简介

Agentic OS

<p align="center"> <strong>"Done." — your AI coding agent, about code it didn't test.</strong><br/> A rules file <em>asks</em> your agent to behave. Agentic OS <strong>checks that it did</strong> — once you switch on the git hook and a CI job (the installer prints both), a leaked secret fails the commit and a work trail missing a phase or its evidence fails the validator. Backstops you control. The validator checks the record the agent keeps, so it catches a phase missing from that record, not a faked record or a task that never opened one. </p>

<p align="center"> <strong>A governance-first layer for AI coding agents</strong> — guardrails and a gated workflow for Claude Code, Codex, Cursor, Copilot, Antigravity, or any Markdown-reading agent. </p>

<p align="center"> <a href="https://github.com/KbWen/agentic-os/releases"><img src="https://img.shields.io/github/v/release/KbWen/agentic-os?style=flat-square&label=release" alt="Release"/></a> <a href="https://github.com/KbWen/agentic-os/actions/workflows/validate.yml"><img src="https://img.shields.io/github/actions/workflow/status/KbWen/agentic-os/validate.yml?branch=main&style=flat-square&label=CI" alt="CI"/></a> <a href="https://github.com/KbWen/agentic-os/actions/workflows/security.yml"><img src="https://img.shields.io/github/actions/workflow/status/KbWen/agentic-os/security.yml?branch=main&style=flat-square&label=Security" alt="Security"/></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-22c55e?style=flat-square" alt="MIT"/></a> &nbsp;·&nbsp; <a href="docs/README_zh-TW.md">繁體中文</a> · <a href="CONTRIBUTING.md">Contributing</a> · <a href="CHANGELOG.md">Changelog</a> </p>

<p align="center"> <img src="docs/assets/concept-hero.png" alt="An AI coding agent confidently claims 'Done. Tests pass. Shipping it.' and Agentic OS stamps the claim '[citation needed]'. Agentic OS checks what your AI agent claims — a leaked secret, a missing test, a phase missing from the work trail — through git hooks, CI and a local validator." width="820"/> </p>

<p align="center">_{It checks the evidence behind what your AI coding agent claims — secrets and tests in your git hooks and CI, phase records in a local validator. Here's a gate firing:}</p>

<p align="center"> <img src="docs/assets/workflow-demo.gif" alt="An AI coding agent in a terminal claims a task is done and tries to ship it; the Agentic OS gate returns verdict FAIL because the work trail has no review or test evidence, blocks the ship, and only passes after review, tests, and evidence are recorded." width="780"/> </p>

The /bootstrap, /review, and /ship above are plain text prompts — your agent maps them to the workflow files in the repo, so they run the same in Cursor or Codex as in Claude Code.

Or run a gate yourself, no install — the credential scan that catches a leaked key before it reaches git history:

bash demo/run.sh          # Windows (PowerShell): pwsh demo/run.ps1

<p align="center"> <img src="docs/assets/demo-gate.gif" alt="Terminal recording of the real credential gate: an AI agent writes config.env containing a leaked aws_access_key_id and reports 'Done - config added.'; Agentic OS runs scan_credentials.py, which detects the credential with the value redacted, and the commit is BLOCKED — the agent said done, the machine said no. Reproduce with bash demo/run.sh." width="820"/> </p>

<details> <summary>Full terminal output</summary>

  An AI agent wrote this file and reported: "Done — config added."
  ----------------------------------------------------------------
    DB_HOST=prod.internal
    aws_access_key_id = AKIA****************
  ----------------------------------------------------------------

  Without a gate, that commit lands and the key is in git history forever.
  Agentic OS runs this before the commit is allowed:

    $ scan_credentials.py config.env

CREDENTIAL PATTERN(S) DETECTED (values redacted):
  config.env:2: aws-access-key-id
Rotate the exposed secret, remove it from the change, then retry.

  Commit BLOCKED. The agent said "done"; the machine said no — and it
  redacted the value instead of echoing your secret back at you.

</details>

Your agent can still cut a corner. What it can't do is get a leaked secret past the hook, or a failing test past CI, once they're on — those run whether it cooperates or not. Reviews are checked from the work trail the agent writes: a missing review record fails the local check, a faked one does not. The key above is generated at runtime and redacted on output, so the demo never stores a real secret.