Picture a workshop where every worker arrives each morning with notes from yesterday and none of yesterday's habits. The notes are good. They say what was done and what went wrong. They do not say how things are done here, so every worker reads them and then invents the day's method from scratch, and by evening the shop has run one more way of doing everything and kept none of them. Memory is plentiful in that shop. Practice never accumulates. Telling the workers how things are done does not fix it either; an instruction is read in the morning and reinvented by noon.
What fixes might look like: a job list that will not hand out work nobody has claimed, a sign-in sheet that shows who is really in the building, a journal read aloud at the start of every shift, a foreman whose only duty is the reading and the filing, a register of every tool available and how it must be used and a receipt kept for every act, so that the right way is what the shop does, whichever worker is doing it. The old word for a way of acting that holds regardless of who is acting is dharma, and that is what the shop needs.
That workshop is a fleet of AI coding agents. A session is a worker; it arrives with memory files and instruction files, and it still starts the job over. The workers have a second problem, and it shows up the moment one of them reaches past the repository. Inside the repository a worker is capable: it reads files, edits them, runs the tests, reasons about a diff (and possibly a lif; we're solving that, too!). Step outside and the same mind has no standard set of provenance for accessing a web page, no contracted eyes for the current shape of a database, no way to tell whether another worker is in the same working directory, and nowhere to keep the key to the city. Each time it needs one of those requests met, it channels an improv: a curl line with a pasted token, a throwaway browser script, a number guessed into a config file, a secret copied into a shell profile. The improvised channel works once and is gone by the next shift, unchecked.
agent-do is the workshop's answer to both problems: a standard, known shape, that every worker picks up at session clock-in, and a dharma the shop holds so that no worker skips orientation. It is the contracted vessel for channeling the outside world; like an Iron Man suit. A human installs this once. After that only agents use it, and they use it from the shell, because the shell is the one interface every coding agent already has:
agent-do <tool> <command> [args...]
Behind that shape sit 102 tools exposing 930 commands. What follows is the company as a worker meets it: the tools on the bench, the sign-in sheet, the job list on the wall, the journal, the foreman, and the owner's window; then why it holds together, and where it is going. The tools appear only as evidence that each faculty and each institution is real.
Every worker picks up the same vessel, and every part of it follows one rhythm: Connect, Snapshot, Interact, Verify, Save. That rhythm is the first article of the shop's dharma, and it is machine-readable. Each of the 919 commands is filed under one of those five beats in registry.yaml (6,525 lines), so the worker knows before it moves whether a command looks or acts.
A camera gives a mind pixels. A mind made of text needs the page as text with handles. browse snapshot -i returns a web page as a numbered list of its interactive elements, each with a reference such as @e7 that the next command can click or fill. db snapshot returns a schema. macos returns the desktop as a tree of controls. Snapshot is the hinge, because an agent cannot reason about a state it has not seen as data, and to a mind that reads, a screenshot is a picture of data rather than data.
A hand that does not know its own strength breaks things. So every command carries a declared reach. The registry classifies 527 verbs as read-only, 529 as writes, 59 as destructive, 24 as emitting secret material, and 11 as arbitrary-code escape hatches. A program running several workers at once reads that surface a single time and knows which commands can run side by side and which must wait their turn.
A declaration is only worth what checks it, and these are checked in three ways: no tool enters the registry without a complete declaration, every promised verb is compared against the tool's own help text, and the read-only verbs are actually run and graded on whether they behaved like reads. The checks live in the test suite and in the automated checks that run on every push. A tool that promises a verb it lacks fails the build.
Verify is the beat where the vessel checks its own act against the world. browse wait --stable blocks until the network is quiet and the page has stopped moving. namecheap reads a DNS record back from the provider after writing it and compares the bytes. manna lint grades the work board's grammar and exits nonzero on findings.
The vessel also has a crude sense of visual craft, and it is worth saying exactly how crude. dpt scores a live web page from 0 to 100 against 65 rules across five layers of perception. In August the project tested it with controlled pages and wrote the result down in .handoff/dpt-audit-2026-08-22.md: a deliberately broken page scored 29, correctly, with four named faults; the owner's ratified design scored 67, and a banned neon template scored 66. One point apart. So dpt is proprioception, a sense of whether the act landed roughly where it should have. It stays on the bench as a floor check for unreadable text and invisible buttons, and workers are told never to chase its score. A faculty whose limits are written down beside it is worth more than one that is simply trusted.
27 tools declare the secrets they need. Those are stored once in the operating system's secure store, and the dispatcher resolves each one at the moment of the call and passes it to the tool as an environment variable, so a token never appears in a command line, a log, a document, or a commit. A worker never carries a key in a command or a note.
