Ran and succeeded
Every required command exited 0; required scanners completed with no findings.
wckd / engineering for agents
Build at the level
the repository requires.
Evidence over assertion. Small, reversible changes. Contracts kept. The values, skills and tools to make an agent a better engineer — with a record of what actually ran.
$ ./.agents/bin/eng verify --profile full
check ok 2.35s exit=0
gitleaks ok 0.06s (0)
semgrep ok 1.53s (0)
osv-scanner ok 0.50s (0)
actionlint ok 0.03s (0)
PASS — evidence written
.agents/evidence/20261029T202043Z-791696ef.json
sha256:5273768155a6a471…
$
The gate is only green when the command actually ran.
01 — The loop
Understand. Plan. Prove.
Six phases, one rule: a skipped or blocked check is never a pass. The loop is deliberately small enough to run on every change.
02 — Operating principles
The rules behind the rules.
Seven cross-cutting commitments. They apply whether the task is a one-line fix, a kernel change or a release.
03 — Skills
Load the task, not the whole manual.
Ten entrypoints with activation conditions, permissions, workflow, verification and completion criteria. Open one to read the full source.
No skill matches that filter. Try “security”, “release” or clear the filters.
04 — Build paths
Start with the outcome.
Choose the work. Get the ordered steps, the skill to load, the commands to run and the evidence each step must leave.
05 — Toolbox
Composable tools, explicit limits.
What is adopted, what is conditional, and what is still a candidate. No tool is added because it is fashionable; each has a role and a failure mode.
No tool matches. Try “security”, “tests” or “connectors”.
06 — Evidence
A record, not a vibe.
Every verification writes one hash-chained record: exact commands, exit codes, durations, output hashes, Git state, config hash and scanner versions.
verdict: passfull · 5.44s
eng-evidence/v1
{
"commands": [
{ "name": "check", "status": "pass", "exit_code": 0 }
],
"security": [
{ "tool": "gitleaks", "status": "pass", "findings": 0 },
{ "tool": "semgrep", "status": "pass", "findings": 0 }
],
"git": { "head": "791696e", "dirty": false },
"verdict": {
"status": "pass",
"required_failures": [],
"unverified": []
},
"sha256": "5273768155a6a471…"
}
./.agents/bin/eng evidence verify
chain intact
Ran and failed
A required command, timeout or security finding. The failing log stays with the record.
Gate unknown
A required scanner or config is missing. Blocked is not a pass and never becomes one.
Not applicable or absent
Reported as unverified. Optional scanner absence is visible, not silent.
Untrustworthy result
The tool ran but did not produce a report. Treated as unknown, not green.
07 — Repositories
Different trees, one contract.
Current rollout status. A blocked or review state is information, not a failure to hide.
08 — For agents
Give the next agent the shortest correct path.
Start with creed.md: the values, lifecycle, trust boundaries and raw skill links in one readable handoff. Repository policy still comes first.
creed.md
The engineering creed. Give this URL to an agent before it starts work.
agents.json
Schema, start commands, skills, paths, tools, guardrails, repository states and limits.
llms.txt
A compact brief with the commands, all ten skills, the adopted tools, the rules and the limits.
site.json
The full portal payload: phases, principles, skill bodies, tools, paths and repo status.
eng-kit.zip
The installable kit: CLI, skills, references, configs, hooks, CI template and manifest.
Agent handoff
Read AGENTS.md first.
Then read .agents/README.md and .agents/references/change-lifecycle.md.
Run ./.agents/bin/eng detect and ./.agents/bin/eng verify --profile fast.
Before editing shared code:
./.agents/bin/eng impact --base origin/main
Never report a skipped or blocked check as passing.