Procoder

A discipline harness for AI coding agents, shipped as one Go binary with no runtime dependencies and no server process. It gives the agent three things: a commit gate it cannot argue past, controllers that refuse to call unfinished work finished, and a loop that turns every escaped bug into a closed class. The gate counts a check that could not run as a failure — a tool that is missing, times out or returns output nobody can parse is reported as not checked rather than clean, and the count appears in the gate’s own summary line. The quality chain puts a refusing controller at every link: a specification interview, a plan, a backlog worked in sprints, and a standalone task list whose close refuses without checked criteria and recorded evidence. Everything the tool owns lives in a single directory inside the repository, and the repository’s own files beat the built-in defaults wholesale. Twenty releases in the thirty-four days between 2026-08-20 and 2026-09-23, on 530 commits and 211 stars, under Apache-2.0.

Who built itA solo maintainer: 514 of the repository’s 530 commits are his, committed as Pascal Watteel from the account piwi3910 and the address pascal@watteel.com. Of the other 16, twelve come from two bots — github-actions[bot] with eleven and dependabot[bot] with one — which is the origin of the figure of about twelve machine-named authors in the recent window; the remaining four are people with a single commit each, RealPLU, Acroaticum, ToberoCat and qinghuanandejiangshi, three of whom commit under a display name that does not match their handle. Eleven co-author trailers were extracted from the history, six of them naming github-actions[bot], and beside the names Claude Opus 5, Codex and Nadim Stub the extractor also returns prose fragments, so that list is not a reliable credit roll.

1. 01

   A gate that counts what it could not check

   The rule the project states before any feature is that a check which did not run is not a pass. Contract two on the architecture page: a tool that is missing, times out, or returns output nobody can parse yields not checked, counted by the gate as failing and never collapsed into “no findings”. The formatter verdict therefore has three values — clean, unformatted, unchecked — and the gate’s closing line prints them together: procoder gate: 0 clean, 2 unformatted, 0 unchecked, 1 out of scope, 8 hygiene finding(s) (3 blocking). The rule reaches the smaller surfaces too: a bare package.json with no lockfile is an explicit unscannable gap, and an unreadable rule copy reports itself as UNREADABLE rather than missing. The gate is one code path — procoder check, procoder git and CI call the same collector, and a local pass that fails in CI is defined as a bug — and the full set of checks belongs only to a repository that has adopted the tool, with every run stating its mode. It was strict enough to block its own repository’s fix for a dependency advisory: in 3.6.0 it named versions that existed nowhere in the working tree, so the commit that removed them was refused, and the fix stopped the scan at nested checkouts. On its own tree the counter reads 856 clean, 0 unformatted, 0 unchecked, 20 out of scope and 172 hygiene findings.

2. 02

   Where the discipline stops being optional

   Running the gate is the agent’s job; two lifecycle hooks are not. A write hook fires on every write and edit, and a session-start hook runs before the agent reads anything — which is why the project budgets their output rather than their honesty. A host inlines only the first two kilobytes of hook output, writing the rest to a file, so the hook keeps its message under that, gives the formatted body a bounded share, and drops what will not fit rather than truncating it: half a finding has a meaning nobody can trust, and half a file may be written back over the whole thing. What was dropped is counted, and procoder check shows it. Contract one points the same way: the binary computes and the agent writes, so formatters hand over content to review; the exceptions are its own state files. That promise is also where it hurt itself. The format command printed a header plus content when a file needed changes and only a header when it did not, exit code zero both ways, and the gate’s hint invited procoder format f | tail -n +2 > f; the maintainer lost two documentation files that way, both committed at zero bytes. The fix moved the verdict to stderr and put the file’s own bytes on stdout, and closed the quieter version underneath — with no header to strip, the same pipe deleted the file’s first line — by rewording the hint and refusing to print nothing for a non-empty file.

