Agent Engineering Stack

Production-grade engineering policies, skill routing, and verification discipline for Codex and Claude Code.

Agent Engineering Stack makes engineering quality the default instead of a prompt users must repeat. It provides a compact global policy plus on-demand skills for implementation, architecture, UI/UX, accessibility, testing, security, performance, databases, APIs, DevOps, Git, documentation, review, and context efficiency.

Independent project. Not an official OpenAI or Anthropic product.

Visual architecture

The stack routes each task to the smallest relevant engineering capability, then applies verification and safety gates before completion.

Engineering workflow

Skill map

Why this exists

Coding agents are strongest when they receive durable engineering rules but do not carry a giant instruction file in every turn. This project uses progressive disclosure: keep the always-loaded global policy short, then load detailed skills only when the task needs them.

The stack is intentionally strict:

• implement rather than only advise;
• preserve architecture and contracts;
• treat security and accessibility as defaults;
• require meaningful tests and verification evidence;
• refuse destructive or production-sensitive actions without authorization;
• keep context bounded and avoid repeated reads, duplicate reviews, and noisy logs;
• never trade correctness or security merely to save tokens.

Included skills

| Area | Skill | |---|---| | Routing | engineering-router | | Code | implementation-quality | | Architecture | architecture-integrity | | Frontend design | frontend-design-quality | | UX | ui-ux-quality | | Accessibility | accessibility-quality | | Testing | testing-verification | | Security | security-engineering | | Performance | performance-scalability | | Databases | database-integrity | | APIs | api-contracts | | DevOps / SRE | devops-reliability | | Git | git-discipline | | Documentation | documentation-integrity | | Review | review-defect-first | | Token/context efficiency | context-efficiency | | External skill safety | skill-security-audit |

Repository layout

.
├── .agents/plugins/marketplace.json
├── .claude-plugin/marketplace.json
├── plugins/agent-engineering-stack/
│   ├── .codex-plugin/plugin.json
│   ├── .claude-plugin/plugin.json
│   ├── skills/
│   └── scripts/
├── adapters/
│   ├── codex/AGENTS.md.fragment
│   └── claude/CLAUDE.md.fragment
├── scripts/
├── tests/
└── .github/workflows/ci.yml

One-command install with npx

After the package is published to npm:

npx agent-engineering-stack

Or install non-interactively:

npx agent-engineering-stack install --codex
npx agent-engineering-stack install --claude
npx agent-engineering-stack install

Useful commands:

npx agent-engineering-stack doctor
npx agent-engineering-stack skills
npx agent-engineering-stack find "postgres migration"
npx agent-engineering-stack uninstall

Quick start

Clone

git clone https://github.com/AL-JANEF/agent-engineering-stack.git
cd agent-engineering-stack

Add the compact global policy (optional but recommended)

./scripts/bootstrap-global-policy.sh --all

Or:

./scripts/bootstrap-global-policy.sh --codex
./scripts/bootstrap-global-policy.sh --claude

The script backs up an existing file and manages only the marked project block.

Codex

This repository contains a Codex plugin manifest at plugins/agent-engineering-stack/.codex-plugin/plugin.json and marketplace metadata at .agents/plugins/marketplace.json.

For local development, point the Codex plugin workflow at plugins/agent-engineering-stack or add the repository marketplace through the Codex plugin flow supported by the installed version.

If a Codex setup relies on user-level skills rather than plugins, copy only the desired skill directories from plugins/agent-engineering-stack/skills/ into the supported Codex skill directory. Avoid copying every external skill collection into global context.

Claude Code

After this repository is on GitHub:

claude plugin marketplace add AL-JANEF/agent-engineering-stack
claude plugin install agent-engineering-stack@agent-engineering-stack --scope user

For local testing before publishing:

claude --plugin-dir ./plugins/agent-engineering-stack

Verify

python3 scripts/validate.py
python3 plugins/agent-engineering-stack/scripts/agent-stack-doctor.py
python3 plugins/agent-engineering-stack/scripts/agent-skill-find.py "database migration security"

Security: external skills are untrusted

Before adopting a third-party skill or plugin:

python3 plugins/agent-engineering-stack/scripts/audit-skill.py /path/to/candidate --fail-on high

This performs conservative static triage only. It does not execute the candidate and it is not proof of safety. Review findings manually, especially network/process execution, credential access, hooks, destructive commands, and prompt instructions that attempt to override higher-priority policy.

Context and token efficiency

The project does not try to make agents "think less." It removes waste:

• search before broad reads;
• load only relevant skills;
• prefer deterministic scripts for discovery and validation;
• keep raw logs/artifacts out of conversational context;
• avoid repeated reads and unchanged passing checks;
• use targeted tests before broad suites;
• use expensive/deep security or review workflows only when risk justifies them.

Optional external tooling

The stack works without third-party binaries. When available, agents may use existing local tools such as Semgrep, Gitleaks, Trivy, OSV-Scanner, RepoMap, ShellCheck, actionlint, or vendor security products according to project policy. They are not bundled here. See THIRD_PARTY.md.

Development

python3 scripts/validate.py
python3 -m unittest discover -s tests -p 'test_*.py'
bash -n scripts/bootstrap-global-policy.sh scripts/uninstall-global-policy.sh

Create release archives:

./scripts/package-release.sh

Brand assets

Repository artwork lives in docs/assets/. The visual system is designed for dark developer tooling surfaces and GitHub documentation.

• hero.png — README hero
• architecture.png — system architecture
• workflow.png — engineering workflow
• skills-map.png — core skill overview
• brand-guide.png — visual identity board
• social-preview.png — GitHub social preview (1280×640)
• logo-mark.png — square repository mark

License

MIT. See LICENSE and NOTICE.md.