Agents Squads

The evidence shows default-deny contracts, role-scoped tools and write paths, runtime and cost ceilings, and rejection of consequential grants without a gate; the branching test also keeps work products off main, so least privilege is handled thoroughly. README inbox approvals and contract HITL gates support user confirmation, but the supplied files do not establish that every externally consequential command is uniformly confirmed. The README explains local Git state, context consumed by agents, and delegation to external AI CLIs, giving adequate data-flow visibility, but it does not enumerate provider payload fields, retention, or network endpoints. SECURITY.md gives concrete guidance for credentials, file permissions, prompt injection, encryption, and secure deletion, although enforcement by default is not demonstrated. CI runs npm audit at critical severity and dependencies are constrained, but no lockfile, stronger supply-chain pinning evidence, or audit result is supplied. Git branch isolation, audit history, and consequential gates constrain effects, yet agents may execute system commands and bare Bash is accepted as an enforceable tool. Git provides a rollback foundation, but no dedicated undo procedure or automatic failure recovery is shown. Author, repository, issue channel, and license attribution are clear; however, the publisher is not registry-verified and the files provide no independently established maintainer identity chain.

README, package metadata, CI, and tests are broadly consistent about Node versions, CLI naming, local Git state, and provider prerequisites, with drift guards for generated clients and command references. Deductions apply because some smoke commands are followed by “|| true,” the branching test relies on a fixed delay, and no execution results are available. Dependency availability is addressed through npm ci, Node 20/22 matrices, doctor checks, and a nonzero exit code for a missing provider CLI, but normal operation still requires separately installed and authenticated Claude Code, while other providers are not verified by the supplied evidence. Failure handling includes missing-file diagnostics, drift errors, a security-reporting route, and machine-detectable provider failure; a complete user-facing error taxonomy, retry policy, and recovery messaging are not shown.

Engineering, marketing, finance, operations, and scanner, worker, lead, and verifier roles are clearly identified, with both conversational and directed execution scenarios, justifying full audience-and-scenario credit. Role contracts, allowed tools, write scopes, budgets, timeouts, and context layers define ordinary capability boundaries, but bare Bash remains broad and the runtime implementation needed to confirm every boundary is absent. Squad/agent addressing, --task, --dry-run, and provider selection offer reasonable trigger precision, though ambiguity handling and dangerous-intent rejection for natural-language tasks are not demonstrated. Node, Git, Claude Code, a local file layout, doctor, and the multi-provider design support environment fit, but the claim that additional providers work out of the box is not fully substantiated by the supplied configuration or end-to-end evidence.

The README supplies a clear directory tree, operating model, documentation map, requirements, development steps, and contribution path, earning full information-architecture credit. Global installation, initialization, an end-to-end demo, local development, and prerequisites are directly actionable, so install notes are thorough. Commands, directories, and role terminology remain consistent across the files, with a generated-reference drift guard, but the product is still 0.x and no compatibility guarantee is shown. Examples cover first use, directed tasks, approval, and development, while an FAQ and broader troubleshooting examples are absent. SECURITY.md documents prompt injection, command execution, and sensitive memory limitations, and README discloses the default-provider requirement, but there is no consolidated and comprehensive limitations section. MIT metadata matches the complete license text, supporting full license credit. Changesets automation and version 0.9.0 establish an update mechanism, but no actual changelog or release notes are included. Security and general contact addresses, issue tracking, and a security-update process identify maintenance routes; deductions reflect the lack of a registry-verified publisher, named maintainers, or governance details rather than treating unknown identity as suspicious.

Human-oriented status, context, inbox, dry-run, and doctor commands, together with machine-detectable failure and reviewable Git/Markdown artifacts, support ordinary output usability. No representative real output or full interaction implementation is supplied, preventing a thorough score. Shared context, persistent memory, feedback loops, verifier roles, and mixed-model routing plausibly add value over a single agent, but reduced duplication and improved quality remain largely asserted without comparative evidence. Per-role cost and time ceilings and the use of cheaper models for scanning show cost awareness, while claims about API-call-only economics lack benchmarks, scale measurements, or total-cost analysis.

Several behaviors trace to concrete tests, issue references, CI guards, and configuration fields, including missing-CLI exit status, contract constraints, initialization artifacts, and branch isolation. Promotional capabilities are not all connected to supplied implementation or tests, so traceability is adequate rather than complete. README, package metadata, SECURITY.md, workflows, and tests strongly corroborate installation requirements, local Git architecture, version, license, permission controls, and maintenance processes. The material often distinguishes requirements, recommendations, and tested assertions, especially in SECURITY.md, but claims such as out-of-the-box provider support, avoidance of duplicate work, and no telemetry surprises lack direct implementation evidence, leaving some facts and inferences insufficiently separated.