Sortie

The CI workflow uses read-only default permissions, disables persisted checkout credentials, and pins third-party Actions to commit hashes. The security policy also states path containment, workspace-name sanitization, execution-directory checks, environment-variable indirection for secrets, and non-logging of secret values. The README says Sortie sends no telemetry and clearly attributes architectural prior art to OpenAI Symphony; the license and repository origin are also explicit, justifying full source-attribution credit. Deductions apply because the supplied implementation cannot verify the stated security invariants; the orchestrator runs agents capable of code and network side effects without showing minimized agent privileges, per-action confirmation, or approval gates; tracker feedback can create external writes whose scope and confirmation controls are unclear; and retained run history is not evidence that commits, tracker writes, or other external effects can be rolled back. Dependencies and Actions are versioned, an automated update path and vulnerability-reporting policy exist, but no vulnerability scan, SBOM, or evidence that the listed versions are free of known vulnerabilities is supplied.

The README, SECURITY policy, go.mod, and CI are mutually consistent about a Go single-binary design, cross-platform scope, SQLite persistence, and the maintenance model, with no direct contradiction found; self-consistency is therefore strong. Static linking and a small direct dependency set reduce runtime requirements, although the installer endpoint, issue trackers, coding agents, and optional services remain external availability dependencies. The material states that failed runs are retried, history survives restarts, and security reports follow a defined response process. Deductions reflect the absence of concrete user-facing runtime error formats, retry limits, backoff rules, unrecoverable-error classification, and partial-failure examples.

The intended users, problem scenarios, five tracker families, and six coding-agent families are explicitly identified, with local or server operation, parallel sessions, and live WORKFLOW.md updates, so audience and scenario coverage is thorough. The security policy separates Sortie, third-party agent, and deployment-hardening responsibilities and names security boundaries, but actual restrictions on agent commands, network access, and capabilities depend on configuration and architecture material not supplied. Triggering is described as matching selected issues through WORKFLOW.md, but matching syntax, deduplication, race handling, and false-trigger safeguards are not shown. CI covers Linux, macOS, and Windows, while deployment prerequisites, containers, and detailed tracker-agent compatibility remain underdocumented in the provided files.

The README has a clear structure covering the problem, compatibility, installation, operation, documentation, prior art, and licensing; naming across WORKFLOW.md, the Go module, and security terminology is stable. The full Apache-2.0 text is present and agrees with the metadata, justifying full license credit. Installation includes a script, Homebrew, a service-free demo path, and a normal onboarding path, but the piped remote script lacks an accompanying checksum, pinned release, or manual-install alternative. Examples are largely external links plus one test script, with no substantive FAQ in the supplied material. The security policy documents support windows, scope, and reporting routes well, but general operational limitations are sparse. Semantic versioning and a CHANGELOG update path are stated, although the CHANGELOG itself is absent. Maintenance channels, timelines, and a security address are clear, but the publisher is not registry-verified and no named maintainers or governance structure are shown.

Outputs are made actionable through retained run history, progress and cost tracking, and optional CI or review feedback loops, which supports ordinary engineering use. The evidence does not show an actual session report, patch-delivery format, review interface, or completion-decision example, so output usability is not demonstrated comprehensively. Combining existing coding agents and trackers with isolated workspaces, retries, and persistence provides clear marginal value over manually launching each task. A single binary, SQLite, and parallel execution reduce deployment burden and cost tracking aids oversight; deductions apply because compute, token, storage, concurrency, and maintenance costs are not quantified and no benchmark or case study substantiates the benefit.

Most principal claims map to specific supplied artifacts, including dependency versions, cross-platform CI, workflow permissions, licensing, and the support policy. Deductions apply because important security and functionality claims are documentary assertions without the corresponding implementation, referenced architecture section, CHANGELOG, or full test suite in the evidence. The files provide some cross-corroboration around dependencies, platforms, credential handling, and testing strategy, but there is no independent source or complete source-level corroboration. Product claims, security policy, and CI configuration are generally separated clearly, yet efficiency claims and assertions such as never logging secrets or sending no telemetry are not explicitly distinguished as implementation-proven facts versus design requirements in the supplied source.