Features

OpenGantry is a local CLI that scopes agent edits before they touch your repo. One verify contract for agentic graphs and IDE sessions — adapter rules differ, outcomes are always structured JSON. It is not Gantry.io and it does not chat on your behalf.

Get started Documentation

Cage

Cage the agent you already use

No manifest, no gantry init. Start your agent inside gantry cage exactly as you normally would; it restores a built-in protected set while the session runs and once more at exit.

Restores while it runs

About once a second, cage puts back changes to CI configs, .env / .env.*, .git/config, git hooks and manifest forbidden_zones. Lockfile changes are listed and kept.

Refuses the push

Inside the session, git push is refused when outgoing commits touch protected paths, and the agent sees why. Nothing is written to your repo.

Halts a fight

An agent that rewrites the same protected file after three restores is terminated with everything it spawned. Exit 4; tune with --contest-limit.

Your own rules

.cage.yaml adds paths and globs (migrations, IaC, key files). It can only add protection, protects itself, and fails closed on anything else. gantry cage suggest proposes entries for review.

Survives being stopped

SIGTERM or SIGHUP on cage terminates the agent's process tree, then restores. After a kill -9, the next cage run recovers from a hash-verified journal before it starts.

One report

Quiet while the agent works: a bell per restore, events in a temp-dir log. At exit one summary, exit 3 if anything was restored, or --json for a digest-only report.


            $
            npx @jeger-ai/opengantry-cage -- claude
          
            $
            gantry cage -- aider
          
            $
            gantry cage suggest --write

Cage restores; it does not block. A change can be committed in the second before the next check, git push --no-verify skips the push guard, and a committed change stays in local history. Reads, network calls and writes outside the protected set are not seen. For scope enforced on every write, use missions.

Step zero Full cage reference

Workflow

How the pieces fit

Scan what is already there, turn findings into enforceable rules, legislate each change, then prove pass at every gate. Discovery proposes — blueprint, perimeter, missions, and verify enforce.

Discover

Scan the repo and collect file:line evidence — nothing becomes law yet.

The scanner writes .gitagent/discovery-proposal.json with concrete anchors (imports, patterns, layer hints). Review or accept before blueprint turns findings into enforceable rules.

Domain-aware scans: gantry init --discover --domain code|content
Evidence is proposals — hooks do not enforce until blueprint or manual acceptance
Agents use output to draft missions with realistic TMVC roots


            $
            gantry init --discover --domain code
          
            $
            gantry blueprint --domain code --yes

Blueprint

Turn proposals into architecture docs and a verification plan.

Blueprint materializes ARCHITECTURE.md, TARGET_ARCHITECTURE.yaml, and .gitagent/verification_plan.json — gate commands, skills, and perimeter rules your team can diff in Git.

Maps discovery evidence to layer rules and adapter hooks
Sets default gate_command candidates per skill in the foreman map
Human review before --yes — same contract as mission legislation


            $
            gantry blueprint --domain code --yes

Skip discovery in mature repos — legislate missions directly once MANIFEST and architecture exist.

Perimeter

Adapter rules enforce boundaries before and during execution.

Code adapters check import layers; content adapters apply forbid/require regex. Failures return file, line, and rule id — agents read structured output instead of guessing why a path was blocked.

gantry arch check for code layer violations
Content missions scope content/** with regex policy adapters
Perimeter runs inside verify and at dedicated arch gates


            $
            gantry arch check
          
            $
            gantry perimeter check

Mission

Legislate TMVC roots and gate_command in mission YAML.

Each change gets an MSN file: allowed paths, forbidden zones, trace rows, and the shell gate verify must pass. Pin the mission so hooks, MCP tools, and runtime exec share the same scope.

Planner commits [MSN-XXXX] before executors edit
gantry pin + runtime env load scope into the agent subprocess
One mission can span a pipeline graph — same YAML for every worker hop


            $
            gantry legislate "Ship feature" --msn MSN-0042 --skill-key gantry --gate-command "npm test"
          
            $
            gantry pin .gitagent/missions/MSN-0042.ship-feature.yaml

Interactive orchestration: gantry start … opens the same MSN contract in a guided session.

