IMG-01 · vallée de brume, porte monolithique lointaine (placeholder)

RW™ · RECORD 01

The engineering that makes an agentic system hold.
From idea to production, every decision made, traced, proven.

01A check aimed at the decisions, not just the code: the choices that keep the system alive are made and traced before production, and the verdict is deterministic, with no model in the loop: same tree, same verdict
02The threat model laid down on day zero, not after the incident
03Every important decision written down: dated, with its reason and when to revisit it
04A first layer of audit evidence: enough to feed the compliance tool (Vanta, Drata) or the auditor

Click here to run it with your agent →

Codex Claude Cursor Copilot Gemini Windsurf Continue Junie Trae

SCROLL ↓

RW·01PROVEN, NOT DECLAREDIMG-02 · SWAP-READY

IMG-02 · macro basalte veiné (placeholder)

RW·02PORTS BEFORE STACKIMG-03 · SWAP-READY

IMG-03 · enfilade de six monolithes dans le désert brumeux (placeholder)

RW·03THE SMALLEST REAL SYSTEMIMG-05 · SWAP-READY

IMG-05 · pierre grise gravée, macro rasante (placeholder)

RW·04PROOF FIRSTIMG-06 · SWAP-READY

IMG-06 · strates sédimentaires chaudes fissurées, zénithal (placeholder)

RW·05DAY ZERO, TRANSVERSEIMG-04 · SWAP-READY

IMG-04 · cristal brut vert sauge, lueur dorée (placeholder)

RW·06HANDED OVERIMG-07 · SWAP-READY

IMG-07 · plaine s'éclaircissant au-dessus de la mer de brume (placeholder)

IMG-08 · dalle minérale nocturne (placeholder)

or follow the installation guide →

Gate 01 · one page, one goal · 43.6102 N / 3.8730 E · alt. 402 m

Frame

A vague intention becomes a decided scope: what gets built first, what is deferred, and the trigger that will reactivate each deferral.

You

Hand your idea to the init wizard, then talk it over with your sponsor.

Your agent

Drafts the framing note.

Locked in the repo

An observable success criterion and a one-page mission contract.

Definition of done

A one-page framing note: problem, value, observable success criterion, hard constraints.
Floor scope listed, each deferral named with its trigger.
Language and topology explicitly left open.

source : runward/workflows/frame.md

Gate 02 · dated decisions · 43.6094 N / 3.8747 E · alt. 396 m

Architect

Boundaries before choosing the tech: each need goes through a port, a stable socket where you swap what is behind it (the model, the database) without touching the rest. The language stays open.

You

Draw the boundaries.

Your agent

Proposes the ports and their contracts, and fills the grid of choices: for each one, a default and the signal that will change it.

Locked in the repo

The architecture note and the first ADRs: dated decisions, each with its re-evaluation trigger.

Definition of done

Architecture note produced: boundaries first, stack open.
Each port named with its contract and initial version.
One ADR locked per structural choice, before the note.

source : runward/workflows/architect.md

Gate 03 · the smallest running system · 43.6089 N / 3.8762 E · alt. 391 m

Floor

The smallest system that proves value on real traffic: a running system, not a demo.

You

Accept or reject the proof.

Your agent

Builds that smallest system from a ready-made base: a clean structure where each piece swaps out without breaking the others, the model behind a port, not a blank page.

Locked in the repo

A proof measured against your criterion, on real traffic.

Definition of done

The floor runs on real traffic through the existing infrastructure.
Value measured against the framing success criterion.
The whole run replays, step by step, from a single request identifier.

source : runward/workflows/floor.md

Gate 04 · proof first · 43.6081 N / 3.8778 E · alt. 385 m

Iterate

No evolution without a signal: a sober default, a trigger observed on real traffic, a switch traced in an ADR.

You

Approve every complexity trigger.

Your agent

Adds only what a trigger justifies.

Locked in the repo

One ADR per evolution.

Definition of done

Every shipped evolution maps to an observed trigger or a measured gain.
One ADR locked per switch, with its rollback signal.
The domain untouched: only what is behind the ports (and the topology) moves.

source : runward/workflows/iterate.md

Gate 05 · day zero, transverse · 43.6076 N / 3.8791 E · alt. 379 m

Govern

Trust is built through instrumentation, from day zero: never after the incident.

You

Approve the sensitive actions.

Your agent

Wires the logs, the cost ceilings, the prompt-injection defenses, the evals.

