Ghostbots — harness settings, explained

01 · Harness

How your agent behaves

A harness is the frame around the model: what it may do, what it knows, what runs on its own and what stops it. All of it is configuration that omp reads when a session starts.

Active harness

omp

coding agent harness · 18.14.1

real · omp --version, Nov 4, 2026

24model roles

4subagents at once

6hooks & extensions by GhostFactory

1MCP server

Counted from config.yml, mcp.json and the hook files on Nov 4, 2026.

01 Global

We use it~/.omp/agent/config.ymlEvery session on this machine reads it. Almost everything on this page lives here.real · config.yml

02 Project

Not used at GhostFactory.omp/config.ymlA file inside one repo. It would override the global file for that repo only.not set

03 Overlay

For the commit gate and for workers without the advisor--config <file>.ymlAn extra file passed when omp starts. It changes a few keys for that run.real · K-B hooks/commit-review.yml:16-29

04 Runtime

Flags for one run--approval-mode, --smol …Options on the command line. They last for one run and are not saved.omp default

Each layer overrides the one before it. Above all of them, an environment variable for a single setting wins.

real · file:lineThe value comes from our config files, with file and line, as of Nov 4, 2026.
omp defaultWe did not change it. omp's own default applies.
not setThe setting exists, but we have not set it, and by default it is empty.
instruction · not enforcedA rule the agent reads in RULES.md or AGENTS.md. Nothing technically enforces it.
illustrativeAn example, not our setup.

02 · Models

Models and roles

omp sends different work to different models. A quick one searches, a slow one takes the hardest problems. You do not pick a model for every task. We hide the model names here; the roles, the thinking levels and the chains are real.

Fallback chain real · config.yml:81-83

If the main model does not answer or hits a limit, omp tries the next one in order.

primary→fallback 1→fallback 2

Fallback chain of the commit review real · K-B hooks/commit-review.yml:22-29

If all three fail, the review fails and the commit stops. It never falls back to the main chain.

primary→fallback 1→fallback 2→stop

Spend cap per session not set

Once a session, subagents included, has spent this much, omp stops sending model requests. We have no cap.

none

03 · Context

Context and instructions

What the agent reads before you type the first sentence, and how much of its memory window a session may fill.

User AGENTS.md real · AGENTS.md:1

Imports our working agreement (83 lines). The main session and the advisor get it; subagents do not. Turn it off and the agent works without the agreement. Our commit gate does exactly that.

RULES.md real · RULES.md:1-6

6 rules sent with every request. Subagents get them too.

Show the 6 rules · translated from Czech

Before a worktree, branch or workspace is deleted, the session running in it is ended with /exit.
A commit holds the implementation, the tests, the prompt that drove the work and a line in logs/session.log, written by a hook. Commit right after the tests pass, not at the end of the session. Message format: type(ISSUE-ID): description.
Run git commit only with the bash tool. Otherwise the git-commit-log hook does not write its line.
Never read or search .env* files (except .env.example), not even to check a claim: the content would end up in the session transcript and with the model provider.
Only the user can waive a required check (tests, lint, the impact check, the commit review), never a worker or the harness. A check that did not run is a blocker; a substitute check does not count.
Temporary files go only into a scratch folder and are deleted afterwards with a separate rm -rf command. One memory bank can be deleted the same way. Any other recursive delete is blocked by bash.patterns and the guard-recursive-delete hook; if they block you, do not work around them, report it.

The repo's own AGENTS.md, if it has one omp default

omp reads AGENTS.md files from the working folder up to the repo root. Rules of the repo travel with the repo.

Skills: only their descriptions omp default

Only each skill's name and description are in the context. The full skill is read when a task matches. See section 10.

Context warning at 30% and 40% real · extensions/gf-context-warn.ts:30

When the conversation fills 30% and again 40% of the model's window, the agent is told once to finish its step and suggest a handoff to a fresh session. Nothing is cut.

30% · 40%

Automatic compaction real · config.yml:46

When the conversation fills this share of the window, omp summarizes the older part to make room. omp's own default is about 85%. We compact at 50% and warn earlier.

dashed: the agent is told to finish its step and suggest a handoffsolid: automatic compaction

50%

Language with the owner instruction · not enforced

Our working agreement tells the agent to talk to the owner in Czech. It is a sentence in a file, not a switch.

Czech

04 · Safety

Permissions

Start with the approval mode: what the agent may do without asking. The rules below it make it stricter for single commands.

Approval modereal · config.yml:50

Always ask always-ask

Read-only tools run on their own. Everything else asks first.

Ask and remember always-ask-cached

Also asks before it reads a file, and can remember a file or folder you allowed.

Write write

Reading and editing inside the workspace runs on its own. The rest asks.

Yolo yolo

Nothing is asked. We run agents this way and guard the dangerous parts with the rules below and a delete guard.

