Every required command exited 0; required scanners completed with no findings.
ADAMANT · portable · agent-ready · evidence-first
Build at the level
the repository requires.
A working control system for coding agents: ten task skills, one dependency-free verification CLI, hash-chained evidence, isolated worktrees and real security gates.
$ ./.agents/bin/eng verify --profile full
check ok 2.35s exit=0
gitleaks ok 0.06s (0)
semgrep ok 1.53s (0)
osv-scanner ok 0.50s (0)
actionlint ok 0.03s (0)
PASS — evidence written
.agents/evidence/20261029T202043Z-791696ef.json
sha256:5273768155a6a471…
$
01 — The loop
Understand. Plan. Prove.
Six phases, one rule: a skipped or blocked check is never a pass. The loop is deliberately small enough to run on every change.
02 — Operating principles
The rules behind the rules.
Seven cross-cutting commitments. They apply whether the task is a one-line fix, a kernel change or a release.
03 — Skills
Load the task, not the whole manual.
Ten entrypoints with activation conditions, permissions, workflow, verification and completion criteria. Open one to read the full source.
No skill matches that filter. Try “security”, “release” or clear the filters.
04 — Build paths
Start with the outcome.
Choose the work. Get the ordered steps, the skill to load, the commands to run and the evidence each step must leave.
05 — Toolbox
Composable tools, explicit limits.
What is adopted, what is conditional, and what is still a candidate. No tool is added because it is fashionable; each has a role and a failure mode.
No tool matches. Try “security”, “tests” or “connectors”.
06 — Evidence
A record, not a vibe.
Every verification writes one hash-chained record: exact commands, exit codes, durations, output hashes, Git state, config hash and scanner versions.
eng-evidence/v1
{
"commands": [
{ "name": "check", "status": "pass", "exit_code": 0 }
],
"security": [
{ "tool": "gitleaks", "status": "pass", "findings": 0 },
{ "tool": "semgrep", "status": "pass", "findings": 0 }
],
"git": { "head": "791696e", "dirty": false },
"verdict": {
"status": "pass",
"required_failures": [],
"unverified": []
},
"sha256": "5273768155a6a471…"
}
A required command, timeout or security finding. The failing log stays with the record.
A required scanner or config is missing. Blocked is not a pass and never becomes one.
Reported as unverified. Optional scanner absence is visible, not silent.
The tool ran but did not produce a report. Treated as unknown, not green.
07 — Repositories
Different trees, one contract.
Current rollout status. A blocked or review state is information, not a failure to hide.
08 — For agents
Give the next agent the shortest correct path.
The portal is also a machine-readable handoff. Point an agent at agents.json or llms.txt; download the same kit a human installs.
agents.json
Schema, start commands, skills, paths, tools, guardrails, repository states and limits.
llms.txt
A compact brief with the commands, all ten skills, the adopted tools, the rules and the limits.
site.json
The full portal payload: phases, principles, skill bodies, tools, paths and repo status.
eng-kit.zip
The installable kit: CLI, skills, references, configs, hooks, CI template and manifest.
Read AGENTS.md first.
Then read .agents/README.md and .agents/references/change-lifecycle.md.
Run ./.agents/bin/eng detect and ./.agents/bin/eng verify --profile fast.
Before editing shared code:
./.agents/bin/eng impact --base origin/main
Never report a skipped or blocked check as passing.