Verify

Prove pass with structured JSON — fail closed.

gantry verify reruns gates, checks Planner legislation, and maps PASS rows to committed EXECUTOR_LOG.md quotes. Chat cannot override a failing verdict.

gantry context-feed --json → compact findings[] for model re-entry (offending_file, hint, gate_log_path)
gantry verify --json → full debug payload (stdout/stderr allowed)
gantry verify --format sarif and --format junit → CI documents. Diagnostics go to stderr. The document is the only stdout payload.
gantry report → localhost triage after verify: last outcome, local run history, drill-down to findings and gate logs (no re-run, no cloud)
Optional --receipt for digest-only attestation history
Same envelope for IDE sessions, CI stages, and orchestration bus workers


            $
            gantry verify
          
            $
            gantry context-feed --json
          
            $
            gantry report
          
            $
            gantry verify --json
          
            $
            gantry verify --format sarif
          
            $
            gantry verify --format junit

In practice

A day with OpenGantry

Composite scenes from how OpenGantry is used.

Staff engineer

The agent walked into a forbidden zone

I pinned MSN-0042 and let the session run. It tried to rewrite .gitagent/foreman/MANIFEST.json. Runtime failed closed. findings[] named the path. The next hop stayed in src/cli/.

gantry pin · TMVC deny

Tech lead

Verify is not the same pass that edited

I will not rubber-stamp a chat transcript. The executor appends PASS rows to EXECUTOR_LOG.md. Those rows have to quote the gate output. gantry verify maps every claim. A missing quote fails the mission.

SOD · verbatim PASS quotes

Docs lead

Release notes do not ship on vibes

The content adapter scopes src/content/. The agent drafted a changelog that sounded fine and failed the docs build. That build is the gate_command. Nothing publishes until verify is green.

content domain · docs build gate

Security lead

The PR has a receipt, not a promise

Review is a mission YAML, a quote in EXECUTOR_LOG.md, and an optional attest file under .gitagent/history/receipts/. I keep the verify JSON. I do not keep a screenshot of a model saying it was careful.

attest receipt · verify JSON

A Tuesday

Legislate, pin, hit a forbidden zone, retry inside TMVC, then prove it with verify JSON.

~/your-repo · tuesday

$ gantry legislate "ship ingest retry" --msn MSN-0042 --skill-key gantry

$ gantry pin .gitagent/missions/MSN-0042.ship-ingest-retry.yaml

$ eval "$(gantry runtime env)"

TMVC deny .gitagent/foreman/MANIFEST.json

retry inside src/cli/, then:

$ gantry verify --json

{"ok": true,"trace": "mapped"}

gate: perimeter · trace: mapped

Domains

Pluggable domain adapters

One verify graph. Pluggable rules. Built-in code and content adapters ship today; CI, security, infra, API contracts, and other stacks hang on the same mission YAML plus gate_command — scope, trace, and structured pass/fail never change.

Block architectural drift before it merges

Agents shortcut through private modules, smuggle forbidden SDKs into core layers, and widen public surface area you never approved. The built-in code adapter turns your repo graph into binary perimeter rules — gantry arch check fails closed with offending_file, line, and resolution_hint.

Forbid src/cli/** from importing src/server/internal/**
Block @aws-sdk/* outside your infrastructure layer
Pin a mission to src/features/checkout/** — nothing else moves

Stop off-brand copy from shipping

Docs, HTML, and release notes are attack surface. The content adapter applies forbid/require regex across your publishing tree — deterministic, byte-identical reruns, no statistical guessing that flips when unrelated files change.

Forbid unsubstantiated health claims in content/**
Require FDA disclaimer blocks on regulated product pages
Reject agent drafts that drop your trademark or legal footer

Wire infra policy into the same verify contract

Terraform drift, K8s policy violations, and IaC hallucinations merge like code — unless you gate them. Point missions at infra/**, run terraform validate or your policy CLI as gate_command, and ship structured findings[] to the agent bus.

gate_command: terraform validate scoped to infra/terraform/**
Block agent edits to k8s/production/** without infra MSN pin
Pair OPA or conftest output with trace quotes for audit replay

Your CI gates — now readable by agents

You already run tests and linters in CI. OpenGantry does not replace them — it scopes the mission, runs the same gate_command locally before commit, and returns structured findings[] so agents retry against a stable envelope instead of stderr soup. Structured producers fill offending_file and line; generic gates emit a coarse row plus gate_log_path on the context-feed.

gate_command: npm test on a mission pinned to src/features/**
gate_command: npm run lint && npm run typecheck before merge
Trace verbatim PASS lines from the test gate in EXECUTOR_LOG.md

Block secrets and policy violations at the gate

Agents paste API keys, bump vulnerable deps, and bypass security review when nothing fails closed. Hang secret scanners and dependency policy on gate_command — same scope, trace, and structured verdict as every other domain.

gate_command: gitleaks detect before any agent commit lands
Fail missions that touch secrets/** without platform-security MSN
npm audit --audit-level=high as gate on dependency bump missions

Lock API contracts before agents ship breaking changes

OpenAPI drift and broken client contracts are architectural failures. Scope missions to api/** or contracts/**, run schema diff or contract tests as gate_command, and reject merges when the public surface moves without approval.

gate_command: npm run openapi:diff on public API MSNs
Forbid handler edits outside src/routes/public/** during refactors
Contract tests as gate before agent-generated SDK changes merge

Verify

Fail closed with structured findings

Pass or fail, you get machine-readable output instead of log scraping. Agents can retry against findings[] without dumping broken code into your lap.