Rules for shell commands14 rules · first match wins

rm -rf …/tmp/omp/*Cleanup of the scratch folder.

real · config.yml:113-114

rm -rf ~/.omp/agent/memories/mnemopi/banks/*Deleting one memory bank.

real · config.yml:115-116

rm -rf *Any other recursive delete.

real · config.yml:117-118

11 other spellingsThe same delete, flags in another order or spelled out.

rm -fr *rm -Rf *rm -r -f *rm -f -R *rm --recursive --force *rm -r --force *5 more

real · config.yml:119-140

The first rule that matches decides, so the two cleanup rules sit above the deny rules. The rules cover the bash tool only, and they are an approval policy, not containment: a program that is allowed to run keeps the full file and network access of the shell.

Never read `.env` files instruction · not enforced

The agent is told never to read .env files: their content would end up in the transcript and with the model provider.

rule 4

Mask tokens before a request real · config.yml:76

Before a request goes to the model provider, omp replaces strings that look like keys or tokens. It is off in omp by default; we turned it on.

05 · Safety

Sandbox and network

omp in this setup has no sandbox. Commands run with the same file and network access as the user who started the agent. These are the boundaries we rely on instead.

File access: anywhere the user can write real · config.yml:50

This follows from yolo: nothing asks before a write. Files are protected by the rules in section 04 and by the delete guard below.

anywhere

Network: open, no allowlist not set

This setup has no list of allowed domains. A command can reach any address the machine can.

open

Restricted folders not set

In tools.restrictedFolders you can list folders where every read, write or command asks for approval, even in yolo. We have none.

none

Isolated worktrees real · config.yml:74

A subagent can work in its own copy of the repo. Each task opts in; the others share the main checkout.

Delete guard real · hooks/pre/guard-recursive-delete.ts:376

A hook blocks recursive deletes in any spelling, in the bash and eval tools, except inside the scratch folder or one memory bank.

See the hook →

06 · Automation

Hooks

Things that happen on their own at a set moment of the work. Read them as a sentence: when this happens, do that.

1Before a promptbefore_agent_start

2Before a tool runstool_call

1After a tooltool_result

1End of a turnturn_end

1Agent finishedagent_end

1Session endssession_shutdown

In omp, hooks and extensions are small TypeScript files in ~/.omp/agent/. They listen to these events. To turn one off, you remove the file; there is no switch.

WHEN a bash command contains git commit → THEN wrap it so a line goes to logs/session.log and into the same commit

tool_callbashreal · hooks/pre/git-commit-log.ts:15-25

WHEN a command would delete recursively → THEN block it, except inside the scratch folder or one memory bank

tool_callbash · evalreal · hooks/pre/guard-recursive-delete.ts:375-376

WHEN the context reaches 30% or 40% → THEN tell the agent once to finish its step and suggest a handoff

turn_endreal · extensions/gf-context-warn.ts:30

WHEN a session ends → THEN send one session_summary span with the usage totals to Span Chain

session_shutdownSpan Chainreal · extensions/omp-session-summary.ts:198-200

WHEN a session works on a Linear issue → THEN post a comment to that issue

before_agent_starttool_resultreal · extensions/gf-issue-agents.ts:283-289

WHEN you type /wrap → THEN the worker writes its notes, commits, pushes and ends the session

/wrap commandagent_endreal · extensions/gf-wrap.ts:51-64

Three more extensions are installed by Orca, the app that runs our agent terminals. We do not change them.

07 · Automation

Gates

Checks that work has to pass before it moves on. One of ours stops a commit, one can wake the agent, and two are rules the agent is told to follow.

Commit review by a second modelBefore a commit

blocks the commit

Before each commit, a hook starts a separate omp run with the commit-review role. It may only read (read, grep, glob) and has at most 10 minutes. The advisor, memory and the user AGENTS.md are off for it, and it has its own fallback chain. The commit goes through only if the last line is exactly VERDICT: approve. If omp fails, the commit stops. One commit can skip it with git commit --no-verify.

active in GhostFactory's knowledge repo (K-B) via git config core.hooksPath hooksreal · K-B hooks/pre-commit

AdvisorWhile the agent works

does not block, can wake the agent

A second model reads along and leaves notes. We let it review only finished answers (agent-end), not every turn. A note of severity concern or higher wakes the agent up again.

turnagent-end

workers can start without it via an overlayreal · config.yml:52-53

Green tests before a commitBefore a commit

instruction

Our rules say: commit right after the tests pass, not at the end of the session. Each repo has its own test command. No hook checks it.

RULES.md, rule 2instruction · not enforced

Only the owner can waive a checkAny required check

instruction

A worker or the harness cannot skip the tests, lint, the impact check or the commit review. A check that did not run is a blocker.

RULES.md, rule 5instruction · not enforced

08 · Automation

Subagents

Helpers the main agent hands part of the work to. They run side by side, each with its own tools and limits.

