AgentOps-Runtime
Rust runtime that turns recurring agent-workflow failure modes into registered gates — one mechanism, one crate — executed through host adapters. The minimal ReAct agent (Pi) is the design baseline; every gate is defined against what a plain agent loop provably emits.
Design premise: the runtime language is maximal — gates define full semantics and host adapters project the subset each host can express. The opposite direction (agent-native capability lifted into a common language, bottom-up) is AwP + A4AA's. See docs/design-direction.md.
Pi agent (baseline executor)
│
AgentOps-Runtime (this repo)
aor core contracts: gate trait, events, findings, records
aor-<gate> one crate per mechanism — policy only, no host code
aor-runtime assembly: gate registry + the `aor` binary
│
┌───────┴────────┐
PA channel AHE channel GitVault boundary
fail-closed observe + events fail-closed checker
managed agents arbitrary hosts push / PR / release
Gates
| gate | crate | mechanism |
|---|---|---|
| handoff | aor-handoff |
conclusion/verified/file-status index; references replace paraphrase |
| dispatch | aor-dispatch |
dispatch contract: completion channel, exclusive writes, acceptance |
| payload | aor-payload |
payload budget; windowed reads; oversized-input split |
| verify | aor-verify |
targeted checks free; full regression once; HEAD-bound evidence |
| close | aor-close |
stale delivery harvest; main/worktree reconciliation; DoD |
| decision | aor-decision |
decision artifacts with stable id+digest; reference, not paraphrase |
| resource | aor-resource |
manifest-declared shared/exclusive resources; intersection checks |
| wait | aor-wait |
completion notifications over polling; bounded backoff |
Enforcement model
Gate definitions are host-neutral. The same gate runs at different strengths depending on which adapter executes it:
pa-managed— a managed host owns the dispatch itself, so profiles here may fail closed.ahe-observe— Agent Hook Engine observes and raises threshold events; it never blocks native host behavior.gv-boundary— GitVault outbound checkers; fail-closed on irreversible operations.
Every channel a gate applies to is declared in the gate's profiles;
partial support is Incomplete, never silently dropped.
Storage (planned)
SQLite is the single source of truth — records, rot_ledger,
todos_gates, memory. Markdown, dashboards and any vault export are
read-only projections. Existing ledgers and curated notes migrate
through a one-time import with parity checks.
Verify
scripts/verify.sh — fmt + clippy + tests.