The worker's reach stops at the edge of the human's desktop. Commands that drive the visible desktop or a real browser window, and message delivery in the human's own name, refuse to run unless the command is prefixed with an explicit +live(...) modifier naming a scope, an application, and a time limit. Absent the modifier, the tool declines. The human's machine stays the human's.
A worker holding good tools still cannot feel the others in the room, and several agents routinely work one repository at once. So the workshop keeps a sign-in sheet under the repository's git directory, and it verifies the sheet against the operating system: a session counts as present only if its process still exists and that process's start time matches the one recorded, which is why a recycled process id can never wear a dead worker's identity. A session unseen for 48 hours turns idle; a dead one is marked dead and swept after 24 hours. Workers declare a role (builder, auditor, researcher, overseer), a goal, and the paths they own; two builders whose paths overlap are both interrupted, with the overlapping paths named, and an auditor stepping onto a builder's paths sends a courtesy notice. Handoffs between live workers are pointers to files on the sheet; no mailbox exists. The sheet also carries a pulse fed by the host program's own events: whether a worker is working, waiting on the human, failed, or finished, and what it last touched.
With the room known, the worker takes a job. manna keeps the job list inside the repository, in .manna/, so it travels with the code and carries git history. Every entry is one of three kinds: a track, which names a program of work; an item, which is a job a worker may claim; or a dream, which is an idea nobody may build until the owner converts it. This repository's own board holds 128 entries: 83 done, 39 open, 5 blocked, 1 in progress. Of those, 3 are tracks and 8 are dreams.
Claiming is the move that matters, because two workers each starting from their own notes will cheerfully start the same job. A claim here is proven rather than labeled. When a worker claims an item, the board stores a fingerprint of a secret derived from that session's identity under a key that lives on the machine, outside the repository, readable only by the owner's account. A restarted process derives the same secret and keeps its authority over its claims. A worker who merely writes another worker's name on the entry gains nothing, because the name was never the credential. Status moves only through lifecycle verbs (claim, done, abandon, block, unblock); nobody can set a status by hand, and the tool refuses the attempt.
A stranger picking up a job needs the whole job on one page, so every claimable item is paired with exactly one work order under .handoff/ (82 files): the exact claim command, the paths this worker owns, the neighboring paths it must leave alone, the project's memory pasted in verbatim (a fresh worker told to go and fetch context usually does not), and numbered verification steps. The order is sealed. A hash of its content is stored on the board entry; editing it requires an explicit reseal; a claim against an order whose seal is broken fails with nothing written. Priority is a numbered filename derived from one ordered list, so a bare number means "safe to start" and a b suffix means "held until that numbered blocker closes."
While the worker works, the shop learns. zpc is the journal, kept per project in .zpc/. Here it holds 112 lessons and 32 decisions, plus 12 positions, where a position is a verdict filed together with the evidence that would change it. It is written by workers as they work and read aloud at every clock-in, fitted to a budget that is looked up from the model's published limits rather than typed. Two rules keep it honest. Entries arrive as dated claims that a live observation outranks, and an entry that turns out wrong is retracted by appending a correction with a receipt (nothing is ever edited or deleted, because the record of having been wrong is worth keeping). And a worker who wants to reverse a filed position without naming new evidence is refused: the tool quotes the worker's own falsifier back and writes nothing. Every read leaves a line in an access log; this repository's holds 861 lines.
context is the library next door: reference documentation fetched from the web and indexed for search. It is kept separate from the journal on purpose, because what a manual says and what the shop learned using it are different kinds of knowledge and rot at different rates. Saved browser sessions and open database connections are the short-term kind of memory, so a worker does not log in again at every step.
None of the above asks a worker to remember that any of it exists, because the dharma is held by the shop and the foreman does the reading and the filing. Hooks are small scripts the agent's host program runs at fixed moments; the installer registers 12 of them. At clock-in, inside a 10-second budget, the foreman pins the worker's identity, reads the job list aloud, reads the journal, reads the previous shift's drift report, and names any interrupts other workers have raised. During the shift the foreman nudges a worker who reaches for a raw command when a tool on the bench exists or types a number where a published limit should have been looked up, and, once per session, notes at turn's end when code changed and nothing was journaled. At clock-out, the foreman retires the worker's presence and runs the reconcile with only its two judgment-free repairs (release claims held by dead workers, clear blocked flags whose blockers are done), then writes .manna/drift.yaml for the next shift's greeting. None of these blocks anything; they add context and get out of the way. Every one of these steps is gated on presence: a repository with no board sees none of it.
