你没有自动化问题。你有决策问题。

每个AI代理的恐怖故事结局都一样：一个没人停下来质疑的行动。拼凑操作系统是代理冲动和行动之间的一层——一个本地优先的运行时，你的AI可以在编辑、GitHub、Slack、Gmail和45+服务中自动完成实际工作，而任何重要的事情都可以先停下来问你。

** 是给谁的：** 已经在真实系统上运行代理的开发者和技术操作员——一个可发货的仓库、一个重要的收件箱、一个生产服务——他们希望有记录允许的内容及其原因。它期望有终端、节点安装，并且能轻松编辑 YAML。

三个想法，一个时长：

• 行动前请先询问。 每个动作都按爆炸半径分类——能被撤销吗？如果错误会破坏多少？可逆的事情可以自由流动。风险事件会在批准队列中等待，附带证据：具体什么会运行，为什么会发射，如果错误会发生什么。

• 信任是赢得的，从不被假设的。 工人——有职位的指定代理人——开始时在监督下开始，并根据行动类型获得独立于其过往记录。

Patchwork OS

You don’t have an automation problem. You have a decision problem.

Every AI-agent horror story ends the same way: an action nobody stopped to question. Patchwork OS is the layer between the agent’s impulse and the action — a local-first runtime where your AI can automate real work across your editor, GitHub, Slack, Gmail, and 45+ services, while anything consequential can be made to stop and ask you first.

Who it’s for: developers and technical operators who already run agents against real systems — a repo that ships, an inbox that matters, a production service — and who want a record of what was allowed and why. It expects a terminal, a Node install, and comfort editing YAML.

Three ideas, one runtime:

• Ask before acting. Every action is classified by blast radius — can it be undone, and how much breaks if it’s wrong? Reversible things flow freely. Risky things wait in an approval queue with the evidence attached: what exactly will run, why it fired, and what happens if it’s wrong.

• Trust is earned, never assumed. Workers — named agents with jobs — start supervised and earn independence from their track record, per action type. Good at filing issues ≠ allowed to push code. One bad high-stakes action outweighs a hundred trivial successes. You set the ceiling; the math never raises it for them.

• Every decision leaves a receipt. What was done, why it was allowed, and how it turned out — durable, replayable, explainable via patchwork judgments, the dashboard’s traces page, and patchwork gate explain. When you approve something, you find out later whether you were right.

An agent wants to write a file. With the gate on, it waits — and shows you exactly what it would do:

You approve. The call proceeds, and both halves are on the record:

Status: stable 1.2

Version 1.2.6, published to npm as latest. The decision layer, recipes, connectors and IDE bridge all work and are dogfooded daily. Interfaces can still change between minor versions and some surfaces are rougher than others. Pin an exact version if you are building on it.