Stop babysitting your AI coding agent.

What it stops

• Secrets in git. lint_secrets.py runs before a commit and fails on hard-coded Stripe, GitHub, AWS, Slack, OpenAI and Anthropic keys and private keys. It found a live Stripe secret in this store's own repo (below).
• Instructions that point nowhere. lint_directives.py fails when CLAUDE.md or a directive references a script or directive that does not exist. It caught the kit's own CLAUDE.md doing that before release.
• Risky shell commands, before they run. In Claude Code, the kit's guard_bash.py hook blocks a commit while the secrets linter finds a key, --no-verify, force-push, rm -r on /, ~ or the project root, and an ad-hoc pip install requests that never reaches requirements.txt. The agent sees why and what to do instead.
• "Fixes" that only hide the failure. The bug-fix standard makes the agent name the root cause and add a test that fails before the fix (plus a written rule when it is a pattern); the operating principles treat a retry, reset or reprocess as recovery, never as the fix.

The hook on real commands (captured 2026-11-07)

A throwaway git repo with the kit's hooks/ and the example settings.json, Claude Code 2.1.312. Output unedited except for line wrapping. The last part is headless Claude Code, told to run pip install requests and not to work around a block.

$ pip install requests
[guard_bash] ad-hoc `pip install requests` blocked: the package would be
missing from the requirements file, so the next machine (CI, prod) breaks.
Add it to requirements.txt (or pyproject.toml) with a version pin, then
`pip install -r requirements.txt`. Set AOK_ALLOW_ADHOC_PIP=1 to allow this
per project.
exit 2

$ git push --force origin main
[guard_bash] force-push blocked: it can delete commits on the remote. Use
`git push --force-with-lease` after checking `git log origin/<branch>..`,
or ask the human.
exit 2

$ git push --force-with-lease origin main
exit 0

# claude -p, after the block:
A project hook (`hooks/guard_bash.py`) blocked `pip install requests`,
because a package installed ad hoc wouldn't be listed in a requirements
file and CI or prod would then break. Instead, I'd add `requests` with a
version pin to `requirements.txt` (or `pyproject.toml`) and run
`pip install -r requirements.txt`, which is what the hook asks for, or you
could set `AOK_ALLOW_ADHOC_PIP=1` if you really want a one-off install.

Why agents fail on real work

A model that's 90 % reliable per step is 59 % reliable over five steps. Real tasks are ten to fifty steps. If the agent executes everything itself — fetching, parsing, transforming, deploying — compounding error does the rest, and you end up watching it.

D.O.E. moves everything with a right answer into tested code and leaves the agent exactly one job: deciding what to run next. Then it makes the system self-annealing — every failure becomes a test, a rule, and a lint, so month three is dramatically better than week one.

What's inside (42 files)

File tree

agent-ops-kit-v1/
  START-HERE.md
  CLAUDE.md
  LICENSE.txt
  CHANGELOG.md
  directives/
    00_template.md
    core/operating-principles.md
    core/self-annealing-loop.md
    core/bug-fix-standard.md
    core/agent-governance.md
    examples/deploy_service.md
    examples/qa_website.md
    examples/scrape_website.md

  executions/
    00_template.py
    lint_directives.py
    lint_secrets.py
    anneal.py
    qa_website.py
    deploy_service.py
    scrape_website.py
    tests/ (4 test files, 24 tests)
  hooks/guard_bash.py
        settings.example.json
  cursor/rules/doe-core.mdc
        python-fastapi.mdc · linux-deploy.mdc
  stacks/fastapi-python-linux/CLAUDE.md
  skills/qa-test · deploy · project-status
  agents/pm-agent.md · worker-agent.md
         registry.example.json
  docs/why-doe.md · adopting-doe.md
       running-a-fleet.md

Two real findings from building this very store

A live Stripe secret turned up hard-coded in an old helper script in the seller's own repo. lint_secrets.py now runs before every commit there — and lint_directives.py caught the kit's own CLAUDE.md pointing at a directive that didn't exist:

$ py executions/lint_secrets.py
ERROR executions/create_links.py:3: stripe live secret
lint_secrets: FAIL (1 findings)

$ py executions/lint_directives.py
ERROR CLAUDE.md: references directives/scrape_website.md which does not exist
lint_directives: FAIL (7 directives, 1 errors)

(Both fixed before release. The kit itself passes both linters, and a test runs the directive linter on it.)

Who it's for

FAQ

Publish Gate v1: check AI-assisted posts before they go out

The gate this store's own agent runs before it posts anything. verify_post.py checks a draft against your facts.md and voice.md: stock AI phrases and your own banned list, numbers that are not in your facts file, dead links, checkout links without utm_source, then an LLM claim-by-claim check. If the LLM is unreachable the gate fails; it never passes unverified. A PASS writes the draft's sha256, and the publishers refuse a draft that changed after it passed.

Same terms as the kit: instant download, 14-day refund, license for projects you own or work on. The bundle is both zips unchanged in one download.