What a shift leaves behind is what the next shift trusts. A commit that advances a job carries a trailer line, Manna: mn-xxxxxx, at the end of its message; 159 of this repository's 537 commits do. That single convention lets the job list be audited against git instead of against itself. reconcile runs 10 checks: jobs whose commits landed while the entry still says open, claims held by workers the operating system reports dead, blocked flags whose blockers have finished, dreams older than 14 days, work orders that point at nothing, and shadow work orders filed outside the canonical root. It reports everything and repairs only what needs no judgment.
One human owns the workshop. The owner converts dreams into items (a worker who tries to claim a dream is refused with exit code 2, the code this system uses for "stopped on purpose, needs a human," and nothing is written) and rules on the questions the machine flags, looking in through manna serve: a page on a loopback port only this machine can reach, picked free on first run and kept thereafter so the address stays stable, that workers are handed and never read from. Its inbox lists every ask in one shape, who is asking and what for, with the verb the owner performs as a button that runs exactly that one board command. The page and native clients read that same shape from manna state --json, the core's complete derived board model, rather than rebuilding board meaning in each interface.
Open the shop.
git clone https://github.com/ovachiever/agent-do.git
cd agent-do
./install.shIt needs GNU Bash 4.4 or newer (macOS ships 3.2; brew install bash first), Python 3.10 or newer, Node 18 or newer for the browser tool, and Rust if you want the work board built locally. The installer symlinks the command, installs the foreman's scripts, asks before registering them (registration is what makes them fire; an unregistered hook is inert), and runs a health check. From then on the human types nothing. Workers pick up the tools and run the shop. The one thing a human may be handed back is a link to the job list, where the shift can be watched.
Every part of the shop trades in one unit, the receipt, and that is why the parts are one system rather than a collection. The vessel produces receipts: a snapshot before every act and a check after it, so a worker's claim to have done something arrives with the thing that shows it. The sign-in sheet is a receipt of presence, verified against the operating system rather than asserted. A claim on the job list is a receipt of ownership, a proof rather than a name. A commit trailer is a receipt in git, where the shop's own history can be audited against the list on the wall. A journal entry is a receipt of learning that carries the evidence that would overturn it. The foreman's only job is moving receipts across the boundary between shifts, reading them in at clock-in and writing them out at clock-out. And the owner rules on receipts through the window, never on testimony. Take any one institution away and the others still run; take the receipt away and none of them do. That is the whole dharma in one rule, and it is the property that lets a worker vanish mid-shift without loss and lets a stranger continue the work as if it were their own.
The shop is also its own first customer. This repository was built inside the institutions it describes: 537 commits, 159 with a board trailer, 334 with a co-author line naming a model or an editor, twelve co-author identities in the log, and one person behind 496 of the 537. The job list you read about is the list that scheduled the work; the journal is the one the work was learned in; the contracts gate was turned on this catalog first, with a grandfather list ratcheted to empty and then deleted. Nothing here was enforced on anyone else before it was enforced here.
Nor was it built in a quiet room and taken to market afterward. It was cut in the middle of a body of work by one person and a fleet, and every one of those builds runs on it today:
- Aldebaran Group, an estate of
dm-*repositories built as a supply chain, instrument to vault to packaging to kitchen to menu, under one law: consumers consume contracted faces, and nothing touches an engine directly. The instrument measures astronomical truth with every quantity stamped and a refusal in place of every guess; a governance layer holds every judgment number as proposed until the owner ratifies it; a deep-science lane points many symbolic frames at one floor; the kernel serving production today has a byte-frozen predecessor as its witness and a greenfield successor on paper, behind a gate that bars the old code as an ingredient. 292 commits at the root and 195 in the instrument; 242 board entries; 179 work orders; 106 lessons. - Versova Supply, where a floor manager at an egg producer asks the ERP a question in plain English and gets an answer that arrives with its receipts. The agent has nothing to answer from except its tools: ten purpose-built, read-only ones (look up an item; pull its purchase history; search 100 indexed machine manuals; recommend an order against Min/Max; translate a GL code; total a vendor's spend; search every column of the transaction record; and, for packaging, demand forecast, inbound loads, and days on hand) plus one escape hatch, a single read-only SELECT over curated views whose executed SQL is attached to the answer so the operator sees exactly what ran. Every claim about a manual must cite the PDF chunk and page; every claim about buying must cite the tool that returned it; a source no tool returned this turn cannot be cited; text inside manuals and rows is evidence and never instruction. A parts answer cross-references by rule: what the manual says the part is, and whether the company actually buys it, from whom, at which site, requested by whom. Part numbers and vendor names are fuzzy-merged and the merge is shown, and a part named in chat opens as a card. So "which grease do we buy most for this model of grader, at which facility, and who does the buying" is one question with one grounded answer, and when the evidence is thin the agent says what is known, what is missing, and the next step. Read-only against the ERP by contract. 265 commits since May, 116 with trailers; 101 board items, 88 done; 19 lessons.
