CLike 发布 1.3.0：为编码智能体提供受治理的交付生命周期

CLike — Governed AI-Native Delivery for Coding Agents

From intent to impact. CLike turns an idea into reviewed, tested and promotable software through a governed lifecycle in which cloud models and local coding agents execute, while deterministic evaluation and gates decide.

Abstract

Coding agents (Claude Code, Codex CLI, cloud LLMs) can now produce large amounts of code quickly. The open problem is no longer generation but governance: keeping intent, requirements, implementation, tests and promotion decisions aligned, auditable and safe when much of the work is performed by autonomous agents.

CLike is an R&D platform that addresses this problem with three ideas:

1. A structured lifecycle (Harper) — IDEA → SPEC → PLAN → KIT → EVAL → GATE → FINALIZE — where every phase produces canonical, reviewable artifacts and each requirement (REQ) advances through short, verifiable loops.
2. Agent-agnostic execution under one contract — the same phase contract (inputs, expected outputs, allowed write roots, validation) is rendered either as a cloud prompt or as an execution package for a local agent, so the choice of executor never bypasses governance.
3. Evidence-based promotion — a deterministic eval runner produces evidence, and the gate, not a model, decides whether a candidate can be promoted.

The developer leads.        CLike governs.
Models and agents execute.  Eval and Gate decide.

Status

CLike is research software under active development. Interfaces may change between minor versions.

Core concepts

Harper lifecycle

/kit → /eval → /gate is an iterative control loop per REQ, not a one-shot generation step. Candidates live under runs/kit/<REQ>/ and are promoted into canonical source roots only after a gate.

Governance principles

• Canonical artifacts win. Methodology companions, skills and agent output are advisory.
• Executors are interchangeable; contracts are not. Cloud and local execution share the same phase contract and are normalized by the orchestrator.
• Agents cannot promote. Local agents write only to the roots allowed by the phase contract and never run Git or promotion.
• The gate is deterministic. Pass/fail comes from executed checks, not from a model's judgment.
• The developer is the orchestrator. No phase advances until its output is reviewed.

Two agent operating models

• Developer → CLike → agent. The developer runs a phase; the orchestrator builds an execution package; the extension runs Claude Code or Codex CLI locally; results are normalized and continue through eval and gate. Free Q&A and Coding chat modes can run the same way.
• Agent → CLike. An external agent operates CLike through MCP, dispatching the same commands a developer would type, so it inherits the same governance.

Details: docs/agent-operating-model.md.

Architecture

                      trust boundary: loopback only · service token on every call
┌───────────────────────────┐      ┌───────────────────────────────┐      ┌───────────────────────────┐
│ VS CODE EXTENSION         │token │ ORCHESTRATOR (FastAPI)        │token │ MODEL GATEWAY (FastAPI)   │
│ the only workspace writer │─────▶│ Harper domain                 │─────▶│ provider abstraction      │ ──▶ cloud providers
│ • chat UI, slash commands │      │ • phase contracts & packages  │      │ • OpenAI / Anthropic      │
│ • confined file writes    │◀─────│ • execution policy            │◀─────│ • OpenAI-compatible       │
│ • Git (non-destructive)   │      │ • gate & acceptance integrity │      │   (e.g. Ollama, optional) │
│ • local agent actuator    │      │ • RAG API · MCP server        │      │ • embeddings, telemetry   │
│ • operational MCP (opt.)  │      │                               │      │                           │
└───────────────────────────┘      └───────────────────────────────┘      └───────────────────────────┘
              │                          │ evalnet               │
              ▼                          ▼                       ▼
┌───────────────────────────┐      ┌─────────────────────────┐  ┌──────────────┐
│ LOCAL CODING AGENTS       │      │ EVAL SANDBOX            │  │ Qdrant       │
│ Claude Code · Codex CLI   │      │ runs LTC checks;        │  │ vector store │
│ own CLI session; write    │      │ no secrets, non-root,   │  └──────────────┘
│ roots from the contract   │      │ read-only, isolated net │
└───────────────────────────┘      └─────────────────────────┘

Further reading: architecture · Harper workflow · artifacts · context sources · RAG · Git and promotion.

