Features

OpenGantry is a local CLI that scopes agent edits before they touch your repo. One verify contract for agentic graphs and IDE sessions — adapter rules differ, outcomes are always structured JSON. It is not Gantry.io and it does not chat on your behalf.

Get started Documentation

Workflow

How the pieces fit

Scan what is already there, turn findings into enforceable rules, legislate each change, then prove pass at every gate. Discovery proposes — blueprint, perimeter, missions, and verify enforce.

Discover

Scan the repo and collect file:line evidence — nothing becomes law yet.

The scanner writes `.gitagent/discovery-proposal.json` with concrete anchors (imports, patterns, layer hints). Review or accept before blueprint turns findings into enforceable rules.

Domain-aware scans: `gantry init --discover --domain code|content`
Evidence is proposals — hooks do not enforce until blueprint or manual acceptance
Agents use output to draft missions with realistic TMVC roots


          $
          gantry init --discover --domain code
        
          $
          gantry blueprint --domain code --yes

Blueprint

Turn proposals into architecture docs and a verification plan.

Blueprint materializes `ARCHITECTURE.md`, `TARGET_ARCHITECTURE.yaml`, and `.gitagent/verification_plan.json` — gate commands, skills, and perimeter rules your team can diff in Git.

Maps discovery evidence to layer rules and adapter hooks
Sets default `gate_command` candidates per skill in the foreman map
Human review before `--yes` — same contract as mission legislation


          $
          gantry blueprint --domain code --yes

Skip discovery in mature repos — legislate missions directly once MANIFEST and architecture exist.

Perimeter

Adapter rules enforce boundaries before and during execution.

Code adapters check import layers; content adapters apply forbid/require regex. Failures return file, line, and rule id — agents read structured output instead of guessing why a path was blocked.

`gantry arch check` for code layer violations
Content missions scope `content/**` with regex policy adapters
Perimeter runs inside verify and at dedicated arch gates


          $
          gantry arch check
        
          $
          gantry perimeter check

Mission

Legislate TMVC roots and gate_command in mission YAML.

Each change gets an MSN file: allowed paths, forbidden zones, trace rows, and the shell gate verify must pass. Pin the mission so hooks, MCP tools, and `runtime exec` share the same scope.

Planner commits `[MSN-XXXX]` before executors edit
`gantry pin` + `runtime env` load scope into the agent subprocess
One mission can span a pipeline graph — same YAML for every worker hop


          $
          gantry legislate "Ship feature" --msn MSN-0042 --skill-key gantry --gate-command "npm test"
        
          $
          gantry pin .gitagent/missions/MSN-0042.ship-feature.yaml

Interactive orchestration: `gantry start …` opens the same MSN contract in a guided session.

Verify

Prove pass with structured JSON — fail closed.

`gantry verify` reruns gates, checks Planner legislation, and maps PASS rows to committed `EXECUTOR_LOG.md` quotes. Chat cannot override a failing verdict.

`gantry context-feed --json` → compact `findings[]` for model re-entry (`offending_file`, hint, `gate_log_path`)
`gantry verify --json` → full debug payload (stdout/stderr allowed)
`gantry report` → localhost triage after verify: last outcome, local run history, drill-down to findings and gate logs (no re-run, no cloud)
Optional `--receipt` for digest-only attestation history
Same envelope for IDE sessions, CI stages, and orchestration bus workers


          $
          gantry verify
        
          $
          gantry context-feed --json
        
          $
          gantry report
        
          $
          gantry verify --json

In practice

A day with OpenGantry

Composite scenes from how OpenGantry is used.

Staff engineer

The agent walked into a forbidden zone

I pinned MSN-0042 and let the session run. It tried to rewrite .gitagent/foreman/MANIFEST.json. Runtime failed closed. findings[] named the path. The next hop stayed in src/cli/.

gantry pin · TMVC deny

Tech lead

Verify is not the same pass that edited

I will not rubber-stamp a chat transcript. The executor appends PASS rows to EXECUTOR_LOG.md. Those rows have to quote the gate output. gantry verify maps every claim. A missing quote fails the mission.

SOD · verbatim PASS quotes

Docs lead

Release notes do not ship on vibes

The content adapter scopes src/content/. The agent drafted a changelog that sounded fine and failed the docs build. That build is the gate_command. Nothing publishes until verify is green.

content domain · docs build gate

Security lead

The PR has a receipt, not a promise

Review is a mission YAML, a quote in EXECUTOR_LOG.md, and an optional attest file under .gitagent/history/receipts/. I keep the verify JSON. I do not keep a screenshot of a model saying it was careful.

attest receipt · verify JSON

A Tuesday

Legislate, pin, hit a forbidden zone, retry inside TMVC, then prove it with verify JSON.