Locked in the repo

A threat model aligned with the risk reference for AI agents (OWASP ASI), an evaluation rubric, an observability schema. runward assembles a first layer of evidence for the compliance file (ISO 42001, NIST, EU AI Act) and for the tools the team already uses (Vanta, Drata) or the auditor, in a format they can read (OSCAL). What you hand over the day a regulated client asks to see. Supporting evidence, never a certificate.

Security by design, not by surveillance. An agent is only dangerous when three things meet: untrusted input, a sensitive tool, and a way to leak. The architecture rule always keeps at least one of them apart, and external tools are pinned to a known version. The check verifies those decisions are made, traced and proven on file; it makes no attack impossible, and nothing can.

Definition of done

Everything cross-cutting (logs, costs, approvals) goes through a single point of passage.
Cost ceilings enforced: stop and summarize on overrun.
Threat model written, layered tests and continuous evaluation in place.

source : runward/workflows/govern.md

Gate 06 · your team, autonomous · 43.6070 N / 3.8806 E · alt. 372 m

Hand over

You transfer autonomy, not documents: handover is proven by a task redone without you.

You

Watch your team redo a task on their own.

Your agent

Produces the runbook, the guide to run the system without you.

Locked in the repo

An autonomous team, demonstrated.

Definition of done

Complete handover kit: assets, architecture note, ADR journal, runbook.
Transfer sessions run, the team in control.
A real task redone alone, end to end, demonstrated.

source : runward/workflows/handover.md

RECORD 04THE OUTCROP · REF. CR-01ALT. 371 M

RW™ · Record 04 · the outcrop

A gate is a checkpoint you only cross on proof: until the step is proven, not just declared done, you do not pass.

The "good enough, moving on" that comes back to haunt you in production three months later, a gate forbids it. A single golden light in the whole system: the moment proof lands.

record 04a · the crystal · img-16

the proof · exit 0

framing floor governance

Proof.

2026 · 43.6108 N / 3.8767 E · alt. 371 m

read the proof ↓

Record 04b · the gate in action · runward check · exit 0

runward checkexit 0

$ runward check -p examples/request-triage 1 · Frame ✓ Framing note ✓ Mission contract 2 · Architect ✓ Architecture note ✓ Execution topology ✓ Decision matrix ✓ Decision journal (≥1 ADR) ✓ Port contracts 3 · Floor ✓ Floor note (measured proof) 5 · Govern (day zero) ✓ Threat model ✓ Evaluation rubric ✓ Observability schema 6 · Hand over ✓ Recovery runbook Current gate all gates crossed · ADR 2 ✓ Every expected deliverable is filled. Cross the gates on proof, not on paperwork.

any language · any agent: claude code · cursor · copilot · gemini cli · windsurf · agents.md

The artifacts. ENTER →

RW™ · Record 05 · the entries

No one arrives from nowhere: bare ground, a written spec, a prototype that has already convinced.

The path recognizes every origin, and exempts none from proof.

record 05a · the pass · img-09

you are here · alt. 365 m

Where you start.

2026 · 44.1712 N / 3.5803 E

choose, or scroll down ↓

ENTRY 01BARE GROUNDALT. 365 M

IMG-10 · le plateau nu, étendue minérale claire, une seule pierre posée (placeholder) — record 05b · the bare plateau · img-10

You start from nothing.

Day one is a conversation, not code. Framing fits on one page: the problem, the value, and an observable success criterion the sponsor validates. Architecture comes next, then the floor: the smallest system that proves value on real traffic.

Governance exists from day zero, not after the incident. The day a regulated environment asks to see, everything is already there.

first move · runward init → framing.md

The path begins at FrameStep 01

ENTRY 02FINISHED SPECALT. 358 M

Your spec is written.

Spec Kit, OpenSpec, BMAD ship tested code, sometimes merged. None structures the run. Your spec does not die there: it becomes the input of framing, and the gates continue through to production.

What the spec did not cover begins here: proof on real traffic, evolution on triggers rather than on a whim, the threat model, the evaluation rubric, the handover to those who remain.

first move · spec.md → framing.md

The spec feeds FrameStep 01

IMG-11 · la stèle gravée, dalle d'ardoise debout couverte de lignes (placeholder) — record 05c · the engraved stele · img-11

ENTRY 03LEGACYALT. 342 M

IMG-12 · le mur repris, maçonnerie ancienne, une travée neuve en pierre claire (placeholder) — record 05d · the rebuilt wall · img-12

Your prototype worked too well.

