covener 0.1.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (46) hide show
  1. covener-0.1.0/.gitignore +13 -0
  2. covener-0.1.0/CHANGELOG.md +21 -0
  3. covener-0.1.0/LICENSE +21 -0
  4. covener-0.1.0/PKG-INFO +476 -0
  5. covener-0.1.0/README.md +433 -0
  6. covener-0.1.0/pyproject.toml +81 -0
  7. covener-0.1.0/src/covener/__init__.py +6 -0
  8. covener-0.1.0/src/covener/adapters/__init__.py +26 -0
  9. covener-0.1.0/src/covener/adapters/base.py +192 -0
  10. covener-0.1.0/src/covener/adapters/claude.py +96 -0
  11. covener-0.1.0/src/covener/adapters/cursor.py +33 -0
  12. covener-0.1.0/src/covener/cli.py +146 -0
  13. covener-0.1.0/src/covener/config.py +111 -0
  14. covener-0.1.0/src/covener/frontmatter.py +51 -0
  15. covener-0.1.0/src/covener/init.py +288 -0
  16. covener-0.1.0/src/covener/knowledge/__init__.py +12 -0
  17. covener-0.1.0/src/covener/knowledge/citations.py +171 -0
  18. covener-0.1.0/src/covener/knowledge/cli.py +74 -0
  19. covener-0.1.0/src/covener/knowledge/convert.py +193 -0
  20. covener-0.1.0/src/covener/knowledge/mcp_server.py +40 -0
  21. covener-0.1.0/src/covener/knowledge/oracle.py +306 -0
  22. covener-0.1.0/src/covener/mcp_server.py +58 -0
  23. covener-0.1.0/src/covener/repo.py +428 -0
  24. covener-0.1.0/src/covener/resources/__init__.py +1 -0
  25. covener-0.1.0/src/covener/resources/agents/engineer.md +44 -0
  26. covener-0.1.0/src/covener/resources/agents/planner.md +55 -0
  27. covener-0.1.0/src/covener/resources/agents/product.md +62 -0
  28. covener-0.1.0/src/covener/resources/agents/qa.md +33 -0
  29. covener-0.1.0/src/covener/resources/agents/reviewer.md +41 -0
  30. covener-0.1.0/src/covener/resources/framework/instructions.md +40 -0
  31. covener-0.1.0/src/covener/resources/framework/states.yaml +41 -0
  32. covener-0.1.0/src/covener/resources/templates/bug.md +20 -0
  33. covener-0.1.0/src/covener/resources/templates/spec.md +28 -0
  34. covener-0.1.0/src/covener/resources/templates/sprint.md +17 -0
  35. covener-0.1.0/src/covener/resources/templates/task.md +22 -0
  36. covener-0.1.0/src/covener/resources/templates/vision.md +21 -0
  37. covener-0.1.0/src/covener/resources/templates/work.md +10 -0
  38. covener-0.1.0/src/covener/roles.py +17 -0
  39. covener-0.1.0/src/covener/states.py +37 -0
  40. covener-0.1.0/src/covener/status.py +185 -0
  41. covener-0.1.0/src/covener/validate.py +205 -0
  42. covener-0.1.0/tests/conftest.py +146 -0
  43. covener-0.1.0/tests/test_core.py +89 -0
  44. covener-0.1.0/tests/test_init.py +171 -0
  45. covener-0.1.0/tests/test_knowledge.py +163 -0
  46. covener-0.1.0/tests/test_status.py +242 -0
@@ -0,0 +1,13 @@
1
+ __pycache__/
2
+ *.pyc
3
+ .venv/
4
+ venv/
5
+ dist/
6
+ build/
7
+ *.egg-info/
8
+ .pytest_cache/
9
+ .mypy_cache/
10
+ .ruff_cache/
11
+ .DS_Store
12
+ CLAUDE.local.md
13
+ .covener/knowledge/
@@ -0,0 +1,21 @@
1
+ # Changelog
2
+
3
+ ## [0.1.0] - 2026-09-12
4
+
5
+ ### Added
6
+ - Project Knowledge (`covener knowledge build | ask | serve`): sources in `knowledge/` converted to
7
+ page-anchored Markdown, `INDEX.md`, a deterministic citation graph (`CITATIONS.md`), and the optional
8
+ Knowledge Oracle (LightRAG graph + vectors, Claude + Voyage) served as one MCP tool, `search_knowledge`,
9
+ returning answer, relations and evidence. `references:` field on specs and bugs, validated by `status`.
