Repository authority and the core work boundary are defined in AGENTS.md.
AgentOps reads or refines the existing bead/caller intent, runs one bounded implementation experiment, derives exact content identity, obtains one author-distinct Validate result, and optionally stores that result when a caller or declared downstream consumer requests it. It does not own Git delivery, merge policy, retries, queues, work ownership, or release transitions.
Repositories own delivery policy for local and cloud agents.
AgentOps: Plan -> Implement once -> Validate once -> report and stop
Repository: deterministic checks -> repository-selected Git/CI/release policy
ao gate check is an ordinary deterministic repository test runner. Success
means only that its selected checks passed. It cannot create, strengthen, or
replace a semantic verdict.
AgentOps installs no push hook and does not choose how a repository invokes
these checks. A repository may call ao gate check from a local command, CI,
pull request, merge queue, or another delivery process.
| Workflow | Purpose |
|---|---|
.github/workflows/validate.yml |
Optional hosted execution of repository deterministic checks |
.github/workflows/release.yml |
Repository-owned tagged release publication |
.github/workflows/nightly.yml |
Scheduled deterministic regression and security coverage |
No workflow is a semantic validator. No workflow writes a Validate verdict.
| Job | What it validates | Common failure |
|---|---|---|
| go-gate-shadow | Runs the ordinary Go gate registry with workflow-coverage reporting | A deterministic check failure or workflow/registry coverage mismatch |
| correctness | Builds ao; runs Go, schema, generated-surface, shell, and smoke tests |
Compilation, test, schema, generated-drift, or portability failure |
| security | Runs secret, dependency, static-analysis, and dangerous-pattern checks | A blocking security finding |
Use the smallest focused checks while editing, then run the ordinary full suite once for the complete candidate:
cd cli && go test ./...
python3 scripts/check-cathedral-cut-conformance.py
python3 scripts/generate-skill-mesh.py --check
bash scripts/ci-local-release.shThe local release script validates this repository's release artifacts. That is repository policy, not an AgentOps lifecycle transition.