Production Projects

A state-of-the-art multi-agent coding harness rebuilt entirely on Claude Code, running on a large enterprise codebase with 10,000+ functions across 22 modules. Six independent layers, carried by eight instruments we built and measured, each on its own demo corpus: a 44.0% reversible tool-output token reduction, 2.1x fewer context tokens per edit, and an independent-judge gate that took task success from 0/3 to 3/3, each an instrument's own figure rather than a codebase-wide result. A companion to our GitHub Copilot Agent Pipelines project.

The same state-of-the-art multi-agent coding harness as our Claude Code build, moved onto a Claude Code orchestrator driving Pi-based workers, and run on a large enterprise codebase with 10,000+ functions across 22 modules. The hybrid recovers the one thing flat Claude Code cannot do, nested teams, and turns tool-output compression into a first-class runtime feature. The instrument figures are each measured on that instrument's own demo corpus: a 44.0% reversible token reduction, applied in-place by Pi's tool_result hook, 2.1x fewer context tokens per edit, and an independent-judge gate that took task success from 0/3 to 3/3. A companion to our Claude Code and GitHub Copilot Agent Pipelines writeups.

The same state-of-the-art multi-agent coding harness as our Claude Code and Claude plus Pi builds, moved onto OpenAI Codex, where the orchestrator leaves the agent entirely: an external OpenAI Agents SDK or Pydantic AI v2 process drives Codex as an MCP server in a star topology. Run on a large enterprise codebase with 10,000+ functions across 22 modules, with a two-ring security model (advisory hooks inside an OS sandbox boundary) and native OTLP tracing bridged to LangSmith. The instrument layer carries its own demo-corpus figures: a 44.0% reversible tool-output token reduction and an independent-judge gate that took task success from 0/3 to 3/3. A companion to our Claude Code, Claude plus Pi, and GitHub Copilot Agent Pipelines writeups.

The same state-of-the-art multi-agent coding harness as our Claude Code and Codex builds, moved onto OpenCode: an external TypeScript SDK conductor drives OpenCode over a headless server, with the orchestrator outside the agent graph. Run on a large enterprise codebase with 10,000+ functions across 22 modules, with a real per-agent permission frame (allow / ask / deny) as the enforcement boundary, broad model-agnostic routing, and experimental OTEL bridged to LangSmith. The instrument layer carries its own demo-corpus figures: a 44.0% reversible tool-output token reduction and an independent-judge gate that took task success from 0/3 to 3/3. A companion to our Claude Code, Codex, and GitHub Copilot Agent Pipelines writeups.

The final runtime in the series: the same state-of-the-art multi-agent coding harness moved onto Cursor, the two-tier, IDE-first variant. A driver (in-IDE, the cursor-agent CLI, or the TypeScript SDK) dispatches seven stage subagents, each in its own native git worktree, and every action crosses a hooks.json policy plane. Run on a large enterprise codebase with 10,000+ functions across 22 modules, with native worktree isolation, an allow / deny / ask policy layer that is a real boundary, and a bolt-on LangSmith trace spine. The instrument layer carries its own demo-corpus figures: a 44.0% reversible tool-output token reduction and an independent-judge gate that took task success from 0/3 to 3/3. The fifth and final companion to our Claude Code, Claude plus Pi, Codex, OpenCode, and GitHub Copilot Agent Pipelines writeups.

Seven specialized Copilot agents that form a structured development workflow for a legacy Servoy enterprise application with 10,000+ functions, 1,000+ files, and 22 modules. Neo4j graph-powered code intelligence, cross-model orchestration, and a self-improving knowledge loop where every code review makes every agent smarter.

Describe a report in plain English, get a printable Apache Velocity PDF in under 90 seconds. Multi-section invoices, statements, and summaries with a vision-aware feedback chat that takes screenshots as input. Same AI pipeline that powered the dashboards, now driving page-perfect documents.

An AI-powered system that converts plain English questions into complete six-card Metabase dashboards in under 30 seconds, 100% SQL success rate on a 90.5-million-row production database, embeddable in any React application via the Metabase SDK.

Type a question, get a six-card dashboard rendered with native React charts in under 30 seconds, no Metabase, no Java, no BI server. 100% SQL success rate against a 90.5-million-row production database.

