{
  "markdown": "# ADE Bootstrapper\n\n[![CI](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/ci.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/ci.yml)\n[![CodeQL](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/codeql.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/codeql.yml)\n[![SAST (OpenGrep)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/sast-opengrep.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/sast-opengrep.yml)\n[![Vulnerability Scan](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/vuln-scan.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/vuln-scan.yml)\n[![Secret Scan](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/secrets-scan.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/secrets-scan.yml)\n[![SBOM](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/sbom.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/sbom.yml)\n[![Fuzz](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/fuzz.yml/badge.svg)](https://github.com/p4gs/ADE-Bootstrapper/actions/workflows/fuzz.yml)\n[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/p4gs/ADE-Bootstrapper/badge)](https://securityscorecards.dev/viewer/?uri=github.com/p4gs/ADE-Bootstrapper)\n[![Dependabot enabled](https://img.shields.io/badge/dependabot-enabled-brightgreen.svg)](https://docs.github.com/en/code-security/dependabot)\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)\n\n> Every badge above tracks a workflow that actually runs in *this* repo's GitHub\n> Actions on `main` — not a static claim. No SLSA-provenance badge yet: the\n> `release-slsa.yml` workflow exists and is reasoned through, but no release has\n> been cut, so there is nothing yet to point the badge at without it being an\n> unverified claim. For the live score breakdown, see the\n> [Scorecard viewer](https://securityscorecards.dev/viewer/?uri=github.com/p4gs/ADE-Bootstrapper).\n\n**Bootstrap a secure, high-quality, operationally trustworthy Agentic Development\nEnvironment (ADE)** for AI coding harnesses — Claude Code, Codex, Cursor, OpenCode,\nAntigravity, Hermes, and Pi.\n\nOne command stands up opinionated, secure-by-default guardrails, governance, and\nverification around your coding harness — as plain files in your repo, with no control\nplane, no telemetry, and nothing listening on any port.\n\n**v0.2 is a single static Rust binary** plus two native macOS apps:\n\n- **`ade`** — the CLI (~3 MB, no runtime, no interpreter, no dependencies to install)\n- **ADE Control Center.app** — a native GUI (egui) to see every capability on your\n  machine: what's installed, what's running, versions, warnings/errors — and to\n  install / uninstall / reinstall / update each one, toggle capabilities, and manage\n  per-project modules\n- **ADE Status.app** — a menu-bar helper showing live aggregate health with a\n  per-capability dropdown\n\n```\ncargo build --release          # or grab a release binary\n./target/release/ade init /path/to/your/repo\n./target/release/ade gui install   # macOS: apps + menu-bar agent + ~/.local/bin/ade\n```\n\n## What you get from `ade init`\n\n- `ade.json` — unified, schema-versioned config (every module on by default)\n- `.ade/policy/*.json` — the policy layer: dependencies, sandbox, approvals, secrets,\n  git, budget, context-trust, token-efficiency\n- `.ade/guardrails/*.md` — secure-coding rules wired into every harness\n- `.ade/instructions.md` — the generated baseline (module blocks), translated into\n  `CLAUDE.md`, `AGENTS.md`, and `.cursor/rules/ade.mdc` inside managed markers\n  (your content outside the markers is never touched)\n- `.ade/instructions.local.md` — **your** project instructions: created once, never\n  overwritten, appended to every harness's managed block\n- `.ade/audit/log.jsonl` — hash-chained audit log, checkpointed in the lockfile\n  (`ade audit verify` detects edits, truncation, and re-forged chains)\n- `ade.lock.json` — deterministic lockfile making the whole setup verifiable\n  (`ade verify`) on any machine, including files planted into the `.ade/` tree\n- A pre-commit secret scan (TruffleHog) that actually blocks committing verified secrets\n- **Runtime-free hooks**: harness hooks (audit logging, injection scanning) invoke the\n  `ade` binary directly — target repos need no JS runtime, and each hook costs\n  milliseconds on the paths that run per-commit and per-tool-call\n\n## Commands\n\n| Command | What it does |\n|---------|--------------|\n| `ade init [dir]` | Bootstrap: detect environment → config → apply modules → lockfile |\n| `ade plan` | Dry-run — prints every action, writes nothing |\n| `ade apply` | Idempotent re-apply of all enabled modules |\n| `ade verify` | Verify on-disk state against lockfile + canonical instructions + module checks |\n| `ade doctor` | Tool/harness/environment health report |\n| `ade status` | Per-module state summary |\n| `ade modules` | List the 15 modules and enabled state |\n| `ade translate` | Regenerate harness instruction files from `.ade/instructions.md` |\n| `ade lock` | Regenerate the lockfile |\n| `ade audit verify` | Validate the audit log hash chain |\n| `ade remove` | Withdraw ade from the repo — prints the plan; `--yes` carries it out |\n| `ade gui install` | macOS: install the Control Center + menu-bar apps and agent |\n| `ade gui uninstall` | Remove the apps and agent |\n| `ade gui status` | Menu-bar agent launchd state |\n| `ade hook append` | (wired by modules) append a harness hook event to the audit chain |\n| `ade hook scan` | (wired by modules) scan stdin for prompt-injection patterns |\n\nAll commands accept `--dir <path>` and `--json` (pure JSON on stdout, logs on stderr).\nExit codes: `0` success · `1` failure · `2` usage error.\n\n## The Control Center\n\nThe GUI is a **native Rust app** (egui — no webview, no browser, no Electron) driven\nentirely in-process by the same `ade-core` engine as the CLI. **Nothing listens on any\nport**: there is no local server, no HTTP, no IPC daemon.