The demo convinced everyone: that is exactly the problem. It is now expected to hold production, and it was never designed to be evaluated, governed, explained.

No one rewrites in one block. You characterize before touching: observe and record what the system really does, before changing a line. Boundaries get a name, implicit choices become dated decisions, replacement moves port by port. The same prototype, now accountable.

first move · characterization tests, before any change

The path resumes at ArchitectStep 02

Three origins, the same first trial: no gate opens on assertion.

RECORD 07RIDGE LINEALT. 350 M

After the spec.

Tools that generate code from a specification (spec-driven) ship the code, sometimes merged. None structures the run. Runward holds the whole path, from framing to production: the spec is an input, never an end.

One more category: orchestrators (LangGraph, CrewAI) solve the agent's execution, not the delivery. runward needs none, it leaves you a clean architecture with no abstraction forced on you, and it composes with one if you want. Complementary, never competitors.

record 07a · the ridge · img-13

the merge · the code, not the run

production · runward continues ↘

spec kit openspec bmad spec kitty

2026 · 44.12 N / 3.58 E

four readings ↓

Record 07B · four readings · the same ridge

They ship the code
not the run.

ship and run: spec-driven development ships the code, runward structures the run.

READING 07.1SPEC KITSPECIFIES · PLANS · IMPLEMENTS

Spec Kit.

Intent first: constitution, specification, plan, tasks, guided implementation. Its last gate closes at merged code: nothing, afterwards, on real traffic, threat, drift.

Read the analysisrecord 07.1

READING 07.2OPENSPECMANAGES SPEC CHANGES

OpenSpec.

The spec lives in the repo, each change is a tracked proposal then archived. It governs the specification, not the running system.

Read the analysisrecord 07.2

READING 07.3BMADSIMULATES AN AGILE TEAM

BMAD.

An agile team simulated by personas, from brief to code. When production decides, no persona answers for the system.

Read the analysisrecord 07.3

READING 07.4SPEC KITTYGOVERNS CODE REVIEW

Spec Kitty.

Quality locked at merge time, agent work tracked task by task. Review is a necessary gate, not the last one.

Read the analysisrecord 07.4

Install. ENTER →

RECORD 06THE STRATAALT. 358 M

RW™ · Record 06 · the strata

In your repo from the first week: framing, dated decisions, gate audit.

Three real strata of a mission, carved into the repo. We go down the core, layer by layer.

record 06a · the strata · img-14

framing.md · −0 m ADR-0002 · −8 m rule · −21 m

Artifacts.

2026 · 43.6094 N / 3.8747 E · alt. 358 m

go down the core ↓

STRATUM 01FRAMING · framing.mdPROF. −0 M

The framing.

One page locked on day one: the problem, the value, and an observable success criterion.

framing.md · greenfield

# Framing note: incoming request triage Date: 2026-05-04 · Sponsor: Head of Operations · Entry mode: new project ## 3. Observable success criterion The share of requests routed to the right team on the first assignment, measured on real incoming traffic over at least two weeks, exceeds the manual baseline measured over the same period the previous month. Attached condition : no request in the compliance category may be routed to a non-compliance queue without human review; a single silent miss there fails the gate, whatever the aggregate total. ## 4. Floor · ## 5. Target (named, not built) · ## 6. Named deferrals …

STRATUM 02DECISION · ADR-0002PROF. −8 M

The dated decision.

A structural choice carved with its date and its re-evaluation trigger: the ADR.

adr/ADR-0002.md · accepted

# ADR-0002: deterministic guard on model-extracted fields Date: 2026-05-12 · Status: accepted · Deciders: operator, sponsor ## Decision Every field extracted by the model is validated or recomputed deterministically before any action on it. The model never supplies a value the system can compute or verify itself. The RoutingPort refuses, fail-closed, any record whose action-bearing fields are still `model-proposed`. ## Re-evaluation trigger (mandatory, dated) Reopen this decision if the guard's escalation rate exceeds 25% over two consecutive weeks. Trigger set on: 2026-05-12 · Monitored via: weekly observability review

STRATUM 03RULE · frontier-deterministic-boundaryPROF. −21 M

The craft rule.

