delegation record
worker identity · inputs · tools · evidence
A worker can return evidence. It cannot certify its own result. The packet still routes review to a human or an independent reviewer.
corpus agents
Claude-Code-first worker definitions for corpus roles: review, exploration, evidence checking, and bounded authoring.
These are role files you can copy into a repo. They help route work; they do not run the project for you.
note
install.sh — copy one worker
pwrcheckevidence
terminal# copy one agent into your repo (Claude Code reads .claude/agents/)
$mkdir -p <your-repo>/.claude/agents
$cp agents/corpus-reviewer.md <your-repo>/.claude/agents/
# optional: the delegation-provenance hook + the read-only guard
$cp hooks/delegations.sh hooks/readonly-guard.sh <your-repo>/.claude/hooks/
These are Claude Code agents (.claude/agents/), not Agent-Skills, so it is copy-based — npx skills installs the skills catalog, not these. Like skills, an agent names abstract command slots (cmdTest, cmdLint) that your repo's AGENTS.md fills in.
tier-1.conf — read-only workers
Read-only workers
Their tools allowlist excludes Edit/Write; the ones that keep Bash pair with the read-only guard. Scoping is toolable/partial — it narrows the surface, it is not a sandbox.
review requiredtoolable limits
corpus-reviewer
independently review a finished task or PR — re-run Verify, read the diff, draft the packet
corpus-explorer
orient in a codebase read-only — locate and trace how something works, then report (no edits, no Bash)
corpus-evidence-checker
re-run a task's Verify items and paste verbatim output; flag every claim that lacks evidence
corpus-challenger
pressure-test a proposal before it is built — assumptions, the steelmanned alternative, external evidence
tier-2.conf — bounded authoring
Bounded-authoring workers
These grant Edit/Write to draft one artifact. Their value is the baked-in discipline, fresh-context isolation, and the delegation trace — not enforcement; a granted Write is not path-locked, and the body says so.
bounded draftreview required
corpus-spec-author
draft a spec from an intake note — verifiable requirements, no smuggled implementation
corpus-researcher
investigate one question against primary sources → a research note, committing to no decision
corpus-auditor
audit a code area — present state, file:line, severity by impact, observation not prescription
corpus-documentarian
draft human-facing docs — one Diátaxis frame, every example run as written
scope.note — toolable, not a wall
What is real, what is honor-system
A read-only agent's toolsallowlist genuinely drops Edit/Write, and the guard hook trips on the obvious write idioms — but a shell can still write, and a parent permission mode can bypass a hook. Nothing here is labelled “enforced.” The honest limits are written down, with the bypasses cited.
delegation trace
Why not just the built-in reviewer?
You can get far with a built-in agent and a CLAUDE.md. These add a fresh isolated context per role and — with the hook — a reviewable delegation trace the built-ins do not emit. Reach for them when that earns its keep.
portability — one source, a second runner
Claude Code first, and it ports
The definitions are authored for Claude Code, but they are the single source — they don't get hand-copied for other tools. corpus agents emit --codex generates Codex .codex/agents/*.toml from the same files, and the shared discipline — evidence over assertion and reconcile-only review — ports through the open AGENTS.md format that Codex, Cursor, Copilot, Gemini CLI, and Aider all read.
What does not travel, stated plainly: the tool-scoping allowlist and the hooks are Claude-Code-only structural enforcement. Every emitted file says so in its header — a Codex adopter gets the prose discipline and scopes tools in their own config. The discipline is portable; the enforcement is not.
catalog — browse on github
The full catalog
Eight workers, two hooks, and the evidence behind the design — all plain markdown plus two short POSIX-sh hooks. Read an agent before you install it; pin to a commit for a stable install.