Agent Ship-Check

Is your agent safe to put in front of real users?

See the sequence See real sample reports ↗

Free & open · no signup · read-only — every stage ends by asking · nothing leaves your machine

Why this sequence

Before an agent touches real users: guarded, evaluated, supervised, affordable.

The map

Run it in order

The conductor fetches each brief in turn and writes its report before moving on — later briefs can build on earlier findings. Or copy any single stage to run it alone.

35Guardrails AuditGUARDRAILS.mdAgent

34Eval Coverage AuditEVALS.mdAgent

43Human-in-the-Loop PlacementHITL.mdAI-UX

38Token Economics AuditTOKENS.mdAgent

what you'll have at the end

4 reports in reports/, plus the run's own INDEX.md: GUARDRAILS.md, EVALS.md, HITL.md, TOKENS.md. Feed them to the optional Studio to turn findings into commits, or run 28 · Roadmap Synthesis to merge them into one plan.

Get started

One paste runs the whole thing

Copy the conductor into your agent inside the repo you want checked. It runs each Goal Prompt in sequence, honoring each one's ask-first rule.

View raw ↗

In this playbook

The 4 briefs

35 · Agent

Guardrails Audit

A defensive review of your agent's blast radius — injection paths, unvalidated outputs, over-broad permissions, ungated irreversible actions.

34 · Agent

Eval Coverage Audit

The test-gap audit for nondeterminism — golden sets, regression evals, judge quality, and the drift between eval and production.

43 · AI-UX

Human-in-the-Loop Placement

Approval gates audited for rubber-stamp fatigue and silent damage — who reviews what, when, with enough context to actually judge.

38 · Agent

Token Economics Audit

Cost per completed task, not per call — retry waste, context bloat priced out, cache leverage, and the margin math.

# Playbook: Agent Ship-Check (conductor)

You are working inside this repo. Mission: execute the **Agent Ship-Check** playbook — 4 audit briefs in sequence, each producing one report file in the repo's `reports/` directory.

Before an agent touches real users: guarded, evaluated, supervised, affordable.

## Before stage 1
- If `CHARTER.md` exists at the repo root or in `reports/`, read it first — its goals, non-goals, and invariants bound every recommendation in every stage. No charter? Proceed, and suggest 149 · The Charter afterwards.
- If there is no `reports/` directory at the repo root, create it now — every brief writes its report there once the directory exists, so the whole run lands in one folder instead of scattering generic filenames across the root.
- Before fetching stage 1, tell the operator in plain words what this playbook will do — one line per stage — and ask for the go-ahead.
- In a git repo, plan to commit as you go — one commit per report plus a final one for the index; make committing part of the go-ahead question, and skip it only if the operator says no.

## How to run each stage, in order
1. Fetch the brief with a read-only web request (for example: curl -s <url>).
2. If your harness can run subagents or fresh sessions, run each stage in one — a stage needs only the earlier report files at the repo root and in `reports/`, never this conversation.
3. Execute it exactly as written. Every brief is read-only toward the codebase; its only write is its own report file.
4. Confirm the report file exists (at the repo root or in `reports/`) before moving on, and stamp one provenance line under its title — `<playbook> · stage <N>/<M> · brief <id>` — so the file itself names the run that wrote it.
5. If committing, commit the report now, message `reports: <FILE> — <stage title> (<playbook> <N>/<M>)` — that per-stage trail is what lets any later session recover the whole run with one git log --grep.
6. After each stage, tell the operator in two or three plain sentences what it found — the single biggest finding and why it matters for this repo — and what comes next; never advance in silence.
7. Proceed to the next stage. Do not parallelize — later briefs may draw on earlier reports.

## Stages
1. **35 · Guardrails Audit** — fetch https://goal-prompts.vercel.app/raw/35.md → writes `GUARDRAILS.md`
2. **34 · Eval Coverage Audit** — fetch https://goal-prompts.vercel.app/raw/34.md → writes `EVALS.md`
3. **43 · Human-in-the-Loop Placement** — fetch https://goal-prompts.vercel.app/raw/43.md → writes `HITL.md`
4. **38 · Token Economics Audit** — fetch https://goal-prompts.vercel.app/raw/38.md → writes `TOKENS.md`

## After the final stage
- Write the run's index — `INDEX.md`, in the same directory as the reports (commit it last, if committing): the run date, the playbook name, each stage with its brief URL, and one line per report — file name, finding count (mark a null report as such), and its top two or three next steps. A session with no memory of this run must be able to start from that one file.
- Present the strongest findings across every report as one ranked list, in plain words — each with why it matters for this repo; the operator should not need to open a report file to act.
- Then ask which findings to fix. Unless 47 · The Fixer already ran as a stage of this playbook, offer to fetch https://goal-prompts.vercel.app/raw/47.md and implement exactly the operator's picks — one verified commit per finding. The report files stay on disk as the paper trail.
- Prefer a merged plan instead? Fetch https://goal-prompts.vercel.app/raw/28.md (Roadmap Synthesis) to fold the reports at the repo root and in `reports/` into one sequenced plan.
- Close with the handoff: if the run sits on an unmerged branch, offer to open a pull request titled `reports: <playbook> run <date> (<M> stages)` whose body is the index — the PR list is the first place a later session or teammate looks; either way, print a paste-ready handoff block naming the branch, the report directory, the file list, and `INDEX.md` as the place to start.

## Rules
- If a fetch fails, retry once; if it still fails, use the locally installed /goal:<slug> (or /goal-<slug>) command or the goal-prompts MCP get_brief tool for that stage; if neither exists, say so and stop — never improvise a brief from memory.
- Honor each brief's own rules, including ending by asking before any changes.
- If a stage's report already exists (at the repo root or in `reports/`), ask whether to re-run or skip that stage.
- A conductor caps at 16 stages — for a longer campaign, split it into two conductors and run them back-to-back.