[ The operational plane for agentic engineering ]

Production readiness for AI-authored code.

More than 75% of the code now ships from an AI agent. VegaStack runs alongside the agents writing it, governing every change inside your coding agent, at every pull request, and in production.

Read the manifesto →

[ What is VegaStack ]

An operational plane that runs alongside your coding agents.

VegaStack governs AI-authored code at 3 levels.

   ┌─┐ ┌─┐   
  ╭─┴───┴─╮  
  │ ◉   ◉ │  
  ╰───┬───╯  
 ╭█████████╮

[ 01 ]

IN YOUR CODING AGENT

Your agent grounds every edit in your stack's docs, plus your team's runbooks, ADRs, and postmortems. The CLI catches what's left, before you push.

```
    · ─── ·    
  · ╭───────╮ ·
 ─·─┤ scan  ├─·─
  · ╰───────╯ ·
    · ─── ·    
```
[ 02 ]

AT EVERY PULL REQUEST

IAM wildcards, migration locks, leaked secrets, missing rate limits, named in one PR comment with a sandboxed one-click fix per issue. The status check gates merge.

  ╔═══════════╗  
  ║ ! ALERT   ║  
  ╠═══════════╣  
  ║ tf drift  ║  
  ║ → PR open ║  
  ╚═══════════╝

[ 03 ]

IN PRODUCTION

Hourly: a reconciliation PR when Terraform drifts. Daily: a right-sizing draft for spend regressions. On breach: a rotation batched with audit-stamped receipts.

The same Constitution. The same Service Graph. The same issue ledger. The coherence across all 3 is the substrate.

[ How it works ]

Install. Push. Ship. The audit moves with you.

BEFORE YOU PUSH

The agent stops guessing.

Install once into Claude Code, Cursor, Codex, Aider, Gemini CLI, or Continue. The Knowledge Harness loads how your stack actually works (provider docs, your team's runbooks, ADRs, postmortems) before the agent writes a line. Run vegastack readiness to catch what would land on the PR, locally.

vegastack - readiness check - zsh

➜ ~/platform git:(main) $

▌ readiness pre-push · sandbox audit

⠋ loading knowledge harness ... 0%

summary 8 pass 1 risk · 4.7s

! secrets token committed in .env.local · line 14

↳ fix locally before push:

$ vegastack redact .env.local --rotate

➜ ~/platform git:(main) $
WHEN YOU PUSH

The audit lands in 60 seconds.

Skills run in parallel sandboxes against your diff. One sticky audit comment names each risk caught, with a sandboxed one-click fix per issue. The status check (VegaStack Pre-Merge Readiness) gates merge through standard GitHub branch protection. Edited in place on every push, never duplicated.

vegastack/platform-iac · pull/812 · feat: edge ingress for api gateway
Open

infra/network/security_group.tf +18 -6

42 resource "aws_security_group" "api_ingress" {
43 name = "api-ingress"
44 vpc_id = var.vpc_id
45 ingress {
46 from_port = 443
47 protocol = "tcp"
48 - cidr_blocks = ["10.0.0.0/8"]
49 + cidr_blocks = ["0.0.0.0/0"]

SANDBOX AUDIT

tf-plan-diff iac-drift policy-as-code 1 issue cost-delta tag-compliance

VS VegaStack Audit policy-as-code · 41s Risk

cidr_blocks cidr_blocks widens 443 from the VPC range to the public internet. Restrict this rule to the edge proxy CIDR or front it with the WAF.

sandboxed · 4 lines

Pre-Merge Readiness · pending

vegastack/onga-vegastack-platform · pull/611 · ci: speed up release pipeline
Open

.github/workflows/release.yml +12 -3

18 runs-on: ubuntu-latest
19 steps:
20 - - uses: docker/login-action@v3
21 + - uses: docker/login-action@master
22 with:
23 username: ${{ secrets.DOCKER_USER }}
24 password: ${{ secrets.DOCKER_PAT }}
25 + - run: echo "token=${{ secrets.DOCKER_PAT }}" >> $GITHUB_ENV

SANDBOX AUDIT

action-pinning secrets-leak 1 issue permissions shell-injection supply-chain

VS VegaStack Audit secrets-leak · 32s Risk

$GITHUB_ENV $GITHUB_ENV writes DOCKER_PAT into the workflow environment, which can land in logs and downstream jobs. Pin docker/login-action to a SHA too.

sandboxed · 6 lines

Pre-Merge Readiness · pending
AFTER YOU SHIP

Agents run on routines you control.

3 autonomy modes per environment: observe, recommend, or execute. The Drift Agent opens a reconciliation PR when Terraform state diverges from reality. The Cost Agent posts a 7am digest pinning yesterday's regression to a specific PR. The Security Agent batches cross-vendor rotation with audit-stamped receipts when a vendor breaches.

active agents · 3 environments LIVE

Drift Agent

on push · terraform / prod

3 drifted

△ rds.instance_type diverged

+ sg.ingress_rule 2 rules added

↗ reconciliation PR #1842 opened

observe recommend execute

Cost Agent

daily · 07:00 digest

digest sent

$ $840 regression pinned to PR #1829

# digest posted to #cost-alerts

observe recommend execute

Security Agent

on vendor breach event

rotating

⟳ cross-vendor key rotation · 4 services

✓ audit receipt stamped AUDIT-20240504-0031

observe recommend execute