10
+ - `covener serve`: one local MCP server exposing `status`, `search_knowledge` and `list_knowledge_sources`
11
+ to Claude Code, Cursor and any MCP client; registered by `init` when the `mcp` extra is installed.
12
+ - `covener init` (`--tools`, `--dry-run`, `--install-agents`): the Covener structure, the default
13
+ team, `AGENTS.md` integration that never overwrites, `CLAUDE.md` import, and `.claude/agents` /
14
+ `.cursor/agents` as links to `agents/` (junctions or copies where symlinks are unavailable).
15
+ - `covener status` (`--json`, `--verbose`, `--strict`): derived backlog by epic and priority, open
16
+ sprints with work states and task progress, done list, consistency errors that protect human
17
+ approval, and what to do next.
18
+ - Five-agent default team (product, planner, engineer, qa, reviewer), one Markdown file each.
19
+ - One file per spec, bug or task; living specs (editing a done spec reopens it); sprints with one work
20
+ log per item (checklist, entries, human feedback); bugs first in the backlog, then priority; hotfix as
21
+ a one-bug sprint; closed sprints archived by date.
covener-0.1.0/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Covener contributors
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
covener-0.1.0/PKG-INFO ADDED
@@ -0,0 +1,476 @@
1
+ Metadata-Version: 2.5
2
+ Name: covener
3
+ Version: 0.1.0
4
+ Summary: Spec-driven development for AI agent teams. Governance for regulated domains and large projects: traceable, auditable, human-approved.
5
+ Project-URL: Homepage, https://github.com/ajmorenodelarosa/covener
6
+ Project-URL: Documentation, https://github.com/ajmorenodelarosa/covener#readme
7
+ Author: ajmorenodelarosa
8
+ License: MIT
9
+ License-File: LICENSE
10
+ Keywords: agents-md,ai-agents,claude-code,compliance,cursor,governance,graphrag,knowledge-graph,llm,mcp,spec-driven-development
11
+ Classifier: Development Status :: 4 - Beta
12
+ Classifier: Environment :: Console
13
+ Classifier: Intended Audience :: Developers
14
+ Classifier: License :: OSI Approved :: MIT License
15
+ Classifier: Operating System :: OS Independent
16
+ Classifier: Programming Language :: Python :: 3
17
+ Classifier: Programming Language :: Python :: 3.10
18
+ Classifier: Programming Language :: Python :: 3.11
19
+ Classifier: Programming Language :: Python :: 3.12
20
+ Classifier: Programming Language :: Python :: 3.13
21
+ Classifier: Topic :: Software Development
22
+ Requires-Python: >=3.10
23
+ Requires-Dist: pyyaml>=6.0
24
+ Provides-Extra: dev
25
+ Requires-Dist: mcp>=2.0; extra == 'dev'
26
+ Requires-Dist: mypy>=1.10; extra == 'dev'
27
+ Requires-Dist: pypdf>=6.1; extra == 'dev'
28
+ Requires-Dist: pytest>=8.0; extra == 'dev'
29
+ Requires-Dist: ruff>=0.5; extra == 'dev'
30
+ Requires-Dist: types-pyyaml; extra == 'dev'
31
+ Provides-Extra: knowledge
32
+ Requires-Dist: pypdf>=6.1; extra == 'knowledge'
33
+ Provides-Extra: mcp
34
+ Requires-Dist: mcp>=2.0; extra == 'mcp'
35
+ Provides-Extra: oracle
36
+ Requires-Dist: anthropic>=1.0; extra == 'oracle'
37
+ Requires-Dist: lightrag-hku>=1.5.7; extra == 'oracle'
38
+ Requires-Dist: mcp>=2.0; extra == 'oracle'
39
+ Requires-Dist: numpy>=1.24; extra == 'oracle'
40
+ Requires-Dist: pypdf>=6.1; extra == 'oracle'
41
+ Requires-Dist: voyageai>=0.5; extra == 'oracle'
42
+ Description-Content-Type: text/markdown
43
+
44
+ <div align="center">
45
+
46
+ # Covener
47
+
48
+ **Spec-driven development for AI agent teams.**<br>
49
+ Governance for regulated domains and large projects: traceable, auditable, human-approved.
