The product

catesworks/agent-ops holds the dispatch and revision workflows, the dispatch scripts in scripts/dispatch/ and the eval rubrics in references/evals/. Both workflows run on the self-hosted runner and take thin workflow_dispatch inputs that never carry task text or secrets.

A stateless AWS Lambda, kept in the separate agent-ops-infra repo, receives org webhooks. It turns a Project board move into a dispatch run, and a comment on an open agent-ops pull request into a revision run.

One self-hosted macOS runner executes every dispatch and revision for every target repo. scripts/install-runner.sh registers it as a launchd service. ADR 0004 defines when the runner pool should grow.

An org-wide GitHub App mints a short-lived installation token scoped to the target repo for each run. The App’s private key is read at run time from 1Password with a service account token, not stored in the workflow.

Claude runs through the implement tool of mcp-agent-bridge, an always-on local MCP server, and every eval runs through its review tool. Codex runs as codex exec in a workspace-write sandbox. Copilot is declared but fails fast because it is not supported.

The onboard-repo-to-agent-ops skill makes a repo dispatchable. It checks App coverage, creates the four labels, links the repo to the Project board and can write knowledge-base/config.yml. It only adds: it never removes or overwrites existing automation, and it adds no workflow files to the target repo.