ArgusBot

The deciding trait is that finishing is not the model's decision. A separate reviewer has to say the work is done and the acceptance checks have to pass, and until both happen the thing keeps going. For a task with a real definition of done, that is the difference between coming back to a result and coming back to an apology.

For anything fuzzy it is worse than useless, because the loop has no way to recognise a goal it cannot test. Pick it for well-specified work with a suite behind it. Pick a hands-on session for anything you would have to explain twice.

The dealbreaker is documented by the authors. When the daemon starts a run, it starts it with approvals disabled, and the project's own text names that as dangerous in a workspace you do not trust. Combine it with a supervisor whose whole design is to keep retrying until something passes, and the tool that never gives up is also the tool that never asks.

What it does right is admit it. A README that names its own worst default is more useful than a landing page that does not mention defaults at all.

1. Separating the actor from the judge is the right decomposition, and constraining the judge to three enumerated outcomes rather than free text makes the control flow inspectable. 2. A planner holding a live plan between sessions is a reasonable answer to context loss across restarts. 3. The weakness is that the reviewer is the same class of model as the worker, so correlated errors are not caught by the arrangement.

2. No evaluation accompanies the design, so the claim that this converges rather than oscillates remains an assertion.

There is nothing to value and that is the honest reading. Permissive licence, a single author, a few hundred stars, no hosted tier and no commercial surface anywhere in the repository. The product is an idea about how supervision should work, and ideas of that shape get absorbed by whichever funded harness reads the README first.

Moat: none, and none available to a wrapper around two vendor CLIs. Likely path: the pattern ships inside a bigger tool and this repository goes quiet. Position: borrow the design, do not build a team habit on the implementation.

The operational picture is what stops this. Long-running work is started, steered and killed from a consumer messaging app, which means the identity attached to a production change is a chat account rather than a corporate one. There is no single sign-on, no provisioning, no retention policy and no audit trail I could show a reviewer six months later.

Multiplied across sixty engineers, the licence cost stays zero and the model spend becomes unpredictable, because the loop decides for itself how many attempts it needs. Not yet.

This is Python I install in editable mode from a checkout, which is the shape I like: the supervisor logic, the reviewer's rules and the planner's prompt are all files I can open and change before the second run. Permissive licence means a fork stays legal, and the whole thing is small enough that forking is a real option rather than a threat.

It brings no protocol of its own. Tool servers get wired into whichever backend CLI is doing the work, and this layer never sees them. Fine by me, as long as nobody claims otherwise.