50
+
51
+ [![CI](https://github.com/ajmorenodelarosa/covener/actions/workflows/ci.yml/badge.svg)](https://github.com/ajmorenodelarosa/covener/actions/workflows/ci.yml)
52
+ [![PyPI](https://img.shields.io/pypi/v/covener.svg)](https://pypi.org/project/covener/)
53
+ [![Python](https://img.shields.io/badge/python-3.10%2B-blue.svg)](https://pypi.org/project/covener/)
54
+ [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
55
+
56
+ ```bash
57
+ pip install covener && covener init
58
+ ```
59
+
60
+ </div>
61
+
62
+ ---
63
+
64
+ Covener is a repository layout, a deterministic checker and a set of agent definitions that turn
65
+ Claude Code, Cursor or any tool that reads `AGENTS.md` into a development team you can govern.
66
+
67
+ - **Specifications, bugs and tasks are files** with a status. What the product is, where it
68
+ deviates, and what has to be done never mix and never grow.
69
+ - **Sprints hold the work**: one work log per item with a checklist, the agents' summaries,
70
+ decisions and reviews, and your feedback. Closed sprints are archived; nothing is stored twice.
71
+ - **Approval is a rule in a file.** An item is `done` only when a human wrote `Approved: Yes` in its
72
+ work log. `covener status --strict` fails CI when that rule, or any consistency rule, is broken.
73
+ - **Knowledge is evidence.** Regulations, contracts and procedures in `knowledge/` become a
74
+ page-anchored corpus with a citation graph and an optional semantic graph; agents cite
75
+ `file#page-N`, reviewers verify, and `status` flags dangling references.
76
+ - **Nothing runs a server, calls a model or needs the package** once initialised. Two commands for
77
+ the method, one for knowledge, one to expose both as MCP tools.
78
+
79
+ ## Why Covener
80
+
81
+ Spec-driven development tools stop at the spec. spec-kit generates a pile of Markdown per feature
82
+ and numbers features so that two developers branching on the same day collide. Kiro writes
83
+ requirements, design and tasks, then treats them as launch documents that drift as soon as code
84
+ changes. BMAD answers the problem with a dozen personas and the process overhead that comes with
85
+ them. OpenSpec tracks changes well, but a spec is still just text an agent can declare done. None of
86
+ them keeps the decisions made while building, none makes human approval something a machine can
87
+ verify, and none can tell you which article of which regulation a requirement comes from.
88
+
89
+ Covener does all three. **Every decision, review and human comment is written next to the item it
90
+ belongs to**, so a new session starts from the record instead of from zero. **An item is done only
91
+ when a person wrote `Approved: Yes`**, and `covener status --strict` fails CI otherwise, which makes
92
+ the approval something an auditor can rely on rather than a line in a prompt. **Requirements that
93
+ come from regulations cite their evidence page by page**, backed by a citation graph built without a
94
+ model, so nothing about a law can be hallucinated. It does this with two files per item, five roles
95
+ with hard boundaries, sprints that never collide across a team, and a layout you can explain in a
96
+ minute.
97
+
98
+ ## How it works
99
+
100
+ ```bash
101
+ cd my-project
102
+ covener init # links the agents into Claude Code and Cursor; never overwrites your files
103
+ ```
104
+
105
+ Then talk to the team in your IDE:
106
+
107
+ > I want customers to connect their Stripe account and receive payments.
