-agnostic core, vendor-thin edges. If a rule only works in one vendor's
    runtime, it isn't doctrine yet.
  6. Autonomy by default, human gates by exception. Agents do not stop to ask
    permission for reversible work inside a claimed scope. The closed stop list
    is in AGENTS.md; docs/14-human-gates.md
    is on-demand rationale only.

Documentation map

Doc Contents
QUICKSTART.md Fastest path: clone → first adopted repo (Ask Contract steps)
FAQ.md Common questions from the first month of operation
docs/00-INDEX.md Reading order by audience
docs/00-glossary.md One-line definitions of Gibson terms
AGENTS.md Agents start here. The operational contract every agent loads first
docs/01-principles.md Design principles and the research they came from
docs/02-sdlc-pipeline.md The full pipeline, stage by stage, with gates
docs/03-roles.md Explanation of the nine roles (binding contracts live in AGENTS.md)
docs/04-plan-to-issues.md Decomposing a plan into well-scoped issues with sprint contracts
docs/05-concurrency.md Worktrees, scope claims, hot files, lane limits
docs/06-quality-gates.md The green gate, review tiers, and lens system
docs/07-uiux-evaluation.md Playwright-vs-deployment UI/UX grading
docs/08-security.md The eight-layer security testing system
docs/09-memory-and-self-improvement.md Memory substrate and the self-correcting loop
docs/10-vendor-adapters.md Running the harness on Claude Code / Codex / Grok / Hermes
docs/11-solo-loop.md Single-platform continuous mode (one agent, e.g. Grok, runs the whole loop)
docs/12-vercel.md Deployment doctrine: previews, promotion, schema safety
docs/13-adoption.md Installing The Gibson into a target repo
docs/14-human-gates.md Rationale and history for the G1–G16 stops listed in AGENTS.md
docs/15-model-economics.md Which model for which task: G/S/F grades, flat-rate-first, escalation ladder
docs/16-nontechnical-operation.md Operator tier: chat-only interface, decision cards, the never-stuck ladder
docs/17-deployment-optimization.md Inspecting & optimizing the deployment target: rendering, caching, cost, field vitals
docs/18-fork-and-upstream.md Fork it, customize in local/, keep receiving upstream updates; contribute back
docs/19-product-and-mcp.md Chatterbuilt Foreman: the productized tier + the guided-setup MCP design
docs/22-devin-cloud-supervisor.md Local runners build; a Devin cloud session reviews, opens the PR, and merges
GUIDE.md Mark's operator manual — start work, approve gates, run the loop, tune the harness
VIBECODING.md The for-dummies guide — vibecoding for non-technical owners, zero jargon
HOW-IT-WORKS.md What it is & how it works — readable by anyone, actionable for everyone
SECURITY-AUDIT.md Living security audit: threat model, eight-layer status, residual risks, checklists
docs/DOC-BACKLOG.md Documentation build-out queue
docs/examples/ Worked PLAN→issues, UX eval, authz matrix samples
docs/troubleshooting/ Loop, claims, preview URL, ZAP, visual flake
playbooks/ Role/job dispatch prompts
scripts/ claim, gate, loop, posture, upstream-sync, …
ci/ Reusable workflow templates
adapters/ Claude Code / Codex / Grok / Hermes runners + Devin cloud supervisor setup
ROADMAP.md Build-out phases from doctrine to full automation

Provenance

Synthesized from five sources, credited throughout:

  • ConferenceOS (mrhinkle/conference-os) — the battle-tested mechanics: worktree
    isolation, scope claims, green gate, tiered review, schema safety, Vercel guard.
  • Mission Control (mrhinkle/mission-control) — cross-vendor dispatch, task
    queue, shared runtime memory, "route by task class, not loyalty."
  • Fowler — Harness Engineering —
    guides/sensors, computational vs. inferential controls, the self-correcting loop.
  • Anthropic — Harness design for long-running agents —
    planner/generator/evaluator separation, sprint contracts, Playwright evaluation,
    context resets via file handoffs, frontend design language at plan time.
  • pi.dev and ruvnet — primitives-not-features,
    self-modifying extensions, multi-host adapters, versioned memory substrates.

License

Apache License 2.0 — Copyright 2026 Mark Hinkle. Fork it, customize it, run it
(see docs/18-fork-and-upstream.md); contributions
back are welcome through the same pipeline the harness uses on itself.

Yorumlar (0)

Sonuc bulunamadi