Five controls to put in front of a fleet of coding agents: a gate that holds what policy did not allow, a kill switch that works from a phone, a hash-chained evidence ledger, a liveness guard where green means it ran, and cost routing that puts the expensive model on the two jobs worth paying for.
$99 minimum, $129 suggested
Pay what you think it's worth, with $99 as the floor. Team licence (5 seats) $299.
Available December 10. Join the list to get it first.
Version 1.0, five controls, a Claude Code hook, three scheduler examples, 43 tests and a 20-page guide, updated December 2026.
Free updates forever. 30-day 100% refund, no questions.
The code is MIT — the guide is the paid part. No subscription, no account, no DRM.
A single agent session fails in front of you — you see the wrong file being edited, you press escape. A fleet fails differently. The moment work runs while nobody is watching, the failure modes stop being "it did the wrong thing" and become "it did the wrong thing, and nothing said so". This is what I run instead.
PreToolUse hook, as a wrapper for Codex CLI or
your own loop, or as three lines of Python.ledger verify names it.Policy is authority, not documentation. policy.json is written by a
person and read by agents; the shipped default denies writes to it. That sounds like a nicety until
you watch a capable agent fix a failing gate by editing the policy that failed it.
Green means it ran. This came out of a real failure — a status tile that stayed green for nine days while the machine running the job was off. Nothing alerted, because nothing had failed. Things had simply stopped happening.
agentops package — gate.py,
killswitch.py, ledger.py, liveness.py,
cost.py, cli.py. Python standard library only, MIT licensed, about a
thousand lines you can read in a sitting.hooks/pretooluse-gate.sh, which fails
closed on a payload it cannot read, passes arguments NUL-separated so a command containing
quotes or newlines reaches the gate exactly as it will run, and works on the bash 3.2 that
macOS still ships.run-with-gate.sh — the same policy in front of Codex CLI, a
Makefile, or any loop with no hook system, plus a run id that ties every decision, command and
dollar together in the ledger.Persistent=true, and a launchd plist with the two traps that silence macOS jobs
written into the comments.python3 -m unittest discover -s tests -t .. Each one
breaks a control on purpose: a kill flag that will not parse, a ledger line edited after the
fact, an approval token used twice, a job whose last success is three days old.policy.example.json — generated from the code at build time, so
the documented policy cannot drift from the one the gate enforces.Everything is plain text: Python, bash, JSON, Markdown, one PDF. No network calls anywhere in
the toolkit, no daemon, no account, no pip install. Nothing that stops working if this
site does.
Vendor-neutral, and honest about its limits: this is a policy layer, not a sandbox. It stops accidents, makes intentional actions visible and bounds the blast radius. For containment, run agents in a container or as a separate user — with these controls inside.
Yes. The gate is a command with an exit code. run-with-gate.sh gates any shell
command, so Codex CLI, a Makefile or a loop you wrote all work. The PreToolUse hook is
the only Claude Code-specific file in the pack.
The guide, and the fact that the decisions are already made. The code is free to take — fork it,
ship it inside your own tooling. What takes the time is knowing which control catches which
failure, where each one stops working, and the dozen small traps that make the difference between a
control and a decoration: a try/except that eats the kill switch, a shell variable that
cannot hold a NUL byte, cron's PATH, launchd inheriting nothing.
No, and the guide says so in chapter 2. It is a policy check, not a security boundary. An agent running as your user with a shell can eventually do what your user can do. What this buys is that accidents are stopped, deliberate actions are visible, and the blast radius is a directory you chose.
Neither. There is no network code in the toolkit at all, and every file it writes is in your own state directory.
No. Free updates forever. The same download link always serves the newest version, and you get an email when one ships.
Yes — 30 days, 100%, no questions asked. Email me and I'll refund it. You keep the files.
The controls are what I run in front of my own agents, and the nine-day green tile was mine. I used AI as an editor to tighten the prose — and, fittingly, these are the controls it runs under.
Not yet. I'd rather show none than invent them. The first buyers get asked for a one-line review, and those go here when they exist.
Not ready to buy? Take the 96-item Homelab Ops Checklist, which costs nothing, or read the guides.
Made by a working sysadmin who runs this lab. About Mark Restivo.