108
+
109
+ | Step | Role | What happens in the repository |
110
+ |---|---|---|
111
+ | 1 | product | Reads `specs/vision.md` and the existing specs, reports the impact, drafts `specs/stripe-connect.md` with acceptance criteria and, when a regulation applies, `references:` to the evidence. You set `status: approved`. |
112
+ | 2 | planner | Opens `sprints/payments-onboarding/` with the spec (and open bugs first) and writes the checklist in the work log. |
113
+ | 3 | engineer, qa, reviewer | Implement, test against the criteria, review architecture, security and compliance. Each writes its entry in the work log. |
114
+ | 4 | planner | Sets the sprint to `review` and tells you what to evaluate. |
115
+ | 5 | you | `Approved: No` with what to change, or `Approved: Yes`. |
116
+ | 6 | planner | Reworks until you approve, marks the spec `done`, archives the sprint. |
117
+
118
+ ```bash
119
+ covener status # backlog, sprints, inconsistencies, what to do next
120
+ ```
121
+
122
+ ## Repository layout
123
+
124
+ ```
125
+ specs/vision.md product intent
126
+ specs/<id>.md what the product is: one living file per spec (draft -> approved -> done)
127
+ bugs/<id>.md what is wrong (open -> done)
128
+ tasks/<id>.md work that changes neither: migrations, refactors, upgrades (open -> done)
129
+ sprints/<name>/sprint.md owner, status, specs, bugs and tasks in scope (active -> review -> closed)
130
+ sprints/<name>/<kind>s/<id>.md the item's work log: checklist, summary, decisions, QA, review, feedback
131
+ sprints/archive/YYYY-MM-DD-<name>/ closed sprints
132
+ knowledge/ optional: domain documents, their Markdown, INDEX.md, CITATIONS.md
133
+ agents/<name>.md one file per agent; .claude/agents and .cursor/agents link here
134
+ AGENTS.md a small block every coding agent reads (CLAUDE.md imports it)
135
+ .covener/config.yaml role to agent mapping and tools; nothing else
136
+ ```
137
+
138
+ Domain folders are fine: `specs/payments/stripe-connect.md` has the id `payments/stripe-connect`.
139
+
140
+ **Which folder?** If in a year someone must read it to know what the product is, it is a spec. If
141
+ it describes something that is wrong today, it is a bug. If they only need to know it was done, it
142
+ is a task. Specs are living documents: to extend, change or remove a requirement, edit the spec, it
143
+ goes back to `draft`, approve it again, and a sprint carries the change. Its history is the sprints
144
+ that touched it.
145
+
146
+ **No backlog file.** The backlog is every open bug, approved spec and open task that is not in an
147
+ open sprint: bugs first, then everything by two optional front matter fields, `priority` and `epic`.
148
+ Reprioritising is a one-line change in one file, so a team never fights over a list.
149
+
150
+ ## The work log
151
+
152
+ `sprints/<name>/specs/<id>.md` (or `bugs/<id>.md`, `tasks/<id>.md`) is a chronological log. Agents
153
+ add entries; you add one.
154
+
155
+ ```markdown
156
+ # stripe-connect
157
+
158
+ ## Checklist
159
+ - [x] onboarding endpoint
160
+ - [x] token refresh
161
+ - [ ] operator docs
162
+
163
+ ## Summary
164
+ Implemented in payments/onboarding.py; 6 tests in tests/test_onboarding.py.
165
+
166
+ ## Decisions
167
+ - 2026-09-12 Store the Stripe account id, not the token; tokens are fetched on demand.
168
+
169
+ ## QA
170
+ Verdict: pass
171
+ - AC1 test_onboarding_starts, AC2 test_reconnect_expired, AC3 manual check on staging.
172
+
173
+ ## Review
174
+ Verdict: pass with notes
175
+ - medium: retry on 429 missing in payments/client.py:41; add backoff.
176
+
177
+ ## Feedback
178
+ Approved: No
179
+ Also handle a revoked authorization, not only an expired one.
