Wired and healthy,
one gap \u2014 guardrails.
\n Everything loads, CLIs are in sync, per-turn context has room. The single thing dragging the score is guardrails wiring (40/100) \u2014 there are 5 actions below, ranked.
\nScore = harness wiring present + in sync, not rule quality.
\nREADY, WITH GAPS \u2014 an agent can start here
The single \"can I start?\" gate: the maturity score above rates harness wiring; this rates whether an agent can make a correct first change on THIS machine right now. A blocker is a hard stop \u2014 the full remediation list is in What to fix first below.
Can I start?
88/100 \u00B7 solidaih ready \u2014 machine \u00B7 repo-contract \u00B7 harness-wiring, over aih's read-only probes.Blockers \u00B7 must fix before an agent can work
clearWhat to fix first \u2014 5 ranked actions
The spine of this report: every finding below, triaged by leverage, each with the exact command. When this list is empty, the harness is clean \u2014 nothing else here needs your attention.
Wire guardrails
highGuardrails at 40/100 \u2014 gitleaks config present but the pre-commit hook is not installed (present \u2260 enforced). Highest leverage + closes a real security gap.
aih bootstrap-ai --scope guardrails --applyAdd AGENTS.md
medMissing bootloader \u2014 codex, opencode, zed cannot load canon here. Only failing adoption check.
aih scaffold --cli codex --applyRealign drifted canon
medRULE_ROUTER.md is +42 tok out of sync (2h). Realign before it reaches the other CLIs.
aih bootstrap-ai --applyVet context7 MCP egress
lowcontext7 is a third-party MCP server (sends queries off-box). Confirm it is approved for this repo.
aih mcp --verifyWire usage + track hooks
lowActivity, trends and time-to-green need the recorder + per-commit snapshots wired.
aih usage --apply && aih track --applyaih cleared 4 blockers to get you running
This is why aih exists. The runtime your AI tools assume \u2014 corporate TLS trust, npm, PATH, MCP launch \u2014 was broken on this host; aih diagnosed and repaired it, and has kept it green across 12 runs. The cumulative payoff over the period, not just today.
Remediation ledger \u00B7 what aih fixed
runtime greenaih heal --scope all diagnoses and repairs.Over the period
run ledgerPer-turn context is lean \u2014 62% headroom
The cost that matters is what a CLI loads per turn: 12,200 of 32,000 tokens (claude, the heaviest), down 3% since last run. The full on-disk corpus is larger (18,400 tok / 42 files) but never loaded at once.
Per-turn budget
62% freeTop files in the corpus
6 of 42Velocity is up \u2014 23 commits this week
Real git activity: 23 commits in 7d (up from 14), 87 in 30d, net +2,630 LOC, on a 23-day active streak. Per-CLI usage share is the colorful bar below \u2014 actions, not cost.
Commit activity \u00B7 90 days
git historyLOC \u00B7 30d + repo
net +2,630- mainmain2h
- feat/x+14\u221225m
Usage by CLI \u00B7 this week
1,204 actionsGuardrails present \u2014 but the hook is not enforced
ECC brings the guardrails, agents, skills and hooks; config is not enforcement, though: gitleaks hook is not installed, so the secret scan never runs. Test/source file ratio 61% (file count, not line coverage).
Test coverage
61%Guardrail enforcement
1 not enforcedECC harness \u00B7 what came along
profile: balancedRULE_ROUTER.md drifted \u2014 realign canon
Drift is a real tamper / config-rot signal: one of 5 tracked managed files changed since the last regen and is +42 tokens out of sync. Time-to-green matters here \u2014 the longer it drifts, the more the CLIs diverge.
Drift detection
1 fileCross-CLI coherence
designMCP wired for 4 CLIs \u2014 1 server phones out
aih writes the MCP config per CLI and pre-flight confirms it launches. Supply-chain truth: context7 is third-party egress (your queries leave the box) \u2014 worth an explicit OK. Runtime call volume is not metered, so it is not shown.
Per-CLI wiring \u00B7 pre-flight green
4/11 wiredServers + egress
1 third-partySetup is complete except AGENTS.md
Point-in-time gate (stays green once met): 8/9 artifacts, 3 AI CLIs runnable (+1 config-only), 5/7 shell tools. On feat/x with uncommitted changes.
Adoption checks
8/9Shell + AI tooling
5/7 tools \u00B7 3 CLIs1 blocker needs IT \u2014 ticket ready
External failures (proxy / TLS / npm / MCP) become a tool-neutral, redacted escalation you paste into IT email / ServiceNow. Self-fixable issues stay with you; only true external blockers escalate.
Findings
routed by who actsEscalation ticket \u00B7 copy to IT
1 external blockerSubject: MCP pre-flight blocked on managed workstation\n\nSummary: aih's MCP servers cannot launch \u2014 `npx` fails behind the\n corporate TLS proxy (root CA not trusted by Node).\nImpact: Claude / Cursor / Kiro cannot reach project MCP servers.\nAsk: Add the corporate root CA to Node (NODE_EXTRA_CA_CERTS)\n or allowlist registry.npmjs.org.\nAcceptance: `aih heal --scope mcp` exits 0.
How it's trending \u2014 and what to measure next
The point of running this weekly. Left: real signals over time (needs aih track hooked). Right: the outcome deltas that prove sustained productivity \u2014 lead time, rework, and time-to-green \u2014 derivable from git, not yet wired.
Trends \u00B7 last 8 samples
needs aih trackWiring score
72\u219282Per-turn ctx %
41\u219238%Drift incidents
stableOpen actions
8\u21925Outcome deltas
designHeavy lifters vs dormant packs
Where skill investment pays off, and what to trim: 6 skills do the work; 5 ECC language packs (go/php/ruby/swift/kotlin) never fire in this TS repo \u2014 dead weight in always-loaded canon. Counts need usage hooks; dormant detection needs a skill-inventory scan.
Heavy lifters \u00B7 30d
263 callsDormant \u2014 trim candidates
5 unusedSkill governance
External skills acquired via aih workspace add, joined to the committed aih-skills.lock.json. Unapproved = on disk without an approval; stale-pin = approved at a commit the source has since moved past.
Skill governance
not availableaih-skills.lock.json is absent \u2014 nothing to govern. Acquire one with aih workspace add <source>.