A RAG-based document assistant that ingests 51,000+ chunks across 4 file formats, answers natural language questions in under 3 seconds using hybrid search with cross-encoder re-ranking, and required zero frontend changes to transform from a single-purpose chatbot into a general-purpose document platform.

AI agents that attack each other to find vulnerabilities. Red Team probes, Blue Team defends, a Referee scores both -- all using Claude Code with worktree isolation. Two rounds of live exercises against a real target drove ASR from 65% CRITICAL to 47% HIGH, with a regression wave proving patches hold at 20% and an escalation wave exposing architectural gaps at 85.7%.

Claude Code already writes a JSONL transcript of every session to disk. TraceKit harvests it into two deliverables no one else produces from that data: a cost-attribution curve that shows where the token bill actually goes, and a reliability scorecard that grades the agent's trajectory in SRE terms. No LangChain, no harness changes, no API calls on the default path. On a bundled real session it measured a 70:1 input-to-output token ratio; its trajectory grader caught 17 of 17 injected process faults an output-only check could not see.

A full-stack RAG application that transforms YouTube videos into interconnected Obsidian notes -- 1,000+ notes, 2,757 auto-generated links, 5,000 searchable chunks, and a chatbot with 2.5s latency, all for $1.50.

An automated job search system that monitors 1,975 companies across 11 ATS platforms, processes 58,807 jobs weekly through a 6-phase AI pipeline, and delivers 311 qualified matches for $5.04 per run.

An agent swarm that builds agent swarms. A 12-step pipeline where Claude Code agents analyze any codebase and generate complete Claude Code infrastructure -- agent teams, hooks, skills, and slash commands -- in 30-55 minutes. Three production migrations validated. The second was harder but faster.

The dominant cost in a coding-agent session is not the user prompt, it is the output of tool calls: file reads, git status, test runs, JSON blobs. ContextLedger compresses that output before it reaches the model, caches the original so nothing is lost, and gives the model a retrieve(id) escape hatch. It unifies three patterns the field arrived at independently (RTK's shell compression, Headroom's reversible Compress-Cache-Retrieve, Code Mode's typed-tool execution). On a real 127-payload dev session it measured a 44.0% tool-output token reduction, fully reversible.

Self-critique in the same context does not work, because the agent rationalizes the path it already took. RubricGate hands a fresh-context grader only the rubric and the artifact, returns a per-criterion pass/gap breakdown with evidence, and loops the producing agent on the gaps until the deliverable clears the bar. A deterministic code tier runs first; the LLM judge only fires on what code cannot decide. On a three-deliverable benchmark it lifted task success from 0/3 to 3/3, and one tested core drives four surfaces: CLI, Python, Claude Code, and the Agent SDK.

A 10-step agent workflow at 90% per-step reliability completes end-to-end only about 35% of the time. This middleware sits on the seam between an agent and its tools and recovers, transparently to the model, from the four failure modes that silently kill production runs: a hallucinated tool name, a transient tool error, a stuck reasoning loop, and an oversized tool payload. Every signal is mechanical, so the core needs no model SDK and no secondary judge. On a seeded fault-injection benchmark it recovered 24 of 24 runs that would otherwise have failed, 100%, a number this repo prints on a re-run rather than borrowing from anyone's stage testimony.

An agent marks itself done by producing plausible output that satisfies no real standard, and a small early miss compounds into an end-of-task failure. Prompts cannot fix this. The Deterministic Gate Harness makes the definition-of-done a code-evaluated gate, not an instruction: each phase runs, its gate is checked, an evidence record is written to a durable store, and only then does the workflow advance. One role, the reviewer, is structurally barred from reviewing its own output. On a 6-document fault-injection benchmark, zero phases advanced without a passing, evidence-backed gate across 6 gated runs, while the same workflow ungated shipped 4 broken artifacts to publish. The core imports no Claude Code and no LangChain primitive.

