The latest articles on DEV Community by Nedal Elbaz (@nedalelbaz). https://dev.to/nedalelbaz https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4079015%2F331f7d50-ec26-4c2d-9a0d-f03050d0964e.png https://dev.to/nedalelbaz en Nedal Elbaz Sat, 15 Aug 2026 13:39:29 +0000 https://dev.to/nedalelbaz/vibe-fast-ship-with-proof-building-guardrails-for-ai-coding-agents-245l https://dev.to/nedalelbaz/vibe-fast-ship-with-proof-building-guardrails-for-ai-coding-agents-245l <p>AI coding agents (Codex, Claude Code, Cursor) are incredibly fast, but opaque. They make changes, run tests, maybe pass — but there's no structured, verifiable trail of what they did, what scope they touched, and what actually passed.</p> <p><strong>WorktreeProof</strong> is a local-first guardrail layer you wrap around any AI coding agent. It enforces an evidence-backed loop:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>plan → reserve → run → close </code></pre> </div> <ul> <li> <strong>Plan</strong> — one named lane, explicit file scope, named acceptance gate.</li> <li> <strong>Reserve</strong> — isolated Git worktree, conflict check, bounded lease.</li> <li> <strong>Run</strong> — your argv (no shell), bounded/redacted output.</li> <li> <strong>Close</strong> — validates a caller-supplied JSON receipt against the closure schema. No evidence = no close.</li> </ul> <p>No cloud, no account, no telemetry, zero runtime dependencies.</p> <h2> What makes it different </h2> <ol> <li> <strong>Immutable task contracts</strong> — frozen before the first mutation.</li> <li> <strong>SAFE-3 circuit breaker</strong> — freezes at 40 calls / 0 closures.</li> <li> <strong>Fixed terminal ledger</strong> — progress = <code>terminal_closed / terminal_total</code> only.</li> <li> <strong>Clean architecture</strong> — proof domain independent of Git/shell/browser adapters.</li> <li> <strong>Fail-closed CLI</strong> — <code>run</code> without a reservation → <code>ERR_PROTOCOL</code>.</li> <li> <strong>Portable Agent Skills</strong> — same state works with Codex and Claude Code; plus 5 OpenCode plugins (54 tools) and /goal /plan /task /review commands.</li> </ol> <h2> Release discipline </h2> <p>v0.4.0 is published with SBOM (CycloneDX), SHA256SUMS, release manifest, npm provenance, and green CI (Node 20/22 x ubuntu/windows, CodeQL, dependency review, Pages). Clean-install verified on Node 20/22/24.</p> <h2> Try it </h2> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>npm <span class="nb">install</span> <span class="nt">--global</span> github:Nedal7707/worktree-proof#v0.4.0 </code></pre> </div> <p>Or clone and run <code>install.bat</code> / <code>npm run setup</code> — one-click install for any agentic app: 286 skills, 54 tools, MCP wiring, and a complete gap-free workflow.</p> <p><strong>Repo:</strong> <a href="https://github.com/Nedal7707/worktree-proof" rel="noopener noreferrer">https://github.com/Nedal7707/worktree-proof</a><br> <strong>Docs:</strong> <a href="https://nedal7707.github.io/worktree-proof/" rel="noopener noreferrer">https://nedal7707.github.io/worktree-proof/</a><br> <strong>npm:</strong> <a href="https://www.npmjs.com/package/worktree-proof" rel="noopener noreferrer">https://www.npmjs.com/package/worktree-proof</a></p> <p>Apache-2.0, local-first, honest status: new project, 0 stars — but the engineering is the product.</p> agents ai git softwareengineering