\n\n- **Capabilities** — every integrated tool and harness CLI: installed state, version,\n  latest available version (checked only when you click *Check for Updates* — never\n  automatically), running state, and per-capability warnings/errors with concrete\n  remediation. Install / Update / Reinstall / Uninstall run as supervised jobs with\n  captured logs (uninstall asks for confirmation). Tools without a trustworthy\n  automated recipe are honestly labeled *manual* with guidance instead of guessing\n  package names.\n- **Machine-level enable/disable** — a per-capability toggle persisted in\n  `~/.ade/gui.json`. Honest semantics: this greys the capability and mutes its\n  warnings machine-wide; the *enforcing* toggle remains each repo's `ade.json`.\n- **Projects** — register any ade-bootstrapped repo: per-module toggles (a toggle\n  edits `ade.json` through the validated loader, re-applies, re-locks, and re-verifies),\n  module findings, and verify results.\n- **Activity** — every job with live status and full captured output.\n- **A clean exit** — `ade remove` (and *Remove ADE…* on a project) restores the\n  repo to exactly how it was before `ade init`: files deleted, managed blocks\n  excised, co-owned JSON un-merged, a chained git hook put back. Anything ade\n  cannot prove it wrote — your edits, your files — is kept and reported instead.\n\nThe menu-bar helper refreshes detection on a bounded budget (it can never hang the\nmenu bar), renders a status dot (green/amber/red), and lists every capability with\ncore-formatted labels — adding a capability never requires touching the apps.\n\n## The 15 modules (spec component → module id)\n\n| Spec component | Module | Integrates |\n|----------------|--------|-----------|\n| Secure-by-default coding guardrails | `guardrails` | Project CodeGuard-style ruleset |\n| Software supply chain security | `supply-chain` | osv-scanner, lockfile policy, AI-native deps |\n| AI-native sandboxing | `sandbox` | nono, harness permission surfaces |\n| Codebase context management | `context` | OpenWiki + CocoIndex, codemap fallback |\n| Performance & quality scaffolding | `scaffolding` | PR/testing/commit conventions |\n| Network-syncable agent memory | `memory` | OpenMemory / Mem0 MCP (opt-in) |\n| Prompt injection & context poisoning defenses | `injection-defense` | trust policy + scanner hook |\n| Harness configuration governance | `config-governance` | managed-block translation + drift detection |\n| Tamper-evident observability & audit logging | `observability` | hash-chained JSONL + harness hooks |\n| Human-in-the-loop approval gates | `approval-gates` | harness permission mapping |\n| Secrets & credential hygiene | `secrets` | TruffleHog, pre-commit |\n| Git & repository hygiene | `git-hygiene` | OCEAN, git config, protected-branch policy |\n| Cost & token budget governance | `cost-governance` | budget + model-routing policy |\n| Reproducible environment & lockfiles | `reproducibility` | environment manifest |\n| Token efficiency | `token-efficiency` | RTK at the shell boundary |\n\nEvery module is individually disableable in `ade.json` (`modules.<id>.enabled: false`) —\nsecure-by-default means disabling is the explicit act.\n\n## Architecture (v0.2)\n\n```\ncrates/\n  ade-core/            the engine: config, lockfile, audit chain, managed blocks,\n                       instructions/translate, 15 modules, 7 harness adapters,\n                       pipelines, reports, GUI data layer (inventory/jobs/state)\n  ade/                 the CLI binary\n  ade-control-center/  native GUI (egui/eframe + AccessKit)\n  ade-status/          menu-bar helper\nsrc/ + tests/          the TypeScript v0.1 reference implementation — kept as the\n                       EXECUTABLE SPECIFICATION; scripts/parity-check.sh proves the\n                       Rust port produces byte-identical artifacts (modulo a closed,\n                       documented allowlist) and that v0.1-bootstrapped repos migrate\n                       cleanly under the Rust binary\n```\n\nThe port is verified three ways: a differential harness (byte-comparing full bootstrap\ntrees against the oracle), replays of the v0.1 adversarial-audit attacks (audit-log\ntruncation/tail-drop/re-forge, managed-marker clobbering, planted-file detection), and\ncross-version interop (the Rust binary appends to and verifies TS-written audit chains).\n\n## What the guarantees actually mean\n\nHonesty about scope is a feature; these are the limits of each claim:\n\n- **Audit log — hash-chained + lockfile-checkpointed.** Every entry commits to its\n  predecessor, and `ade apply` pins the chain's length and head hash into\n  `ade.lock.json` (which you commit to git). In-place edits, truncation, tail-drops,\n  and chains re-forged from the public genesis anchor are all detected. Residual\n  limit: an attacker who rewrites the log *and* the committed lockfile together.\n- **Secret blocking is verified-findings only.** The pre-commit gate blocks secrets\n  TruffleHog can *verify*; unverifiable candidates warn.\n- **Enforcement differs per harness.** Harnesses with permission/hook surfaces\n  (Claude Code) get real wiring; the rest get policy files + instruction blocks, and\n  the docs say which is which.\n- **The GUI never acts on its own.** No auto-updates, no scheduled jobs, no network\n  calls except the package-manager subprocesses you explicitly trigger.\n\n## Security\n\nFound a vulnerability? See [SECURITY.md](SECURITY.md) for how to report it privately.\n",
  "bytes": 11539,
  "sha": "c419a9bfb766a1c3218709eff58f14e61f24f69b4feff64b37d99052a9bb3892",
  "repo_slug": "p4gs/ade-bootstrapper",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_p4gs_ade_bootstrapper_openwiki_index_md_d98faad4/readme"
}