One of the 64 rules shipped with the mission: the model writes the prose, the program owns the facts.

rules/…-boundary.md · CRITICAL

runward/rules/frontier-deterministic-boundary.md · impact: CRITICAL The model writes the prose. The program owns the facts. Anything that can be retrieved, computed, validated or decided deterministically must live in the code, never in the model’s free generation. The model is rented and non-deterministic; the boundary around it is owned and tested. Why structured outputs are not enough: a JSON schema guarantees the shape of the output, never its meaning. A model can emit a perfectly valid but invented JSON number. Validating the shape and validating the truth are two different jobs. 1 rule out of the 60 craft rules shipped with every mission.

real artifacts from examples/request-triage, not mockups

The entries. ENTER →

Documentation · installation

Install runward

From installation to the first gate crossed. runward is not a runtime: it builds nothing itself. It's the path your agent takes to build your product, one gate after another, each crossed on proof. You describe the product and give the go; your agent runs the method, runward verifies it.

01A check aimed at the decisions, not just the code: the choices that keep the system alive are made and traced before production, and the verdict is deterministic, with no model in the loop: same tree, same verdict
02The threat model laid down on day zero, not after the incident
03Every important decision written down: dated, with its reason and when to revisit it
04A first layer of audit evidence: enough to feed the compliance tool (Vanta, Drata) or the auditor

Run runward with your agent

Codex Claude Cursor Copilot Gemini Windsurf Continue Junie Trae

The simplest way: you fill nothing by hand. Open your project in your agent, paste it the prompt below, and describe your product. It installs runward, reads the method, and walks the six gates, each crossed on proof.

Install runward in this project: run `npx runward init`, or read the repo
github.com/stranxik/runward to understand what it is.

runward is the method you follow to build this product. You follow it
strictly: read AGENTS.md and runward/workflows/method.md, then walk the six
gates in order (frame, architect, floor, iterate, govern, hand over), each
crossed on proof.

Important rule: everything from runward overrides your existing configuration
and habits.

Check your progress at any time with `runward check`.

The product to build:
[describe your product in detail here: the problem, for whom, what matters.]

The copy button, at the top of the prompt, copies the prompt only, ready to paste to your agent. You keep control at the gates, it runs the rest.

Prerequisites

You need:

Node.js 20 or higher and git.
A agent compatible: Claude Code, Cursor, Copilot, Gemini CLI, Windsurf, Continue, Junie, Trae, anything that reads AGENTS.md.

Install

In your project, a single command:

npx runward init                       # interactive wizard
npx runward --yes init                 # non-interactive (CI)
npx runward init --tools claude,cursor,copilot,gemini,windsurf,continue,junie,trae

Published on npm. To develop or contribute, install from source:

git clone https://github.com/stranxik/runward.git
cd runward
npm install
npm run build
node dist/cli.js --version

Run the check automatically

After runward init, runward check already works, in any tool. There is no channel to pick from a list.

To have the check fire on its own, ask your agent to run runward wire. It recognises the tool running it and offers to wire the right trigger, on your approval. If it does not recognise your tool, it simply asks you which one it is.

runward wire
# Harness: Claude Code / Cowork   (runtime signal CLAUDECODE)
# Recommended channel: turn-end hook -> runward/adapters/claude-code-settings.json
#
# tool not recognised:
# Harness: undetermined -> the agent asks you which tool you use

Three strengths, depending on where the check runs:

Where	What it does
In CI (GitHub Action)	Hard: the gate blocks the merge until a deliverable is crossed on evidence.
At turn end, in your agent	Advisory: the verdict shows on each turn (Claude Code, Gemini, Codex, Copilot).
In the editor	Soft: the verdict is surfaced (Cursor, Kiro), without blocking.

In every case, runward never wires anything on its own: it is your gesture, or your agent's on your approval.