- Versova Research, a strategic-intelligence platform whose contract is a request in and a twenty-to-forty-page report out, in hours, of the kind a strategy consultancy bills weeks for. Two pipelines share one chain of gates. External research sends eight specialists out into the world (market, technology, finance, data, competitive, regulatory, implementation, risk) with source-tiered citations. Internal analysis takes uploaded spreadsheets, data files, and documents and puts eight other specialists on them (data engineering, statistics, simulation, visualization, domain, financial, risk, implementation): the data science the company used to buy from a university, ten thousand dollars and a month's wait for one trial's analysis, now runs in a few hours for about forty dollars. Before either swarm runs, a three-reviewer pre-flight panel plus a chair reads the whole input for reality, logic, and sufficiency, and pauses the job when a human must decide. After it, a panel of three readers drawn across labs and verified by a different lab returns a verdict in plain code, remediation is held to two bounded rounds, two independent judges classify the report at publish time, and a single publish authority checks ownership and the exact hash of the reviewed input, compares and sets, reads its own write back, and only then notifies. Reports leave as PDF, slides, and audio through an authenticated portal. 550 commits; 32 board items, 18 done; 23 work orders; 44 lessons.
- Palingenesis, an autonomous innovation system for any field with a body of prior research: construction, health care, agriculture, wherever the written record of what humans have tried can be pattern-matched across time and turned into new ideas that carry a lineage, each one born of parents and mutations, judged, and then proven in simulation before anyone spends a dollar on real-world R&D. The purpose is economic: make regenerative practice cheaper than extraction, one proven idea at a time. Regenerative egg production is the first proof and the first market. The plant is five wheels that each own their database schema and runtime boundary and speak only through events: Eureka ingests research into a knowledge graph and runs durable research commissions; Symbiont scores alignment, manages attractors, and detects drift; Innovation generates candidates it calls prophets, has a twenty-five-agent council evaluate them, evolves the survivors, and keeps a long memory; the Simulator, in Rust, runs council debate against physics and systems models; Portfolio turns what survives into market intelligence, intellectual property, and revenue plans. Over all of it sits a SCADA-style command center with tracing, metrics, and a gateway, and one launcher that brings the whole plant up. 408 commits; 38 board items; 34 work orders; 200 lessons, the largest journal in the estate.
- the orient, a research campaign into one question, whether reality shows evidence of orientation, run under a method rather than an opinion: a claim's strength is the number of independent frames it survives (physics, mathematics, biology, neuroscience, philosophy of mind, first-person report, comparative religion, anthropology, the history of science), so nine candidate lanes each carry a steelman, a deflation, and a stated kill-test, and every candidate ends in exactly one state: strong, weak, retired, or undetermined. Lanes run blind to each other, selected lanes re-run on a different model family and with the framing inverted, the synthesizer never grades its own synthesis, the red team is a fresh session on a different model holding only the artifacts, and its findings enter the report unedited. Phase one was ratified after four review sittings, with two campaign laws ruled on the way; the deliverable is a ledger, and "underdetermined, and here is exactly why" counts as success. 87 commits in 12 days, 82 with trailers; 46 board items, 29 done; 28 lessons.
- Scale Mechanics, a standing experiment in steering frontier models toward new, verified physical theory, whose payload is a scale-dependent information-processing account of measurement, gravity, and cosmology. Three generations are preserved in full: the raw first draft, the forensic sweep that found fourteen fatal defects in it, the repairs, and the gauntlet that certified the third; verifier fleets ran until two consecutive independent passes found nothing. Every headline number is computed by the repository's own derivation engine from stated inputs and locked by a test that fails if the paper and the code ever disagree. The record states its own limit, that adversarial self-verification cannot certify physical truth, so five kill conditions are registered in advance for reality to grade, among them a neutrino mass sum and a dark-energy sign. 19 commits, 12 with trailers; 14 board items; 15 work orders; 30 lessons.
