A model-agnostic AI coding harness that puts unskippable gates into Git

I'll pull the GitHub repo and HN thread so the paragraphs stick to real project details, not invented numbers or claims.A public GitHub project from beausee, Coniunctio Intelligentiarum, landed on Hacker News under the AI Agents lane with 1 point and 0 comments (item 49196878). The repo tags itself as a harness that bridges a human mind and an AI mind: unskippable gates, structural memory and recall, and a growing repertoire of how-we-solve methods, with the human always on top. Its stated motto is to mechanise memory, not judgment—moving rules that must not be forgotten out of model context and into machinery the agent cannot skip.

Technically, enforcement sits outside the model. Risk-pattern commits (auth, secrets, hooks, schema, the gate itself) must carry a verification record bound to the diff: named risk paths, non-empty evidence, a freshness window, and a read from the git index so an empty staged record cannot be patched after the fact. A commit-msg hook is the primary gate; pre-push re-scans outgoing history because cherry-pick, revert, rebase, and git am never run commit-msg; pre-applypatch covers git am. Around that core sit memory and recall injection at session start, a strategy repertoire, a file-backed multi-seat message bus, a knowledge commons with hard write quarantine and human-only promotion, a loop layer that turns done into a runnable check (nine definition-of-done items, exit codes for pass / needs-owner / fail), an evaluator tripwire that hashes declared judge files against a freshly fetched origin/main, and a prompt guard that blocks secret-shaped input and secret-file reads before transmission. The project’s own example of self-graded tools is sharp: a tool scored 92 percent on the test corpus it wrote for itself and 8.8 percent against reality; the prompt guard’s hand-written tests hit 92 percent and 8.8 percent on real credentials, which is why strong matching uses known values from local secret files rather than shape guessing alone.

For engineers and builders, the product pitch is not a smarter agent but a seatbelt for long sessions. Agents drift: rules fire early and go quiet later with no announcement. Agents forget across sessions. Agents grade their own homework. Putting gates in git means a risky change without evidence is refused at the commit boundary whether the model remembers the policy or not. Fail-open is deliberate so a broken checker cannot lock the owner out of the repo; deliberate overrides such as gate-ok reasons are logged rather than silent. The honest limits section is explicit: the harness defends against forgetfulness, not malice; evidence is free prose the same agent can write; git commit --no-verify and git push --no-verify still work; controls that must be invited are not treated as boundaries.

In market context this sits with other agent harnesses—Goose, Aider, Letta, LangGraph are named prior art—while differentiating on model-agnostic git enforcement and multi-layer integrity (gates plus a tripwire on the gates themselves). It is Apache-2.0, extracted from a private system the author says gates real commits daily, and published as scrubbed generated snapshots rather than hand-edited living code. Session wiring still leans on Claude Code hooks; enforcement claims agent independence via plain git hooks and Python under scripts/. Early HN traction is minimal (1 point, no discussion yet), so adoption signal is the repo’s design docs and test suites, not community consensus.

Practical takeaway: treat this as opt-in process infrastructure—git config core.hooksPath scripts/git-hooks, harness-gates.json enabled, optional Claude settings for recall—not as containment. Watch whether teams actually adopt verification records on risk paths, whether pre-push re-scan closes the silent-history gaps in real workflows, and whether the evaluator tripwire and mutation-tested suites stay trustworthy under load (the project itself documents load-sensitive false failures and severity inversions it had to fix). If you already run multi-model seats or fear silent rule decay more than adversarial agents, the gates-plus-commons-plus-done-as-command stack is the concrete thing to evaluate next; start by running the shipped commit_gate and push_gate tests against a throwaway repo before wiring it to production history.