At most at once real · config.yml:72

More agents at once is faster, but costs more and is harder to review.

4

Built into omp

scoutExplores code and returns a short summary. Read-only.omp default

reviewerReviews a change for quality and security.omp default

security-reviewerLooks for vulnerabilities with evidence. Read-only.omp default

taskGeneral work in several steps, can edit files.omp default

sonicStrictly mechanical edits and data collection.omp default

Ours, in the knowledge repo

commit-reviewerReviews the staged diff before a commit: correctness, security, maintainability, repo rules. Ends with a verdict a script can read.role commit-review · read, grep, globreal · K-B .omp/agents/commit-reviewer.md:1-11

blog-writerWrites a finished blog post draft from the context it is given. Backs every claim with a source.read, grep, globreal · K-B .omp/agents/blog-writer.md:1-12

backlog-plannerBuilds an ordered work plan from the existing backlog. Only picks and orders what is there; changes nothing in the tracker.role plan · read, grep, glob, bashreal · K-B .omp/agents/backlog-planner.md:1-14

09 · Extensions

MCP servers

External tools the agent can call through the Model Context Protocol. We run one server.

gitnexus real · mcp.json

A code knowledge graph: impact of a change, call context, queries.

stdio · gitnexus mcp · 16 tools in a session on Nov 4, 2026

10 · Extensions

Skills

Instructions for one kind of work. The agent reads a skill only when the task matches its description.

Load Claude user skills real · config.yml:55

omp also reads skills from ~/.claude/skills. Turn it off and the skills from that folder go quiet.

gf-brand-token-designOur black-and-white brand and design tokens for carousels, images and short motion pieces.

omp user skillon matchreal · skills/gf-brand-token-design/SKILL.md:1-15

linear-workflowHow we write, sort and plan issues in Linear.

omp user skillon matchreal · skills/linear-workflow/SKILL.md:1-10

session-reviewAt the end of a session, a list of decisions, open questions and patterns for another model to check.

omp user skillon matchreal · skills/session-review/SKILL.md:1-10

gitnexus-impact-analysisWhat breaks if you change something: an impact check before an edit.

Claude user skillon matchreal · .claude/skills/gitnexus-impact-analysis/SKILL.md:1-4

orca-cliRuns Orca worktrees, terminals and its built-in browser from the command line.

Claude user skillon matchreal · .claude/skills/orca-cli/SKILL.md:1-11

web-design-guidelinesReviews UI code against web interface guidelines: accessibility, design, UX.

Claude user skillon matchreal · .claude/skills/web-design-guidelines/SKILL.md:1-8

"On match" means the agent picks the skill itself when the task fits the description. A skill can opt out of that and wait to be called by name; none of ours does.

11 · Extensions

Memory

What the agent remembers between sessions. Memories are background, not instructions: the current repo always wins.

Long-term memory: Mnemopi, a local SQLite database real · config.yml:60

Decisions and habits from earlier sessions can come back in the next one. off means no memory, local a simpler summary store.

offlocalmnemopi

Search runs on this machine real · config.yml:62

Memories are found with a small embedding model that runs locally, in its English variant.

local

Summaries are written by an online model real · config.yml:21

To turn a session into memories, Mnemopi calls the memory role, which is an online model. That text does leave the machine.

online

Save automatically omp default

Finished turns are saved as memories, at most once every 4 user turns.

Whose memories omp default

per-project keeps one memory bank per project folder. global shares one bank everywhere. per-project-tagged writes per project but recalls from all.

globalper-projectper-project-tagged

The commit gate runs without memory real · K-B hooks/commit-review.yml:20-21

The reviewer of a commit should judge the diff, not what it remembers from other sessions.

off

12 · System

Advanced

Everything above is a view of this file. To change it yourself, edit it, or run omp config set <key> <value> for single keys.

~/.omp/agent/config.ymlreal excerpt · config.yml · shortened, model names hidden

modelRoles:
  default: <model>:high
  smol: <model>:medium
  slow: <model>:xhigh
  plan: <model>:high
  advisor: <model>:high
  # …
  commit-review: <model>:high
# …
compaction:
  enabled: true
  thresholdPercent: 50
# …
tools:
  approvalMode: yolo
advisor:
  enabled: true
  reviewMode: agent-end
skills:
  enableClaudeUser: true
# …
memory:
  backend: mnemopi
mnemopi:
  embeddingVariant: en
# …
task:
  maxConcurrency: 4
  isolation:
    enabled: true
secrets:
  enabled: true
# …
retry:
  fallbackChains:
    default:
      - <model>
      - <model>:high
# …
bash:
  patterns:
    - match: rm -rf …/tmp/omp/*
      approval: allow
    - match: rm -rf ~/.omp/agent/memories/mnemopi/banks/*
      approval: allow
    - match: rm -rf *
      approval: deny
    # … 11 more spellings, each with approval: deny