u00dxk2/agent-ops-patterns

Operational patterns for running LLM agents in production.
**New here? Paste this to your own agent.** Five questions about your own setup, read-only, scored out of five:
It answers each question with a verdict and the file path behind it, then names the smallest fix that would move one failure to a pass. About thirty seconds of your attention.
What it found on ten popular agent repos: *I ran my agent audit on ten popular agent repos. All ten scored zero.*
That prompt points your agent at a file on this repo's main, so read SELF-AUDIT.md first if you'd rather see what you're handing it — it's one page, it changes, and it asks your agent to read your history, logs, memory and config. Read-only means it won't write anything; it doesn't mean it reads nothing.
Before I published this repo, an adversarial review found a real hole in the permission
library - the artifact whose whole job is question four. It was fixed before this audit
was added to the repo, and the fix commit
says how it was found.
**Got a score? Tell me** — your number and which questions failed. Verdicts only: don't paste your agent's output.
Gallery: who decides what inside open-source agents
gallery/ holds cognitive operations maps of open-source agent systems. Each one lists the recurring judgments it found in a system and who holds each (code, a model, or a person), with how it has failed and what checks it where the mapping found them, the prompt pieces and assembly paths identified in the mapped source for the seats a model holds, and a report of what the mapping exposed. The first is **OpenHands**: 171 seats and 70 gap entries (12 of them flagged as stated design) in its agent SDK, all read at one commit from 2026-10-06. Where a card quotes prompt text, the quote is the source as written, linked to the lines it came from (14 cards). Three of the gaps were reproduced with tests and reported to the project in public: two new issues and a comment on an existing one. The link opens it in your browser; it's one self-contained HTML file, also in gallery/openhands/ if you'd rather download it.
What's here
| Artifact | What it does | How to adopt |
|---|---|---|
| lib/snippet-redact.mjs | Redacts secret-shaped text (API keys, JWTs, DB URIs, PEM blocks…) at the output boundary of any recall/search path, with named shape tokens ([redacted:github-token]) so hits stay findable. Defense-in-depth, not DLP — see Coverage and limits. | **Use as-is** — vendor the one file (zero deps, pure function) |
| lib/memory-integrity.mjs | Zero-LLM integrity pass over a markdown agent-memory dir (MEMORY.md-style index + per-fact files + [[wiki-links]] — the Claude Code auto-memory shape): dead links, silent merges, over-budget index, orphans, near-duplicates, and (opt-in, with a synchronous resolver you supply) index lines naming a script that resolves to no file; plus a backlink graph, **suggest-only** repairs, and a fleet-wide index-size classifier where an agent you couldn't measure is a finding rather than a clean row. | **Use as-is** — vendor the one file; wire a thin CLI to your memory dir |
| lib/secret_redaction.py | The same output-boundary redaction for Python recall paths (agent-memory layers, log excerpting) — a faithful port of snippet-redact.mjs, kept in sync; extracted while proposing this boundary upstream to a Python memory framework (mem0ai/mem0#6817). | **Use as-is** — vendor the one file (stdlib-only); python lib/secret_redaction.py runs its self-check |
| lib/capability-grant.mjs | Scoped, single-use, TTL-bounded capability grants for human-gated agent actions: an approval relayed through a chat/bus message is not authorization, so a direct human "go" mints a grant bound to the sha256 of one exact command, honored once. Fail-closed: any ambiguity falls through to your normal permission prompt. | **Reference logic** — pure and complete as logic, and **not an authorization boundary on its own**. You supply: complete, non-bypassable mediation (no execution path reaches the action except through the hook); an authenticated *and* authorized minting principal, minting outside any agent session; a grant store, class policy and audit log the agent cannot write or delete; random ids; scope and class resolution; a trusted clock; atomic consume-before-execute; executing the same captured value that was checked; binding or independently trusting mutable context (cwd, PATH, executable resolution, environment, shell, referenced files) — a command hash does not bind a command's *effect* when those can change; and a fallback to your normal prompt. Budget real work here, not a wrapper |