180
+
181
+ ## Rework
182
+ Added revocation handling and a test.
183
+
184
+ ## Feedback
185
+ Approved: Yes
186
+ ```
187
+
188
+ The last entry is the state: awaiting feedback, changes requested or approved (the checklist does
189
+ not count). `covener status` derives everything from this file.
190
+
191
+ ## `covener status`
192
+
193
+ ```
194
+ Covener
195
+
196
+ Product
197
+ Vision: OK
198
+
199
+ Specs
200
+ Total: 4
201
+ Draft: 1
202
+ Approved: 2
203
+ Done: 1
204
+
205
+ Bugs
206
+ Total: 2
207
+ Open: 2
208
+ Done: 0
209
+
210
+ Tasks
211
+ Total: 1
212
+ Open: 1
213
+ Done: 0
214
+
215
+ Backlog
216
+ Items: 3
217
+ [bugs]
218
+ - wrong-currency (priority 1)
219
+ [platform]
220
+ - task migrate-postgres (priority 1)
221
+ [payments]
222
+ - spec refunds (priority 2)
223
+
224
+ Sprints
225
+ payments-onboarding (review, alvaro): approved 1/2
226
+ - spec stripe-connect: awaiting feedback, checklist 5/6
227
+ - bug expired-tokens: approved, checklist 2/2
228
+
229
+ Done
230
+ - spec reporting-api (2026-09-10-reporting-v1 2026-09-10)
231
+
232
+ Governance
233
+ Pending human review: 1
234
+ Pending spec approval: 1
235
+ Errors: 0
236
+ Warnings: 0
237
+
238
+ Next
239
+ * Review and approve specs/ideas.md (draft)
240
+ * Give feedback on spec stripe-connect in sprints/payments-onboarding/specs/stripe-connect.md
241
+ ```
242
+
243
+ `--json` for machines, `--verbose` for warnings, `--strict` to fail CI on errors. No model is
244
+ involved; it only reads files.
245
+
246
+ Errors are the rules that protect your authority and the repository's consistency: an item `done`
247
+ without your `Approved: Yes`; a sprint `closed` with unapproved work; an item in two open sprints; a
248
+ draft spec, a done item or an unknown id in an open sprint; an open sprint in the archive; invalid
249
+ statuses or unparsable files; a missing vision; a configured agent without a definition. Closed
250
+ sprints are history: only the approval rule applies to them, so a spec that later changes never
251
+ breaks CI. A second open sprint for the same owner is a warning, not an error: that is what a
252
+ hotfix looks like.
253
+
254
+ ## Working in a team
255
+
256
+ One sprint, one owner, one branch, one pull request. Git isolates parallel work; Covener makes the
257
+ rules checkable.
258
+
259
+ - Name sprints by what they deliver (`payments-onboarding`), never by number: sequential numbers
260
+ collide the moment two people branch.
261
+ - The owner is a field in `sprint.md`. One open sprint per owner is the norm; an item is in at most
262
+ one open sprint. `covener status` flags both after a merge.
263
+ - Specs, bugs and tasks are one file each, so two people rarely touch the same one. Approval is in
264
+ the file.
265
+ - History is the archive of closed sprints plus `status: done` in the item. Archive after the pull
266
+ request merges. Everything is committed; nothing is personal or ignored.
267
+
268
+ ## Bugs, tasks and hotfixes
269
+
270
+ A **bug** is a deviation from the product. A **fix** is the change that corrects it. A **hotfix** is
271
+ a fix that cannot wait. A **task** is work that leaves no requirement behind. The words stay apart;
272
+ the flow stays the same.