An agent editing an unfamiliar large repo spends most of its context budget locating the code before it can change a line. MapKit scaffolds a per-folder AGENTS.md navigation map, writes the interop shim Claude Code actually needs, keeps the map current after every edit, and ships a token-accounting harness that proves the payoff. On its own worked sample repo across 8 stated edits, the map roughly halves the context loaded per edit: 2.1x fewer tokens (53 percent less) with the exact tiktoken counter, cross-checked at 2.3x with a dependency-free heuristic. It is an honest integration-and-measurement build on the upstream DOX pattern, not a new invention, with zero infrastructure and no model SDK.

Enterprises in regulated industries do not grant an agent write access on day one. They climb a ladder: read-only, then auto-route, then sandboxed remediation, then live action, and every promotion has to be earned. Trust-Ladder Deployer operationalizes that climb. It binds the tool set and approval policy at each rung, logs every action tagged with the rung it ran at, gates each promotion on an eval that actually blocks a seeded regression, isolates rung-3 fixes in a real sandbox replica, and auto-demotes to a safer rung the moment measured accuracy drifts. On the bundled demo the auto-demote kept 7 bad writes out of production that an un-monitored baseline let through, and the promotion gate blocked an agent at 0.720 accuracy against a 0.950 bar.

A naive agent forgets every session and repeats the same mistake at a constant rate. FlywheelKit harvests the findings from a completed session or PR review into typed proposals, a human gates the handful that would change future behaviour, and a surgical applier lands only the approved additions to your plain-Markdown skills and wiki without ever rewriting them. On its offline worked demo it compounded a skill's gotchas from 1 to 4 across three harvests, blocked a plausible-but-wrong rewrite at the gate, and turned a failure that recurs on an un-fed baseline into one that is blocked on the next run, all under a tested invariant of zero un-gated writes to live knowledge.

Any pipeline that feeds public-facing product data to an LLM opens a prompt-injection surface, and the attacker never needs to touch the model: a payload hidden in a log line or a fake bug report rides ordinary telemetry into the agent's context window. ingest-guard is a fast, model-agnostic filter that sits at the ingest boundary and drops adversarial payloads before a triage, research, or remediation agent reads them. It normalizes the text, runs one versioned deterministic pattern set, escalates only the undecided residue to an optional LLM classifier, and logs every decision. On the project's own seeded corpus of 40 attacks and 40 benign signals, the keyless deterministic core blocks 85.0% of injections at 0.0% false positives with zero payloads leaked; the optional classifier tier takes detection to 90.0% at the same zero false-positive floor.

A text-to-SQL agent in a multi-tenant SaaS must never show tenant A a single row of tenant B's data, and a prompt-rule-plus-regex validator cannot guarantee that, because it trusts a probabilistic model to behave. We rebuilt the guarantee structurally: identity enters the system exactly once, from a cryptographically verified JWT claim, the model only ever sees a server-side parameterized CTE sandbox scoped to that claim, and every cache key binds to the same verified identity. Our own adversarial harness ran 605 scoped queries across three admins: 0 cross-tenant rows returned, all 19 probes across 6 attack classes blocked, and a jailbroken SELECT against a warehouse base table that sails through the seven-point validator dies at execution, because the table is structurally absent from the sandbox.

Every client with regulated data has the same unanswered question: what is actually in our documents that must never be pasted into a cloud model? They cannot answer it by uploading the documents to a tool, because that is the exact act they are trying to prevent. Faraday resolves the circularity: an open-weight model on a local machine whose network is verifiably, provably down reads the documents and reports the exposures, and every capability claim is scored against Microsoft Presidio, the free regex + NER baseline. The measured result: 26-28 of the 29 contextual exposures Presidio catches none of (contextual recall 0.90-0.97 across sessions, runs, and GGUF builds), at 0.00 false positives per clean document in every recorded run versus Presidio's 1.90, backed by a committed zero-packet capture spanning a live scan.

A chat front door on the txtToSql engine, with its own re-runnable number: 15 chat-driven queries, 0 cross-tenant rows, tenants disjoint, live under Claude Opus 4.8 and a deterministic mock. A Vercel Eve agent (TypeScript, Node 24) lets a tenant's ops team ask in plain English in Discord and get an answer scoped to exactly that tenant's rows. The multi-tenant guarantee is supplied entirely by the finished Python isolation core over a one-way seam, so no isolation logic is reimplemented in TypeScript, and the verified bearer token is the only identity that crosses into the core.