I Built a Self-Hosted AI Engineering Team That Won't Push Code Without My Approval

Описание и применение

Создана безопасная, самодостаточная система AI‑команды, где агенты пишут код в изолированном окружении, проходят многоступенчатую проверку и требуют ручного одобрения перед публикацией.

Задача

AI coding agents often ship incorrect or insecure changes without human oversight, leading to broken code, accidental leaks, and unsafe dependencies.

Результат

Implemented a secure, model-agnostic AI coding pipeline that prevents accidental pushes, catches secrets and unstable dependencies, and requires human approval before integration.

Рабочий процесс

• Define task and handoff notes
• Planner reads code and notes, writes plan with files, acceptance criteria, and risks
• Coder writes code in its own Git worktree
• Quick checks validate secrets, syntax, debug leftovers, and dependency stability
• If checks fail, coder revises code
• Reviewer reviews requirements, crashes, tests, and agreement up to 3 rounds
• UI and security critics run app, capture screenshots, and evaluate UI/security changes
• Git agent creates commit and PR
• Human approves via dashboard
• Branch is pushed to GitHub

Доказательства

Agents run inside the coding harness's sandbox (Landlock/bwrap on Linux).

Источник

The Planner reads the code, the project's handoff notes, and team memory, then writes a plan with files, acceptance criteria, and risks before any code is touched.

Источник

Quick checks catch secrets, broken JSON/YAML/JS, debug leftovers, and risky new dependencies with plain code, no model call.

Источник