Nexus Agents

A governance substrate for coding agents. It exposes one MCP server with 47 tools; behind it, a scheduler picks a strategy for a task, admission gates decide what is allowed to ship, a default seven-role panel votes on real forks through consensus_vote, and every tool call, voter decision and routing choice is written to a hash-chained append-only audit log that verify_audit_chain can walk. Outcomes feed back into routing through an outcome store, with a second loop that can apply a capped, decaying, demotion-only adjustment to how a CLI is scored. Claude Code, Codex, Gemini and OpenCode are the data plane — the agents that do the work; Nexus Agents is the layer that reviews, audits and routes it.

Who built itA single GitHub account, opened in 2015, with 84 public repositories and 35 followers. He wrote 4,147 of the repository’s 5,184 commits; the other 1,037 are from two bots, one of which also files pull requests on a weekly schedule. Every path in CODEOWNERS names him, including the governor section that requires owner ratification — so the gate separates agent-authored work from owner approval, not one person’s work from another’s. He opens the pull requests, and posts the adversarial review of his own change at a named commit hash underneath them.

1. 01

   One person, two bots, and 6,829 numbered items

   The repository was created on 2026-01-03 and had 5,184 commits by 2026-09-28 — 4,147 by one human account, 932 by a workflow bot and 105 by Dependabot, with every commit linked to an account. Alongside them: 3,313 pull requests, 3,516 issues of which 157 are open, 903 releases and 913 tags, 3,897 files, and 500 MB. The commit graph has no idle month: 630 commits in January, 777 in February, 988 in September. Version numbering is not one line but three that do not agree — the oldest tagged release is v2.2.0 (2026-01-16) and the newest is nexus-agents@8.113.0, while ARCHITECTURE.md declares itself “Version: 2.137.0, Last Updated 2026-06-21”. The twenty most recent releases all landed on 2026-09-24, between 05:47 and 15:11, and the repository’s own scheduled review bot reports documentation staleness in days, listing ARCHITECTURE.md at 23. Against all of that, the repository has 19 stars, 2 forks and 1 watcher.

2. 02

   It reviews its own work, adversarially, at a named commit

   There is no second person, so the second reader is constructed. Open any pull request and the first comment after the body is the author’s own adversarial review of the exact commit he is proposing to merge — “Independent adversarial review of exact head ce559a93 found no substantive blocker” — followed by what he checked, what he could not check, and an explicit statement of the gap the change does not close. A fix to the npm install smoke test (#6826) reads as a list of false passes: a truncated tools/list stream was counted from grep and passed a floor of 25 names; the response had been cut at 65,536 bytes while jq reported an unfinished string. Holding stdin open returned valid JSON with all 47 tools. Independent review then produced three more ways to exit zero — an empty initialize result, tools/list carrying both a result and an error, and a healthy page with a nextCursor — and each became a red fixture before it became a fix. The same comment names the reviewer’s own limits: “Focused tests 8/8 … await refreshed exact-head CI and review; do not merge before both.”

3. 03

   The governor must not be able to weaken its own governor

   The parts of the repository that enforce the rules are themselves gated, and the gate is not a paragraph. CODEOWNERS carries a block bounded by # @governor-section-start and # @governor-section-end listing the paths that may never be auto-merged: the audit hash chain, the governance source, the script that injects one instruction file into another, the claims registry, the signing keys a vote record is verified against, and — the entry added for this reason — “the governor’s own gates”, because as the comment puts it, “a gate an agent can quietly weaken without tripping it is not a gate.” Both gates derive their path set from that single parse. Ratification fails closed and is mechanical: an owner approval or an owner-applied label, and a record in the committed ledger governance/vote-records.jsonl bound to that pull request and that head SHA, approved at supermajority or unanimous, on a whole panel, under an absolute-quorum error policy. The repository also records where this went wrong: .rules/ sat outside those directives until #5997 “while this paragraph claimed otherwise”. The instruction files state the design intent in one line — an agent that can quietly lower its own review bar has no review bar.

4. 04

   The audit chain is off by default, and the threat model says so

   The hash chain is the substrate under every “immutable audit” claim in the project, so there is a document whose stated job is to analyse it adversarially. Its headline finding is that the chain is tamper-evident against in-place edits but not against a whole-log rewrite — there is no external anchor, no signing and no monotonic counter — and it tells the reader to read the residual-risk lines rather than the design. Section 0 is the part most projects would omit: in a default installation the chain does not exist. The subsystem is gated on a security.audit.enabled flag that no shipped configuration sets, so unless an operator opts in, no events are written and every threat in the document is not mitigated but inapplicable. verify_audit_chain against such an installation returns ok: true with notVerified: 'empty' — honest, as the document notes, but a reader who checks only .ok learns nothing. The server does warn at startup. The document also records that it previously described the chain’s guarantees in full, including a enableHashChain default of true and the numbered threats, without ever saying whether a chain was being written at all, and that the instruction files compound it by calling the record load-bearing — which describes a capability, not a default state.

5. 05

   What the committed ledger actually contains

   governance/vote-records.jsonl is checked into the repository: 795,042 bytes, 41 records, averaging about 19 KB each because each one carries every voter’s reasoning and confidence alongside the tally. Every record was written between 2026-09-14 and 2026-09-24, and every one of the 41 is the same shape — strategy supermajority, decision approved, seven approvals, zero rejections, zero abstentions. The first record is the ratification of a fix to the ratification machinery itself (#6241): the ledger gate had judged a bound record on decision, error policy, append-only status and panel coverage but had never read record.strategy, so a record produced at simple majority would have counted. The panel that ratified that fix is the standard seven roles — architect, security, devex, ai_ml, pm, catfish, scope_steward — where catfish exists to be contrarian; in the committed record it approved at 0.9 confidence along with the rest. A consensus system whose default panel includes a professional dissenter has, in its own durable record of the votes that mattered, no dissent to show.

6. 06

   Rules that are checked, and empty cases that are named

   .rules/ holds twenty files totalling about 105 KB, and the README says plainly that they are “enforced by CI gates and PR-review voters, not just suggestions”. Drift detection fails the build when documented rules part company with registered behaviour — the model registry, the MCP tool list, expert types, the skills set. The disciplines are specific enough to disagree with: Red/Green TDD requires the first commit on a branch to be a test failing for the right reason; TypeScript is held to a zero-any policy by ESLint rather than by review; and one rule targets a class of bug rather than a style — name the empty case. [].every(p), ![].some(p), Math.min(...[]) and errors.length === 0 all render absence as health, so aggregation goes through helpers whose empty-case argument is required, and the rule adds that the test, not the linter, is what actually catches it. Two sentences in the instruction files are the whole thesis: “A check that cannot fail by construction is not a check”, and “a review must consume the artifact, not a description of it” — with the qualification that a bounded read is legitimate as long as the record says which portion was read. The project reports its own pull-request review experiment as “directional small-n figures, not measured rates”, and notes that human triage of two inspected false positives reclassified one as a real finding the dataset had mislabelled.