{
  "status": "passed",
  "envelope_schema_version": 3,
  "phase": "full",
  "msn_id": "MSN-0042",
  "mission_file_path": ".gitagent/missions/MSN-0042.ship-feature.yaml"
}

{
  "envelope_schema_version": 3,
  "failed_gate": "arch",
  "offending_file": "content/ad-bad.md",
  "line": 3,
  "severity": "error",
  "resolution_hint": "Import crosses layer boundary per TARGET_ARCHITECTURE.yaml"
}

After verify, gantry report is a read-only localhost triage view over the same snapshot — no re-running gates, no cloud upload.

How to read this

digest_ring — breaker slots; a highlighted slot means ABORT (same finding recurred; stop the repair loop).
Donut buckets are exclusive — KPI vs error/warning, never mixed in one slice.
Phase duration bars — where verify time went (gate, trace, perimeter).

gantry report overview with last verify, local ring breakdown, and verify history table — After verify: see last outcome, ring health, and every recent run — click through to findings without re-running gates.

FAIL drill-down: status panel above the findings card with file, rule, and resolution hint — FAIL — file, rule, and resolution hint in one card; gate log one tab away.

ABORT drill-down: status panel above the circuit breaker with a highlighted digest-ring slot — ABORT — same finding recurred; escalate to Planner instead of another repair loop.

PASS drill-down: status panel above phase duration bars — PASS — confirm gates and trace before you push; phase bars show where time went.


            $
            gantry report
          
            $
            gantry report --last
          
            $
            gantry report --json

Evidence

Hybrid hub and spoke

Execution stays on your machine (the spoke): missions, TMVC, gantry cage, org policy, ledger, and gantry verify run locally with no cloud required. A hub remains optional for digest-only aggregation — receipts and policy hashes, never source trees or gate stdout bodies.

Orchestration bus

Cold-path gantry::verify and hot-path gantry::middleware on buses like iii.dev — multi-worker graphs with promote-class gates. See examples/iii-integration/ on GitHub.

Mission pin

gantry pin [file], gantry unpin — active scope without stale branch drift.

Hash-only telemetry

flight_telemetry.body_mode: hash_only in .gitagent/config.json (default).

Attestation receipts

gantry attest, gantry verify --receipt — digest-only outcomes under .gitagent/history/receipts/.

Policy digest drift

gantry doctor --policy <expected-digests.json> offline against MANIFEST and config digests.

Policy bundle (tighten-only)

gantry policy pull pins a signed org ORG-POLICY.yaml. Merge is a floor — never loosens local law. Doctor/verify stay offline (ADR-0042).

refs/gxt/ledger

Digest-only orphan chain. gantry ledger verify / export --format soc2-pack. Unsigned entries are checksums, not proofs (ADR-0043).

depends_on

Cross-repo mission gates from fetched ledger refs. gantry deps fetch then offline deps check / release check (ADR-0044).

Audit trail detail Receipts, attestation, and review artifacts for compliance narratives.

Advisory performance judge

Deterministic gates cannot read your performance intent from docs. Ship PERFORMANCE.md + PERFORMANCE_RUBRIC.md, wire a BYO llm_verifiers command, run gantry scan, then gantry verify.

The judge checks structural strategies only — pooling, non-blocking I/O, memoization — never guessed millisecond latency. Verdicts are advisory: they appear as warnings and structured findings[] on PASS and never flip a failing gate to PASS.

See the performance judge example on GitHub. MCP tools (gxt_draft_legislation, gxt_verify, gxt_pin_mission) work with any MCP-capable harness — see the integration guide.

Experimental contract preflight

gantry contract preflight and MCP gxt_preflight_contract suggest a skill_key and tmvc_roots before propose. They do not seal a contract. The classifier reads every skill from MANIFEST.json — description and roots — with no hard-coded skill list.

Jev is optional and fail-open. The fetch limit is 2000ms. A timeout, or any non-OK HTTP status including 500, falls back to the offline heuristic and does not crash the agent loop. A missing TYPESAFE_API_KEY is an explicit error before any fetch.

See the Jev preflight example and the capabilities doc. CI export flags are in CI / CD.