273
+
274
+ | Situation | Flow |
275
+ |---|---|
276
+ | Trivial fix (one place, no design decision) | "Fix this." The engineer fixes it with a test and tells you. No file, no sprint. |
277
+ | Bug worth tracking | "This is the problem." Product registers `bugs/<id>.md` (symptom, reproduction, cause if known, expected behaviour), `open` from the start: a bug is reported, not approved. It waits at the top of the backlog for the next sprint; an active sprint's scope does not change. |
278
+ | Hotfix | Same, but the planner opens a one-bug sprint now (`sprints/hotfix-<slug>/`) and the cycle runs in an hour: regression test, fix, QA, review, your `Approved: Yes`, archive. |
279
+ | Technical work | "Migrate to Postgres." The planner registers `tasks/<id>.md` (goal, why, scope, done-when, risk and rollback), `open` from the start. Same cycle; QA verifies the done-when and that no spec regressed. If the work leaves a durable requirement ("data lives in Postgres"), it is a spec instead. |
280
+
281
+ Bugs and tasks never touch a spec. If a bug reveals the spec was wrong, or a task changes what the
282
+ product promises, that is a separate change to the spec.
283
+
284
+ ## Project Knowledge
285
+
286
+ Regulated products depend on documents nobody reads twice: laws, contracts, procedures, internal
287
+ standards. Covener makes them a first-class input with evidence, so an agent never writes "the
288
+ regulation says" from memory.
289
+
290
+ ```bash
291
+ pip install "covener[oracle]" # "covener[knowledge]" for the deterministic layer only
292
+ cp ~/regulations/*.pdf knowledge/
293
+ covener knowledge build # incremental: only new or changed documents are processed
294
+ ```
295
+
296
+ **Deterministic layer**, no model, no network. Every source becomes Markdown with `## Page N`
297
+ headings next to it; `knowledge/INDEX.md` lists the corpus; `knowledge/CITATIONS.md` is the graph of
298
+ explicit cross-references between documents, resolved to the documents in the corpus. Patterns cover
299
+ EU regulations and directives and Spanish-language public law today; adding a jurisdiction is one
300
+ regular expression. Nothing in this layer can be hallucinated.
301
+
302
+ **Knowledge Oracle**, optional. A graph of entities and relationships plus vector retrieval over the
303
+ same Markdown, built with a frontier model and stored as local files (LightRAG: NetworkX graph,
304
+ nano-vectordb, no server). One tool, `search_knowledge`, returns answer, relations and evidence with
305
+ `knowledge/<file>.md#page-N` references. Without evidence it says so instead of guessing.
306
+
307
+ ```bash
308
+ covener knowledge ask "What must happen when a customer asks us to delete their data?"
309
+ ```
310
+
311
+ ```
312
+ Personal data must be erased without undue delay when the data subject withdraws consent or the
313
+ data is no longer necessary [gdpr.md#page-43]; the controller must inform recipients of the erasure
314
+ [gdpr.md#page-44].
315
+
316
+ Evidence
317
+ - knowledge/gdpr.md#page-43: Article 17 ... the controller shall have the obligation to erase ...
318
+ - knowledge/gdpr.md#page-44: Article 19 ... communicate any rectification or erasure ...
319
+ Relations
320
+ - gdpr -> data-retention-policy (citation)
321
+ - data-retention-policy -> gdpr (citation)
322
+ ```
323
+
324
+ **How the team uses it.** Product asks the Oracle before drafting a governed spec and cites the
325
+ evidence in `references:`. Engineer reads the cited pages before implementing. Reviewer opens every
326
+ citation, checks the implementation against the wording, and asks the Oracle whether an uncited
327
+ document contradicts the spec: a contradiction is a `fail`. `covener status` warns when a reference
328
+ points to a file that does not exist.
329
+
330
+ ```yaml
331
+ # specs/data-erasure.md
332
+ references: [knowledge/gdpr.md#page-43, knowledge/data-retention-policy.md#page-2]
333
+ ```
334
+
335
+ Models: `claude-sonnet-5` for extraction and answers, `voyage-4-large` for retrieval, both
336
+ multilingual; the Oracle answers in the language of the question. Override with `COVENER_LLM_MODEL`
337
+ and `COVENER_EMBED_MODEL` (`voyage-law-2` is tuned for legal text). Keys (`ANTHROPIC_API_KEY`,
338
+ `VOYAGE_API_KEY`) live in the environment, never in the repository. Indexing costs cents to a few
339
+ dollars per hundred documents. The graph lives in `.covener/knowledge/` (ignored by git,
340
+ rebuildable); the Markdown and both index files are committed and reviewable.