- Holy Ghostty, the fleet's cockpit: a product fork of the Ghostty terminal in which the unit is a session, never a tab. Claude, Codex, OpenCode, and shell sessions run on tmux, locally or over SSH, in a roster that shows each agent's state through a six-state indicator fed by the agent's own lifecycle hooks, notifies once and deterministically when one replies, needs you, or fails, tracks every session's git snapshot and worktree, joins GitHub attention, alerts, and board triage into one inbox, and after a tmux server dies restores every interrupted session to the exact conversation it was in. The next release watches the account's usage windows once a minute and tells every running session to checkpoint and pause before a cap lands. 91 Swift files and 44,926 lines on top of upstream, with 14,817 lines of tests; 271 commits of its own since April; 102 trailers; 73 work orders; 86 board items.
- The expense pipeline, small, and the same law at desk scale. It collects invoice PDFs from three sources (a mailbox queried over the Graph API, 318 receipts on the first pass; vendor billing portals driven through a real browser, plus a browserless sweep of Stripe-hosted invoices; and manual drops), matches each to an expense with a three-tier scoring engine (merchant plus date within three days plus amount within a dollar, then merchant plus date within a week, then merchant alone), fills the expense system's five fields, attaches the receipt, and carries a cleanup path for attachments it got wrong. Its own handoff records the day a lazy fallback attached the alphabetically first of eighty receipts to every matching expense, two to four times over, against a system with no bulk delete: the cheapest lesson this estate ever paid for receipts over testimony.
Each of the seven larger builds carries a board, sealed work orders, a sign-in sheet, and a journal, because each is built by the same person with the same fleet under the same rules, and the rules were cut where the builds broke: the sign-in sheet was rebuilt around incidents from multi-session builds, the design scorer was demoted to a floor check the week the Palingenesis redesign was about to ship on its say-so, and the policy layer now on the board began as a claim-enforcement problem inside a Versova build. None of those could be run without this. This could not have been built without them. Those are the receipts.
Three moves, all on the board, in a program the board calls Moon: seven trunks lettered A through G, one already done.
The agent operating system. Today the shop's rules live in the tools. The next layer makes them data: one committed policy file per repository or organization stating which model tiers may take which class of work, how a job may be claimed, and what evidence a commit must carry. The harness stamps every commit with the model, effort, and session that produced it (the design's own reason: models misreport, so the harness writes the stamp). A session checks its own floor before it spends a token, and the merge gate refuses anything under-floor, unclaimed, out of order, or unproven. Advisory in the session, binding at the gate: no worker is bricked mid-flight, and nothing silent reaches main. The six questions the design says a team should never have to ask aloud (what next, who has it, is my branch current, was the model strong enough, can we prove it, what is actually live) become answers the machine gives all day.
Multiple humans in the loop. The same ambient loop that serves the workers serves the people. A developer on the team gets the job list at session start, claims with one command that also assigns the GitHub issue (the atomic claim the whole team sees within seconds), and has evidence stamps written by installed hooks without thinking about them. The owner's window becomes the team's window, with each ask routed to whoever holds that decision. And the shop already spans buildings: since v1.5 every board carries a portable identity (this one is mb-615bf342bcb87e41e7d54a7c6c0b84ae) and can cite work on another repository's board, so a program that crosses repositories stays one graph, and a missing counterpart degrades to "unavailable" instead of a broken link.
The complete outer harness for any inner harness. The inner harness (Claude Code, Codex, Cursor, whatever ships next) does the thinking. agent-do is everything around it: the vessel, the sign-in sheet, the job list, the journal, the foreman, the receipts, the window. Hooks ship for three inner harnesses today (twelve scripts for Claude Code, six for Codex, four for Cursor), and any inner harness that can run a shell command can pick up the tools without hooks at all, because the shell is the contract. The dharma never moves when the model does. Swap the inner harness or the model mid-program: the same board, the same receipts, the same journal, the same rules. A company can change who sits at the bench without changing the company.
A team that runs ten agents without something like this pays for the same job twice, starts blocked work because the dependency graph lived in a document nobody read, ships work from a model that was too weak for it, and cannot say a month later which model wrote which commit. The usual remedy is to ask the people to be careful, and carefulness is a property of a person, which does not scale to five developers and ten agents with the lead asleep. This is the other remedy: a dharma held in the machine, so that nobody has to be careful. A vessel whose every act keeps a receipt, and a shop that reads the receipts to whoever arrives next. Intelligence is now the cheap part. What is scarce is an institution that intelligence can work inside of without remembering that it exists, and that is what was built here, on itself and on seven real builds, first.
Give the mind a vessel whose every act keeps a receipt, and build every institution as if no habit survives the shift, because here none does; the handoff, never the recollection, is the continuity.
The full system map is in ARCHITECTURE.md; hook wiring is in docs/INTEGRATION.md; the tool catalog is generated into docs/TOOLS.md. MIT license.