Security model

CLike executes model-generated code and drives agents that write files, so security is part of the design:

• Authenticated, loopback-only services. Every endpoint except /health requires a service token; services fail closed without one, accept only loopback/service Host headers and expose no CORS.
• Confinement. Paths from models, agents or requests are confined to their roots (workspace, run directory, telemetry); the extension is the only component that writes the workspace.
• Trusted, isolated evaluation. The gate executes the profile stored in the workspace, never one supplied by the caller, in a sandbox without credentials or access to the other services; the acceptance surface is locked before evaluation and tampering blocks the gate; overrides are audited.
• Least privilege at runtime. Services run as a non-root user; the CLike repository is mounted read-only.
• Non-destructive Git. Only the files of a phase are committed; no branch is rewritten; commit, push, merge and PR automation are opt-in.

See SECURITY.md for the threat model, current limitations and how to report a vulnerability.

Install

Requirements: VS Code 1.85+, Podman 5 with podman-compose (or Docker Compose v2) and a container VM with at least 4 GB, provider API keys for cloud models, optionally the Claude Code or Codex CLI.

cp .env.example .env                      # provider keys + CLIKE_API_TOKEN=$(openssl rand -hex 32)
cp docker/.env.example docker/.env        # CLIKE_PROJECTS_DIR = host folder containing your projects
cd docker && podman-compose up -d --build # services on 127.0.0.1, wait until (healthy)
code --install-extension ../extensions/vscode/clike-1.3.0.vsix

In VS Code: CLike: Set Service Token (the CLIKE_API_TOKEN value). Full guide, local agents and the MCP setup for Claude Code / Codex: docs/INSTALL.md.

Get started

Open a project under CLIKE_PROJECTS_DIR, run CLike: Chat (Q&A / Harper / Coding), Harper mode:

/init → /idea → /spec → /plan → ( /kit REQ-xxx → /eval REQ-xxx --fix → /gate REQ-xxx )* → /finalize

With execution = agent the chat is a continuing conversation with Claude Code or Codex (/agent-model, /agent-session), and Claude Code / Codex can drive CLike through MCP. Walkthrough, options and troubleshooting: docs/GET_STARTED.md.

Extensibility

• Capabilities — project-local skills, packs and design profiles (.clike/) that PLAN selects per REQ and KIT/EVAL/GATE enforce. → docs/CAPABILITIES.md
• Methodology profiles — optional, advisory enrichment of phases (e.g. BMAD roles) without a runtime dependency and without overriding Harper governance. → docs/integrations/bmad
• MCP — a read-only informational server in the orchestrator and an opt-in operational server in the extension, both token-protected. → docs/mcp.md
• Models — declarative catalog and routing in configs/models.yaml. → setup and runtime

Engineering practice

Developer guide: docs/development.md.

Research context

CLike combines three lines of work and investigates how to make them governable in practice:

• Harper-style iterative generation — idea → spec → plan → kit in short, verifiable loops (Harper Reed — LLM codegen workflow).
• Vibe coding — intent- and outcome-level development with cognitive offloading to AI (Gartner).
• AI-native software engineering — agentic workflows with human-in-the-loop governance, grounding and automated validation (Gartner).

Open research questions the project works on:

1. How to keep acceptance criteria independent from the implementation produced by the same agent.
2. How to bound autonomous KIT ⇄ EVAL repair loops (iterations, cost, escalation) without losing control.
3. How to make the same governed lifecycle usable from inside native coding agents (skills, MCP, CI gates).
4. How to measure delivery outcomes (lead time, first-pass gate rate, cost per requirement) rather than code volume.

Roadmap

Documentation

License

Apache License 2.0 — see LICENSE.

CLike on, code on.