3. 03

   The loop that closes a class of bug

   The self-learning loop is the part the project calls its reason to exist. A self-review before a pull request exists — through lenses including an adversarial one and an edge-case one — catches reviewer-class findings early. Anything that still escapes becomes an entry in a lessons ledger, one file in the repository that has grown to 23,975 bytes, and writing the entry down does not close it: the adaptation it names, whether a linter rule, a rubric line or a test, has to land before the work counts as done. The bot reviewer is the fallback net, not the net, and what it catches is not lost: one command collects GitHub Copilot’s automatic review findings, strips every trace of the repository’s code out of them, files them as issues only after a terminal confirmation, and marks them unlearned until somebody writes the adaptation that closes the class. A sprint file in the project’s own backlog names the campaign that tests these instruments as one deliberate defect per class the tool claims to catch; its report runs to 17,554 bytes, six scripts drive it, and the architecture page states the rule — a checker that cannot catch its planted bad fixture is not trusted. The loop records its own holes: one pending task file says the records it writes were not actually bounded, and the no-silent-green rule has its own specification, its own backlog epic and two test files named after it.

4. 04

   One binary, no runtime dependencies, and the bill for it

   The implementation is one Go program: 284 files across 59 internal packages, a 72,448-byte main command, and a launcher that finds it. Cross-compilation happens in CI at each tag, the release publishes them with a checksum manifest, and the launcher fetches the one binary the machine needs on first use, verifies it against the published digest and caches it beside the plugin, so later runs exec it directly with no network at hook time. That arrangement is itself a recorded trade: the binaries used to be committed, which made the install offline and cost 39 megabytes of git history per release, and the decision that changed it accepts one network fetch on first run plus a hook that warns and lets the session continue. The README has not caught up with its architecture page — it still says the binaries are cross-compiled and committed with the plugin — the kind of drift its own mirror check exists to catch. What the single binary buys is legibility: the same repository carries rule files for around fifteen hosts, six plugin manifests that carry a version, and no server process. What it costs shows in the small print: two pull requests both record that standalone JavaScript was not run for lack of a test script, and an open bug reports the self-upgrade command on 3.6.0 asking to go to 3.7.0, failing to fetch the checksum manifest on Ubuntu 22.04, leaving the upgrade undone.

5. 05

   Twenty releases in thirty-four days

   The first release is v1.0.0 on 2026-08-20, four days after the repository was created, and its title in the release list is a sentence rather than a number: 1.0.0 — the interface is a promise now. Nineteen more follow in thirty-four days, and the first week is the interesting part of the rate: four on the day of the first one, four the next day, three inside four hours on 2026-08-24, then v3.0.0 on 2026-08-25, after a v2.0.0 the previous afternoon. Three major versions arrived inside six days, and after that the rhythm settles into roughly weekly — v3.5.0 on 2026-09-01, v3.6.0 on 2026-09-09, v3.7.0 on 2026-09-23 — while the commit count tells the other half of the story, 499 of the 530 commits arriving in August and 31 in September. Behind the tags sits a controller that refuses instead of tagging: it checks the version across nine files the repository lists, the changelog entry, a clean tree, a clean gate and a passing suite, prints every failure in one list, and on success prints the git tag command for a human to run. It never tags anything itself, the whole procedure is written down in a release document where that tag command is step seven, and the release pull request for 3.7.0 shows the checking habit reaching into the changelog: it lists the nine files, the new entry, and a correction to the previous version’s heading, which had the wrong date.

6. 06

   One outside fix, a queue of bot bumps, and two misleading failures

   The outside traffic is thin: 22 open issues at the snapshot, and one outside contributor, whose OpenTofu fix for the infrastructure gate the maintainer rebased, extended with two commits and landed with the contributor’s name kept on it — noting that the extension was needed because with both binaries installed the same directory was still being sent to the wrong one, the original bug the other way round. Most of the rest is machine-opened: bump pull requests from a workflow token, each carrying the caveat that it does not start CI and has to be closed and reopened, and each answered with a version-specific verification: a checksum matched, the tool installed in isolation, the real command run. Two of the project’s own bugs are worth more than their fixes. A guard test failed once in CI and passed on a re-run of the same commit; the maintainer filed it rather than let a green re-roll close the question, and it closed only when the runner was changed to read structured test output, so a printed failure line can no longer be counted as a failing test. The other is a Windows job that failed on the v3.6.0 tag because two callers appeared to win a start race — his verdict was that the lock was right and the test was wrong, since each winner released inside its own goroutine and Windows simply spread ten of them past the five-millisecond window the other platforms had fitted inside.