~/your-repo · tuesday

$ gantry legislate "ship ingest retry" --msn MSN-0042 --skill-key gantry

$ gantry pin .gitagent/missions/MSN-0042.ship-ingest-retry.yaml

$ eval "$(gantry runtime env)"

TMVC deny .gitagent/foreman/MANIFEST.json

retry inside src/cli/, then:

$ gantry verify --json

{"ok": true,"trace": "mapped"}

gate: perimeter · trace: mapped

Domains

Pluggable domain adapters

One verify graph. Pluggable rules. Built-in code and content adapters ship today; CI, security, infra, API contracts, and other stacks hang on the same mission YAML plus gate_command — scope, trace, and structured pass/fail never change.

Block architectural drift before it merges

Agents shortcut through private modules, smuggle forbidden SDKs into core layers, and widen public surface area you never approved. The built-in code adapter turns your repo graph into binary perimeter rules — `gantry arch check` fails closed with offending_file, line, and resolution_hint.

Forbid `src/cli/**` from importing `src/server/internal/**`
Block `@aws-sdk/*` outside your infrastructure layer
Pin a mission to `src/features/checkout/**` — nothing else moves

Verify

Fail closed with structured findings

Pass or fail, you get machine-readable output instead of log scraping. Agents can retry against findings[] without dumping broken code into your lap.

{
  "status": "passed",
  "envelope_schema_version": 3,
  "phase": "full",
  "msn_id": "MSN-0042",
  "mission_file_path": ".gitagent/missions/MSN-0042.ship-feature.yaml"
}

{
  "envelope_schema_version": 3,
  "failed_gate": "arch",
  "offending_file": "content/ad-bad.md",
  "line": 3,
  "severity": "error",
  "resolution_hint": "Import crosses layer boundary per TARGET_ARCHITECTURE.yaml"
}

After verify, gantry report is a read-only localhost triage view over the same snapshot — no re-running gates, no cloud upload.

How to read this

digest_ring — breaker slots; a highlighted slot means ABORT (same finding recurred; stop the repair loop).
Donut buckets are exclusive — KPI vs error/warning, never mixed in one slice.
Phase duration bars — where verify time went (gate, trace, perimeter).

gantry report overview with last verify, local ring breakdown, and verify history table — After verify: see last outcome, ring health, and every recent run — click through to findings without re-running gates.

FAIL drill-down with status panel, findings, and phase durations — FAIL — file, rule, and resolution hint in one card; gate log one tab away.

ABORT badge with highlighted digest-ring slot for GXT_FINDINGS_RECURRED — ABORT — same finding recurred; escalate to Planner instead of another repair loop.

PASS drill-down with status panel and phase durations — PASS — confirm gates and trace before you push; phase bars show where time went.


          $
          gantry report
        
          $
          gantry report --last
        
          $
          gantry report --json

Evidence

Hybrid hub and spoke

Execution stays on your machine (the spoke): missions, TMVC, cages, and gantry verify run locally with no cloud required. An optional future hub aggregates digest-only metadata — receipts and policy hashes, never source trees or gate stdout bodies.

Orchestration bus

Cold-path `gantry::verify` and hot-path `gantry::middleware` on buses like iii.dev — multi-worker graphs with promote-class gates. See `examples/iii-integration/` on GitHub.

Mission pin

`gantry pin [file]`, `gantry unpin` — active scope without stale branch drift.

Hash-only telemetry

`flight_telemetry.body_mode: hash_only` in `.gitagent/config.json` (default).

Attestation receipts

`gantry attest`, `gantry verify --receipt` — digest-only outcomes under `.gitagent/history/receipts/`.

Policy digest drift

`gantry doctor --policy <expected-digests.json>` offline against MANIFEST and config digests.

Audit trail detail Receipts, attestation, and review artifacts for compliance narratives.

Advisory performance judge

Deterministic gates cannot read your performance intent from docs. Ship PERFORMANCE.md + PERFORMANCE_RUBRIC.md, wire a BYO llm_verifiers command, run gantry scan, then gantry verify.

The judge checks structural strategies only — pooling, non-blocking I/O, memoization — never guessed millisecond latency. Verdicts are advisory: they appear as warnings and structured findings[] on PASS and never flip a failing gate to PASS.

See the performance judge example on GitHub. MCP tools (gxt_draft_legislation, gxt_verify, gxt_pin_mission) work with any MCP-capable harness — see the integration guide.

Features

How the pieces fit

Discover

Blueprint

Perimeter

Mission

Verify

A day with OpenGantry

The agent walked into a forbidden zone

Verify is not the same pass that edited

Release notes do not ship on vibes

The PR has a receipt, not a promise

A Tuesday

Pluggable domain adapters

Block architectural drift before it merges

Stop off-brand copy from shipping

Wire infra policy into the same verify contract

Your CI gates — now readable by agents

Block secrets and policy violations at the gate

Lock API contracts before agents ship breaking changes

Fail closed with structured findings

How to read this

Hybrid hub and spoke

Orchestration bus

Mission pin

Hash-only telemetry

Attestation receipts

Policy digest drift

Advisory performance judge