简介

Agentic OS

<p align="center"> <strong>"Done." — your AI coding agent, about code it didn't test.</strong><br/> A rules file <em>asks</em> your agent to behave. Agentic OS <strong>checks that it did</strong> — leaked secrets and a green check over zero tests fail your git hooks and CI; a skipped review or phase shows up when the validator reads the work trail. Backstops you control, not the agent's own word. </p>

<p align="center"> <strong>A governance-first layer for AI coding agents</strong> — guardrails and a gated workflow for Claude Code, Codex, Cursor, Copilot, Antigravity, or any Markdown-reading agent. </p>

<p align="center"> <a href="https://github.com/KbWen/agentic-os/releases"><img src="https://img.shields.io/github/v/release/KbWen/agentic-os?style=flat-square&label=release" alt="Release"/></a> <a href="https://github.com/KbWen/agentic-os/actions/workflows/validate.yml"><img src="https://img.shields.io/github/actions/workflow/status/KbWen/agentic-os/validate.yml?branch=main&style=flat-square&label=CI" alt="CI"/></a> <a href="https://github.com/KbWen/agentic-os/actions/workflows/security.yml"><img src="https://img.shields.io/github/actions/workflow/status/KbWen/agentic-os/security.yml?branch=main&style=flat-square&label=Security" alt="Security"/></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-22c55e?style=flat-square" alt="MIT"/></a> &nbsp;·&nbsp; <a href="docs/README_zh-TW.md">繁體中文</a> · <a href="CONTRIBUTING.md">Contributing</a> · <a href="CHANGELOG.md">Changelog</a> </p>

<p align="center"> <img src="docs/assets/concept-hero.png" alt="An AI coding agent confidently claims 'Done. Tests pass. Shipping it.' and Agentic OS stamps the claim '[citation needed]'. Agentic OS demands evidence for what your AI agent claims — leaked secrets, missing tests, skipped reviews — through git hooks and CI instead of taking the agent's word." width="820"/> </p>

<p align="center">_{It checks the evidence behind what your AI coding agent claims — secrets, tests, reviews — through your git hooks and CI. Here's a gate firing:}</p>

<p align="center"> <img src="docs/assets/workflow-demo.gif" alt="An AI coding agent in a terminal claims a task is done and tries to ship it; the Agentic OS gate returns verdict FAIL because the work trail has no review or test evidence, blocks the ship, and only passes after review, tests, and evidence are recorded." width="780"/> </p>

The /bootstrap, /review, and /ship above are plain text prompts — your agent maps them to the workflow files in the repo, so they run the same in Cursor or Codex as in Claude Code.

Or run a gate yourself, no install — the credential scan that catches a leaked key before it reaches git history:

bash demo/run.sh          # Windows (PowerShell): pwsh demo/run.ps1

<p align="center"> <img src="docs/assets/demo-gate.gif" alt="Terminal recording of the real credential gate: an AI agent writes config.env containing a leaked aws_access_key_id and reports 'Done - config added.'; Agentic OS runs scan_credentials.py, which detects the credential with the value redacted, and the commit is BLOCKED — the agent said done, the machine said no. Reproduce with bash demo/run.sh." width="820"/> </p>

<details> <summary>Full terminal output</summary>

  An AI agent wrote this file and reported: "Done — config added."
  ----------------------------------------------------------------
    DB_HOST=prod.internal
    aws_access_key_id = AKIA****************
  ----------------------------------------------------------------

  Without a gate, that commit lands and the key is in git history forever.
  Agentic OS runs this before the commit is allowed:

    $ scan_credentials.py config.env

CREDENTIAL PATTERN(S) DETECTED (values redacted):
  config.env:2: aws-access-key-id
Rotate the exposed secret, remove it from the change, then retry.

  Commit BLOCKED. The agent said "done"; the machine said no — and it
  redacted the value instead of echoing your secret back at you.

</details>

Your agent can still cut a corner. What it can't do is get a leaked secret, a green check over zero tests, or a skipped review past the hooks and CI — those run whether it cooperates or not. The key above is generated at runtime and redacted on output, so the demo never stores a real secret.