kaiohenricunha/dotbabel

> Maintained by @kaiohenricunha · Changelog · Security
**Make an AI coding agent show its work.**
Agents produce plausible output fast. The expensive failures come from the
plausible-but-unverified kind: a fix for a bug nobody reproduced, an analysis
citing a file that was never opened, a "done" that no test covers. dotbabel is
the verification layer — a library of skills that force an agent to ground
every claim, plus gates that check the result before it merges.
The skills encode the discipline. /ground-first refuses to propose an edit
until the relevant source has actually been read. /fix-with-evidence demands
a failing reproduction before a fix and a passing run after it.
/veracity-audit and /plan-grader grade work against what the code really
says. /security-review, /detect-flaky, and /validate-spec gate the
output. Cloud and IaC specialists (aws, gcp, azure, kubernetes,
terraform, crossplane) bring the same evidence-first posture to
infrastructure work.
**How serious is that verification? Serious enough to replace your CI gate.**
dotbabel local-attest runs your GitHub Actions matrix on your machine and,
on a clean pass, posts a SHA-pinned attestation that makes the remote
workflows skip themselves for that commit — one repo cut ~27 minutes of runner
time per push to zero. It is deliberately hard to fool: pinned to the exact
head SHA so the next push invalidates it, owner-authored comments only, a
refusal to attest when any leg was skipped or never launched, an audit log
that records failures as well as passes, and toolchain pins that fail the run
closed when your local Node or Go differs from CI's. That is the standard the
rest of the toolkit is built to.
And it holds a floor under the code an agent writes. dotbabel quality
resolves one policy — complexity, changed-line coverage, duplication, dead code,
high-confidence security findings — and measures it with the tools your repo
already has: your Makefile targets, your package.json scripts, your
pyproject.toml config. It installs nothing, runs nothing outside an explicit
trust allowlist, and when it cannot measure something it says unsupported,
not_configured, or unavailable rather than quietly passing.
It also runs everywhere you work: one rule floor, fanned out to Claude Code,
Codex, Gemini CLI, Antigravity CLI, OpenCode CLI, and Copilot CLI, with drift
detection so the
copies cannot silently disagree.
**Who is this for?**
| I am… | I want… | Start here |
| ----------------- | -------------------------------------------------------------------------------- | ------------------------------------------------------- |
| **Agent user** | Skills that make Claude ground, verify, and cite its work | Install as a plugin |
| **Dotfile user** | The toolkit — skills, commands, and CLAUDE.md in every Claude session | Clone & bootstrap |
| **CI payer** | To stop re-running checks I already verified locally | Local attestation |
| **Quality owner** | One enforceable quality floor across a mixed-language repo | Language-aware quality |
| **Consumer** | The CLI in my repo — bootstrap, doctor, drift detection, optional spec-gov gates | Install the CLI |
| **Library user** | Node API in my own tooling | docs/api-reference.md |
| **Contributor** | Dev workflow, local gates | CONTRIBUTING.md |
---
TL;DR — pick your path
| What you want | How |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Skills & subagents inside Claude Code, no clone | **Install as a plugin** — two slash commands |
| Skills & commands library wired into ~/.claude/ | **Clone & bootstrap** — 30 seconds, no npm required |
| Skip remote CI for commits you verified locally | **Local attestation** — npx dotbabel-local-attest --init |
| Governance CLI for your own repos (bootstrap + doctor + optional spec gates) | **Install the CLI** — see install section (Node ≥ 20 required) |