341
+
342
+ ## Tools: CLI and MCP
343
+
344
+ The same implementation has two doors: the CLI for people and CI, and a local MCP server for the
345
+ model. `AGENTS.md` tells the agents when to use which.
346
+
347
+ | Level | For | Registered in | Covener |
348
+ |---|---|---|---|
349
+ | CLI | people, CI | installed | `covener init`, `status`, `knowledge build`, `knowledge ask`, `serve` |
350
+ | Instructions | the model, at session start | `AGENTS.md`, `agents/*.md` | when to use each tool or command |
351
+ | MCP tools | the model, any time | `.mcp.json`, `.cursor/mcp.json`, written by `init` | `status`, `search_knowledge`, `list_knowledge_sources` |
352
+ | Chat commands | you, as shortcuts | `.claude/commands`, `.cursor/commands` | roadmap |
353
+
354
+ ```bash
355
+ pip install "covener[mcp]" # included in covener[oracle]
356
+ covener init # registers the server; re-run after installing the extra
357
+ ```
358
+
359
+ Claude Code reads `.mcp.json` (project scope, committed) and asks you to accept the server once.
360
+ Cursor reads `.cursor/mcp.json`; enable it under Settings, MCP. Codex, Windsurf and others: point
361
+ their MCP config at `covener serve` (stdio). The server exposes nothing that changes the repository.
362
+
363
+ ## The agents
364
+
365
+ Five roles with explicit boundaries, one Markdown file each in `agents/`, in the front matter
366
+ format Claude Code and Cursor read natively. `init` links `.claude/agents` and `.cursor/agents` to
367
+ that folder, so there is exactly one copy of each agent and editing it is editing the file.
368
+
369
+ | Role | Owns | Never |
370
+ |---|---|---|
371
+ | product | vision, impact analysis, specs, bug intake, evidence in `references:` | code, approving its own specs |
372
+ | planner | tasks, sprint scope, briefs, feedback requests, closing and archiving | code, writing `## Feedback`, marking `done` without approval |
373
+ | engineer | implementation, fixes (regression test first), tasks, infrastructure | editing specs, expanding scope |
374
+ | qa | tests from acceptance criteria, acceptance verification, regressions | changing application code |
375
+ | reviewer | architecture, security, quality, compliance against citations; also on pull requests | editing anything |
376
+
377
+ The prompts follow current Anthropic and OpenAI guidance for frontier coding models: clear objective,
378
+ just-in-time reads, explicit outputs, explicit human gates, no permission-seeking for work already
379
+ requested. The model is a property of the agent (`model: claude-sonnet-5` or `inherit`); defaults are
380
+ a fast model for QA, a balanced one for the engineer, a strong one for the rest.
381
+
382
+ **Extending the team.** Roles are the contract; agents are files. Rename or disable a role in
383
+ `.covener/config.yaml`; add an agent by adding a file (a `frontend-engineer.md` next to
384
+ `engineer.md` is visible to every tool through the links). For stack-specific know-how, prefer
385
+ skills over more roles: Claude Code and Cursor load a skill only when the task needs it, so one
386
+ engineer with `frontend`, `backend` and `infra` skills stays cheaper and more consistent than three
387
+ engineers with three prompts. Keep `agents/` for boundaries and `skills/` for expertise.
388
+
389
+ ```yaml
390
+ # .covener/config.yaml
391
+ agents:
392
+ reviewer: security-reviewer # agents/security-reviewer.md
393
+ qa: off
394
+ tools: [claude, cursor]
395
+ ```
396
+
397
+ ## Install
398
+
399
+ ```bash
400
+ pip install covener # or: uv tool install covener / pipx install covener
401
+ covener init # --tools claude,cursor --dry-run --install-agents
402
+ covener status # --json --verbose --strict
403
+ covener knowledge build # --no-graph --dry-run (covener[knowledge] or [oracle])
404
+ covener knowledge ask "..." # --json
405
+ covener serve # MCP over stdio (covener[mcp])
406
+ ```
407
+
408
+ Python 3.10+. One runtime dependency (PyYAML). No network. `-C <dir>` works on every command.
