RELEASE v0.21.0 • PURE GO 1.22+ • SPEC-DRIVEN DEVELOPMENT (SDD)

g8s (The Gatekeepers) — Zero-Trust Capability Harness for AI Agents

"k8s orchestrates your compute containers; g8s orchestrates your AI subagents." Enforce single-use path-scoped WriteReceipts, isolated Git worktrees, and orthogonal kernel firewalls across Claude Code, Cursor, Antigravity, OpenCode, and 9router workers.

1 : 1 : 1

Issue : Worker : Receipt

0% Burn

F0 Brain Quota Saved

F0 / F1 / F2

Containment Rings

S0 .. S3

Orthogonal Strata

▶ Test WriteReceipt Firewall github.com/tamld/g8s ↗ Inspect CLI Workflow →

quickstart — g8s supervisor loop go 1.22+ • sqlite-wal

# 1. Build & verify local harness health

$ make local && ./bin/g8s doctor --json

# 2. Issue a single-use path-scoped WriteReceipt (F0 Only)

$ REC=$(./bin/g8s receipt issue --path "internal/worker/*.go" --ttl 1800 --json | ./bin/g8s select data.receipt_id)

# 3. Submit bounded F1 worker task & execute in isolated Git worktree

$ TASK=$(./bin/g8s submit --idempotency-key slice-01 --permission workspace_write --role implementer --provider 9router --model deep-coding --receipt-id "$REC" --prompt "..." | ./bin/g8s select data.task_id)

$ ./bin/g8s worker --once --provider 9router --model deep-coding

# 4. Verify mechanical evidence & deliver worktree diff

$ ./bin/g8s verify --task "$TASK" --json && ./bin/g8s deliver "$TASK" --prune-worktree

Target Personas & Value Delivery

Built for 3 Distinct Engineering Consumers

Zero-Trust Delegation • Zero Quota Waste

1. AI Agent & Harness Engineers Builder / Operator

Stop Frontier Brain Quota Burn (Lesson #23)

Cloning your frontier F0 Brain model (Claude Opus / Gemini Pro) across N subagent coding loops burns your 5-hour quota to 0%. g8s keeps F0 strictly for reasoning and dispatches F1 coding/scouting loops through 9router SWE combos (deep-coding, reasoning-high, fast-agent).

✓ Outcome: 10× parallel worker throughput with 0% F0 quota exhaustion.

2. Platform & Security Architects Governance / Auditor

Eliminate Out-of-Scope Agent Mutations

Prompt instructions cannot stop a hallucinating agent from editing .env, CI workflows, or sibling packages. g8s enforces in-process WriteReceipt.AllowedPaths globs, SHA-256 CAS file guards, and kernel firewall strata (E_S1_DIRECT_MUTATION_FORBIDDEN).

✓ Outcome: Mathematical 1-1-1 boundary (1 Issue = 1 Worker = 1 Receipt).

3. Multi-Repo Maintainers & Leads Consumer / Adopter

Pull-Based Offer Bundle & Double-Blind QA

Onboard any repository in 60 seconds with g8s offer init across 4 domain profiles (knowledge, security, infra, utility) and defeat AI reviewer sycophancy using S3-A BlindAdjudicator verification packets.

✓ Outcome: Repo-agnostic CI spec-sync gates & sanitized Mode-3 defect packets.

Dedicated Architecture Blueprint • ADR-0032 & ADR-0035

Exponential Containment Rings (F0 / F1 / F2) × Control Strata (S0..S3)

Open Standalone SVG Asset ↗

F0 Brain / F1 Worktree CAS LeaseS3-M AllowedPaths Receipt ChannelS1/S3-A Mutation Firewall BlockThe g8s harness physically isolates every worker inside an ephemeral Git worktree and OS process group (Setpgid), stamping a single-use WriteReceipt before any file mutation can occur.

Ring F0 — Sovereign Brain

Exclusive holder of architecture authority, git commits, vault promotion, and WriteReceipt issuance (Operator ↔ F0 = 1-1).

Ring F1 — Isolated Worker

Spawned via g8s worker with SQLite WAL CAS lease, isolated Git worktree, killable OS PGID, and zero horizontal F1 ↔ F1 edges.

Ring F2 — Bounded Subagent

Spawned inside F1 (F2 ⊆ F1 ⊆ F0), inheriting G8S_RECEIPT_ID and G8S_SCOPE_ROOT. Invisible to F0 except via F1's sealed evidence.

Jev System-1 Reflex

Enforces Sensor ≠ Decider across L1 Pre-Mutation Triage, monotonic gate-lane routing (0/D/R/F/S), and 3-tier offline fallback.

Live Kernel Enforcement • POST /api/v1/g8s/verify-receipt

Interactive WriteReceipt & Orthogonal Stratum Firewall Playground

Select a preset or test custom Stratum + Path combinations

Ring Stratum Target Path

Developer Experience • Pure-Go Native Agent I/O (DELTA-23..45)

End-to-End CLI & MCP Execution Lifecycle

Zero-Trust Specification • DELTA-33 & DELTA-45

Orthogonal Control Strata Permission Matrix & Tech Stack

Stratum ID	Role Name	Containment Ring	Allowed CLI Capabilities	Kernel Firewall Invariant
S1	FederationCoordinator	F0 (Multi-Repo)	`g8s charter issue\|verify\|list`, `g8s fleet status`	Blocked from direct file write (`E_S1_DIRECT_MUTATION_FORBIDDEN`) & direct `g8s submit` (`E_STRATUM_ADJACENCY_VIOLATION`).
S2	DomainGovernor	F0 (Single-Repo)	`g8s receipt issue`, `g8s submit`, `g8s verify`, `g8s deliver`	Never runs raw log-hunting loops; delegates procedural coding/scouting to F1 workers.
S3-M	BoundedMutator	F1 / F2 Worktree	`g8s search`, `g8s read`, `g8s edit --if-sha256`	Strictly jailed to isolated Git worktree & `WriteReceipt.AllowedPaths` globs.
S3-A	BlindAdjudicator	F1 Disjoint Model	`g8s verify --task <id>`, `BlindReviewPacket`	Read-only; receives spec + raw diff + test output with worker identity stripped.
O-Plane	TelemetryProjector	F0 / Daemon	`g8s charter portfolio --json`, `g8s scorecard status`	Strictly observational projection; zero mutation or queue dispatch authority.