Strengths, ranked

The best of this codebase, ordered by how much a reader should want to steal it.

1. The session log as an enforced single source of truth

Every model-visible fact is a durable event; LLM requests are re-derived from the log, never accumulated; and a runtime invariant fails the process if the two ever diverge (packages/core/agent-loop/src/invariant.ts:39-42, registered prepend: true so replay cannot silence it). Replay, resume, and UI rendering all read one substrate. This is the design decision most worth copying — it converts an entire class of "the UI shows something different from what the model saw" heisenbugs into a hard, immediate failure.

2. Fail-closed as a house style, actually implemented

Not a slogan. Missing approval service denies (packages/core/tools/src/index.ts:1694-1699); an unavailable sandbox runner means the command never runs (packages/sandbox/sandbox-local/src/index.ts:494); an unknown or throwing concurrency classifier defaults to exclusive (packages/core/tools/src/index.ts:1278-1284); a rogue approval answerer is normalized to unavailable (packages/interaction/user-approval/src/index.ts:325). The safe direction is the default direction throughout.

3. Honest self-labeling of what is not a boundary

Repeatedly, code comments refuse to overclaim: the fs fence is "a policy check in TRUSTED code ... NOT a kernel boundary" (packages/fs/fs-sandbox/src/index.ts:11-18); the workflow VM "is not a security boundary" (.../realm.ts:4-6); the dynamic-Cordis runner "is not containment: host-realm helper functions remain an escape route" (packages/extensions/cordis-host-runner/src/sandbox.ts:6-7); the code runtime is "containment, not a security boundary". This candor is rare and is worth more than a stronger-sounding but dishonest claim.

4. Single-sourced security predicates

The Code-Mode collapse rule the prompt tells the model is the exact function the executor denies by (packages/core/tools/src/index.ts:861 feeds the prompt; :1325 gates execution). The model can never be told a rule the executor does not enforce — a pattern any prompt-plus-policy system should adopt.

5. Monotonic guards by type, not convention

A ToolGuard returns a deny reason or undefined — there is no "allow" return value (packages/core/tools/src/index.ts:711). Registration order therefore cannot resurrect a denied call. Making the safety property a type property instead of a discipline is the right move.

6. The plugin model delivers on its promise

"Everything is a plugin" is verifiable: the agent loop is a config row (packages/bundle/base/cordis.patch.yml:436-437), the loop interface and its driver are separable packages joined by a swappable factory (packages/core/agent/src/index.ts:372-379), and per-agent scopes (packages/core/scope/src/index.ts) genuinely give one session a different capability set. This is real composability, not a DI-container veneer.

7. Release verification that actually verifies

Per-package publish decisions by registry tarball integrity — differing bytes fail the run (scripts/release/publish.ts:5-8) — plus installing every tarball into a clean external consumer and driving the bin before release (scripts/release/verify-packed-install.ts:14-17). Exactly one dependency patch across 221 packages (pnpm-workspace.yaml:71-72). Most monorepos this size are a swamp of patched dependencies; this one is not.

8. Cancellation and teardown treated as designed contracts

Tool bodies are never abandoned; the caller signal is re-fused over any wrapper replacement (packages/core/tools/src/index.ts:1536-1544); aborted-unstarted calls still get durable synthetic results so replay stays valid (packages/core/agent-loop/src/tool-calls.ts:251-258); the agent disposer is registered before any resource exists and is memoized (packages/core/agent-loop/src/index.ts:497-499). Lifecycle is engineered, not bolted on.

9. Test infrastructure that resists cheating

216 of 219 packages have tests; a scriptable OpenAI-compatible mock server and a session-replay harness under packages/test-support/; and an explicit anti-cheat rule that an e2e assertion must re-run the command or re-read the file externally rather than probing the agent's own output (docs/testing.md:29). The philosophy — mock only the expensive, non-deterministic boundary and keep everything downstream real — is correct.

10. Institutionalized wart-admission

220 of 268 package READMEs carry a gate-enforced ## Known Limitations and Deferred Work section, and the four postmortems exist to record why the process failed, not just the fix. A codebase that forces itself to write down its own gaps is one you can trust to have found more of them than it hides. This review's own material came substantially from the project's own honest self-documentation.

Worth a special mention: the postmortems

PM 0001's lesson — "Coverage proves lines ran; it says nothing about whether the feature works the way it ships" (docs/postmortem/0001-...:98) — is the single most valuable sentence in the repository, and they earned it by shipping a completely non-functional ACP bridge behind 178 green tests and 100% coverage. PM 0003, where their own web agent fooled itself three times about which server it was validating, is a candid record of agent-driven development's failure mode from the people best positioned to see it.