Delegatus Agent Workbench

Evidence shows default binding to 127.0.0.1, access-key enforcement on other binds and --tailscale, log APIs refusing paths outside known transcript folders, and an explicit admission that reachability equals command execution as the operator; this is a deliberate least-privilege trade-off, but agents run with full operator authority and no per-command confirmation, so least_privilege and user_confirmation score 2. Data-flow disclosure is unusually thorough (daily anonymous ping fields, opt-out switch, memory/voice summaries, direct Anthropic usage endpoint, default-off and fail-closed consent), so data_flow_transparency scores 3. Sensitive-data handling has a privacy gate and known-value fingerprinting, but design docs admit quadratic regex behavior and ~4-core CPU cost and treat detectors as hints only, so 2. Dependency security shows only external dependencies (Bun 1.4, Bubblewrap, systemd) and curl|bash installers with no lockfile audit or vulnerability handling evidence, so 1. External effects include merges, pushes, Telegram and relay writes, while rollback is only scattered across design docs, so external_effects and rollback score 1 each. Source attribution has provenance.json and upstream commit references but no unified attribution statement, so 1.

README and security docs are broadly consistent on binding, telemetry and merge-off defaults, so self_consistency scores 2; however design docs cite commit hashes that differ from the reviewed revision, indicating version drift. Dependency availability gives only install commands and Docker tags with no version pinning or offline guidance, so 1. Failure messages describe missing-CLI startup hints, telemetry timeouts and fail-closed corrupt consent files, which is moderate, so 2.

Audience and scenarios cover individual developers, teams, phone and Tailscale use, so 2. Capability boundaries are explicit (Copilot cannot run the orchestrator, Windows only Claude Code, WSL2 required), so 2. Trigger precision relies on natural-language instructions and decision forms without precise trigger conditions or misfire safeguards, so 1. Environment fit covers Linux/macOS/WSL2/Docker, so 2.

README information architecture is clear with a full guide, so 3. Install notes cover quick start, clone and Docker but rely on curl|bash and coarse version requirements, so 2. Naming stability has no versioned API or naming commitment evidence, so 1. Examples and FAQ include screenshots and guide links but no standalone FAQ, so 2. Known limitations have platform and security sections, so 2. License is MIT and consistently declared, so 2. Versioning and changelog only mention an Updates menu and RELEASING doc with no CHANGELOG evidence, so 1. Maintenance responsibility is unclear with an unverified publisher and no governance or support commitment, so 1.

Output usability includes board, conversations, decision forms and PR flow, so 2. Marginal value comes from multi-engine orchestration, shared memory and phone access, but competition is strong and evidence is largely self-reported, so 2. Cost-benefit is weakened by self-reported ~4-core privacy gate cost and Bubblewrap/systemd environment requirements, so 1.

Design docs cite specific commits, line anchors, measurements and failed candidates, so claim_traceability scores 2. Most claims come only from the repository's own docs without independent cross-sources, so cross_source_corroboration scores 1. Docs separate measured, inferred and unverified items (e.g. no real sub-agent probes), so fact_inference_separation scores 2.