wmux Agent Workspace

The security documentation and README describe token-authenticated IPC, approval gates for cross-agent execution, a read-only web service bound to loopback by default, and sealed envelopes for phone push; the workflow also limits permissions, triggers, and token budget. These support the least-privilege, confirmation, and external-effects scores. Deductions: these are mainly documentation and workflow configuration, with insufficient implementation detail to assess the product’s full data flows, sensitive-data handling, or rollback behavior. Dependencies are listed with a few overrides, but there is no audit or vulnerability-remediation evidence.

The README describes daemon-owned persistent sessions, recovery, and all-or-nothing git apply for worktree changes. Install troubleshooting gives concrete errors and remedies, while CI files explain expected behavior and limitations. Deductions: the CI explicitly says the cross-platform baseline is not a release gate and that some platform branches have not been executed; repo-wide lint is advisory. Static evidence cannot establish runtime robustness of error handling or dependency availability.

The README covers multiple CLI agents, workflows, and Windows/macOS users, and describes browser, phone, worktree, Git, scheduling, and MCP profile scenarios, with some platform and feature boundaries. Deductions: the broad compatibility claims are not backed by equally specific adaptation details for every environment and agent; trigger and applicability boundaries are described across feature sections rather than in a consistent, comprehensive specification.

The documentation is clearly organized, with entry points for installation, building, troubleshooting, FAQ, limitations, and detailed guides; the MIT license text is explicit. The README gives platform and installation guidance, while package.json provides version, engine, and dependency information. Deductions: the supplied material has no changelog or durable maintenance commitment; release paths are described, but responsibility and maintenance commitments are not clear. There is no formal stability policy for names or components.

The README describes concrete outputs for agents, including browser control, terminal use, agent-to-agent communication, task fan-out, and review workflows; worktree isolation and selective adoption provide clear potential user value. Deductions: cost, resource use, and realized benefit are not quantified, and the described experience is presented by repository materials rather than independently established evidence.

Most feature, installation, and security claims point to repository documentation; the workflows document trigger constraints, permissions, and CI failure context. The README sometimes distinguishes defaults, experimental builds, and known limitations. Deductions: many product capabilities are asserted in the README, while the linked implementation documents and corresponding source are not included here for cross-checking; static evidence cannot verify the depicted or described runtime behavior.