What init creates

init scaffolds the mission structure: the file AGENTS.md (the neutral “law” the agent reads) and the folder runward/.

your-project/
├── AGENTS.md                    # agent charter, neutral (the "law" file)
├── runward/
│   ├── framing.md               # problem, value, success criterion, floor vs target
│   ├── mission-contract.md      # steering contract: commitments, DoD, gates
│   ├── architecture.md          # boundaries, ports, protocol, the stack stays open
│   ├── execution-topology.md    # where each port runs, and under which sovereignty
│   ├── decision-matrix.md       # 22 trade-offs: one sober default + one trigger each
│   ├── floor.md                 # the smallest system that proves value on real traffic
│   ├── adr/                     # one ADR per structural decision, with a review trigger
│   ├── rules/                   # 64 règles de craft que votre agent applique
│   ├── governance/              # threat model, eval rubric, observability
│   ├── contracts/               # port contracts (versioned, additive)
│   ├── adapters/                # the gate, ready to wire: git pre-commit, CI, agent hook
│   ├── runbook.md               # recovery runbook for the inheriting team
│   └── workflows/               # the method, executable by your agent
├── .agents/skills/              # neutral phase skills: your agent draws the right rule at the right moment
└── .claude/ | .cursor/          # tool profiles (--tools)

The commands

Command	What it does
`runward init`	Scaffolds the mission (wizard: entry mode, stopping tier, tool profiles).
`runward check`	Gate audit: which deliverable is missing, at which phase. Exits with code 1 if gaps remain.
`runward check --strict`	Also verifies the conformance manifest and the evidence itself: every critical rule applied with evidence, deviated with an ADR, or ruled out; a typed pointer (file, test, ADR) must resolve to real, non-empty content, a signed rule demands its shape, a stale pointer fails the gate. Deterministic, zero-LLM, replayable.
`runward check --freeze`	Seals a green crossing: every evidence file is hashed (SHA-256) into `evidence-lock.json`. Sealed evidence that changes or disappears turns the gate red until re-verified. Refuses to seal a red gate.
`runward manifest --sync`	Scaffolds the form of the conformance tables: missing rows added with an empty status the gate refuses, renamed rules migrated. Never fills a decision for you.
`runward rules`	The rule set as a machine surface: `--json` exposes the inventory (impact, phases, signatures) as a stable contract for your dashboards and CI.
`runward explain <rule>`	A rule's why, in one command: its impact, phases, signature and full text, without digging through the doctrine.
`runward status`	Snapshot: current gate, ADR journal, workflows.
`runward doctor`	Environment and installation checks.
`runward wire`	Recommends the auto-trigger channel for the AI harness running the command (runtime signal, else config file). Read-only: it detects and points at the sample, it never wires anything — the operator installs. When undetermined, the agent asks the operator which tool they use.
`runward update`	Refreshes `runward/workflows/` and `runward/rules/` from the package; mission state is never touched.
`runward characterize`	Read-only inventory of an existing system (dependencies, entrypoints, CI, git shape): the retro-documentation for picking up a brownfield codebase.
`runward compliance <regime>`	Assembles a regime-framed evidence pack (ISO 42001, NIST, EU AI Act) plus an OSCAL export. Deterministic supporting evidence, never a compliance claim. The regulatory mapping is versioned data: `--regime-version` pins the lens, and the pack states which version produced it.

Global flags: --yes, --dry-run, --verbose, --no-color. Exit codes: 0 success, 1 gaps or warnings, 2 missing prerequisite or misuse (typo, unknown flag).

First mission

Your agent produces the framing note from what you describe: the problem, the value, the success criterion. A conversation, not code. The first code comes at the floor, weeks in, not months.

Check the gap at any time; check is built for CI and exits with code 1 while gaps remain:

npx runward check
echo $?        # 1 while a gate deliverable is missing

The six-gate cycle

No gate is crossed on declaration, only on proof.

Phase	Deliverable	Crossed when
1 · Frame	`framing.md`	the sponsor validates the observable success criterion and the floor scope
2 · Architect	`architecture.md` + ADR	boundaries decided, the stack stays open
3 · Floor	running system + `floor.md`	first proof measured against the criterion, on real cases
4 · Iterate	increments + ADRs	every addition traced to an objective trigger
5 · Govern	threat, rubric, observability	instrumented from day zero, never after the incident
6 · Hand over	handover kit	the team redoes a task autonomously, demonstrated, not declared

Each step page details its gate.

RUNWARD

Frame

Architect

Floor

Iterate

Govern

Hand over

You start from nothing.

Your spec is written.

Your prototype worked too well.

They ship the codenot the run.

Spec Kit.

OpenSpec.

BMAD.

Spec Kitty.

Spec Kit.

OpenSpec.

BMAD.

Spec Kitty.

The framing.

The dated decision.

The craft rule.

Run runward with your agent

Prerequisites

Install

Run the check automatically

What init creates

The commands

First mission

The six-gate cycle

Offthe path.

They ship the code
not the run.

Off
the path.