SDTK-AGENT — Orchestration Shipped

SDTK-AGENT ships the governance kernel: a runtime-neutral, durable, file-driven DAG controller for multi-step agent workflows — with a resumable on-disk ledger, human-gate approvals, and conditional stages. Zero new runtime dependency (Node.js stdlib only).

• CLI: sdtk-agent (package sdtk-agent-kit)
• Full command list: sdtk-agent reference

What it is

A DAG controller layered above sdtk-code agent-team — it doesn't rebuild execution or governance, it orchestrates them. Every command is stateless-CLI-over-file-ledger: state lives under .sdtk/agent-runtime/, so a run can be paused, resumed from a different process, or inspected at any point. No daemon, no in-memory session.

Quick start

# 1. Initialize the runtime ledger
sdtk-agent init --project-path ./my-project

# 2. Validate a workflow DAG (cycle detection, unsafe paths, schema)
sdtk-agent workflow validate --file ./workflow.json

# 3. Start a run — creates the ledger only, executes nothing
sdtk-agent run start \
  --project-path ./my-project \
  --workflow ./workflow.json \
  --runtime-map ./runtime-map.json \
  --feature-key MY_FEATURE \
  --goal "Describe the goal"

# 4. Drive the run until it blocks, waits, or completes
sdtk-agent run continue --project-path ./my-project --run-id <run_id>

# 5. Decide a human gate
sdtk-agent gate approve --project-path ./my-project --run-id <run_id> \
  --gate <gate_id> --approved-by <name>

# 6. Inspect and report
sdtk-agent run status --project-path ./my-project --run-id <run_id> --json
sdtk-agent run report --project-path ./my-project --run-id <run_id>

Cost awareness

A run can fan out into many agent tasks. run start is deliberately ledger-only — nothing executes and nothing is spent until you explicitly run continue.

Adapters

The runtime map binds each workflow role to an adapter:

Adapter	Behavior
manual	Waits for a human/agent to write evidence/<task_id>.evidence.json
shell	Runs an allowlisted binary (shell:false), rejects shell metacharacters and network-mutating flags
sdtk-cli	Dispatches to an allowlisted sdtk-* binary and normalizes output into evidence
hermes-kanban Preview	Pure dry-run plan compiler — the currently published npm adapter refuses mode:"live" fail-closed. See Hermes Adapter

Safety

Path containment on every write, binary allowlists that fail closed, strict Windows .cmd/.bat argument policy, and secret redaction before anything hits disk. Details in The Trust Layer.

Recovery verbs Shipped

sdtk-agent run cancel and sdtk-agent task retry are published in sdtk-agent-kit@0.4.0 — cancel a run (preserving completed/failed tasks, best-effort cancelling in-flight external tasks) or re-ready a failed/timed-out task for another attempt.

What it is not

• Not a replacement for agent-team execution/governance — it delegates via adapters.
• Not a live Hermes Kanban client in this release (dry-run only).
• Not a scheduler or cron system.
• No slash command — SDTK-AGENT is deliberately CLI-only; there is no /agent.

Where to go next

Durable Agent RunsAuthor a workflow, run it, gate it, report it — hands-on.

The Governance KernelLedger anatomy and the state machine.

Command referenceEvery command and option.