409
+
410
+ **Existing files are safe.** An existing `AGENTS.md` keeps its content and gets the Covener block
411
+ between `<!-- covener:start -->` and `<!-- covener:end -->`; an existing `CLAUDE.md` gets an
412
+ `@AGENTS.md` import; existing `.claude/agents/` or `.cursor/agents/` directories keep their files
413
+ and get per-agent links; a legacy `.cursorrules` is reported.
414
+
415
+ **Windows.** Links become directory junctions when symlinks are not permitted. Clone with
416
+ `git config core.symlinks true`, or run `covener init` after cloning to repair the links.
417
+
418
+ **CI.**
419
+
420
+ ```yaml
421
+ - run: pip install covener && covener status --strict
422
+ ```
423
+
424
+ ## What Covener does not do
425
+
426
+ No project-management UI. No orchestration engine. No MCP requirement. No autonomous deployment.
427
+ No user stories, requirement layers or profiles. Updating the package never touches your files. The
428
+ repository works without the package installed.
429
+
430
+ ## FAQ
431
+
432
+ **Do I need MCP, hooks or a server?** No. The repository provides the context. `covener serve` is
433
+ optional and runs locally over stdio, for IDEs that prefer tools to shell commands.
434
+
435
+ **Can I use my own agents or skills?** Yes. Drop a file in `agents/`; it is visible to every tool
436
+ through the links. Rename or disable roles in `.covener/config.yaml`. Put stack-specific expertise
437
+ in skills rather than in more roles.
438
+
439
+ **What if I uninstall the package?** Everything keeps working. The method is in the files;
440
+ `covener status` is only a checker.
441
+
442
+ **Does it work with Codex, Copilot or Windsurf?** They read `AGENTS.md`, so the instructions and
443
+ the layout work. Agent files are linked for Claude Code and Cursor today; other adapters are a few
444
+ lines each.
445
+
446
+ **Why not just a good CLAUDE.md?** A CLAUDE.md tells an agent how to behave. It does not keep
447
+ decisions between sessions, does not separate what must be true from what happened, cannot stop an
448
+ agent from calling something done, and cannot cite a regulation with a page number. Covener adds
449
+ exactly those four things.
450
+
451
+ ## Roadmap
452
+
453
+ - Codex and Windsurf link adapters; `skills/` linked like `agents/`.
454
+ - `/covener` chat commands for approving and requesting changes from the conversation.
455
+ - A reviewer GitHub Action that posts the `## Review` entry on pull requests.
456
+ - Knowledge Oracle: DOCX and HTML sources, more citation jurisdictions, compliance reports per spec.
457
+
458
+ ## Contributing
459
+
460
+ Issues and pull requests are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md).
461
+
462
+ ```bash
463
+ pip install -e ".[dev]" && pytest && ruff check . && mypy
464
+ ```
465
+
466
+ Standards used: [AGENTS.md](https://agents.md/), Claude Code
467
+ [subagents](https://code.claude.com/docs/en/sub-agents) and
468
+ [CLAUDE.md imports](https://code.claude.com/docs/en/memory), Cursor
469
+ [subagents](https://cursor.com/docs/agent/subagents) and [rules](https://cursor.com/docs/context/rules);
470
+ conventions from [OpenSpec](https://openspec.dev/docs/team-workflow),
471
+ [spec-kit](https://github.com/github/spec-kit) and [Kiro](https://kiro.dev/docs/specs/);
472
+ [LightRAG](https://github.com/HKUDS/LightRAG) and [Voyage AI](https://docs.voyageai.com/) for the Oracle.
473
+
474
+ ## License
475
+
476
+ MIT. Built by [@ajmorenodelarosa](https://github.com/ajmorenodelarosa).