🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP
Sign In

@touchskyer/opc

Package Overview
Dependencies
Maintainers
1
Versions
25
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@touchskyer/opc

OPC — One Person Company. Task pipeline with independent multi-role evaluation.

Source
npmnpm
Version
0.10.1
Version published
Weekly downloads
4
-92.98%
Maintainers
1
Weekly downloads
 
Created
Source

OPC — One Person Company

A full team in a single Claude Code skill. You're the CEO — OPC is everyone else.

16 specialist agents (PM, Designer, Security, Devil's Advocate, and more) that build, review, and evaluate your code through a digraph-based pipeline with code-enforced quality gates.

What's Different in v0.8

Compound eval quality gate (D2). 11-layer substance check on every eval — thin content, missing code refs, low uniqueness, fabricated references, aspirational claims, change scope coverage, etc. ≥3 layers tripped → hard FAIL (enforce by default); --no-strict downgrades to shadow mode. thinEval substance exemption: short evals with complete reasoning/fix/refs are exempt. Evaluator guidance: when D2 triggers, evaluatorGuidance output tells the evaluator exactly which layers failed and how to fix.

Iteration escalation (D3). Persistent eval warnings across ≥2 iterations auto-escalate to FAIL. No more infinite loops of shallow reviews.

Task Scope Registry. Loop mode plans require ## Task Scope with SCOPE-N items. The harness validates at init and blocks completion if any scope item is uncovered — preventing the #1 failure mode where LLM decomposition silently drops requirements.

Pipeline E2E lint. Tasks containing pipeline keywords (cron, webhook, CI/CD) must have an e2e-live-trigger acceptance criterion. Proxy evidence (unit tests) ≠ live evidence.

Evaluator prompt hardening (D6). 5 evidence standards baked into the evaluator protocol: cite evidence, address anomalies, no aspirational claims, distinguish root cause vs symptom, cover change scope.

What's Different in v0.7

Third-party extension authoring. docs/extension-authoring.md (7800+ words) + examples/extensions/_starter/ (30-min walkthrough). Hardened via DX litmus: an independent agent built an extension using only the doc + starter.

What's Different in v0.6

Digraph engine. Tasks flow through typed nodes (build → review → gate → ...) with mechanical verdict routing. No more linear pipelines.

Autonomous loop. opc loop decomposes a feature into units, schedules a durable cron, and runs 8-16 hours unattended — with code-enforced guardrails that survive context compaction.

Code-enforced, not honor-system. 29 test suites verify: tamper detection (write nonce), atomic state writes, review independence, oscillation detection, tick limits, scope coverage, compound defense, and JSON crash recovery.

External validator integration. Pre-commit hooks, test suites, Playwright E2E, and CI pipelines are formally part of the quality architecture — the agent is supervised by tools it doesn't control.

How It Works

One principle: the agent that does the work never evaluates it.

Task → Flow Selection → Node Execution → Gate Verdict → Route Next
                              ↑                              ↓
                              └──────── ITERATE/FAIL ────────┘
  • Task inference — reads your request, picks a flow template (review, build-verify, full-stack, pre-release), and enters at the right node.

  • Typed nodes — each node has a type (discussion, build, review, execute, gate) with specific protocols. Build nodes produce commits. Review nodes dispatch parallel subagents. Gate nodes compute verdicts from code, not LLM judgment.

  • Mechanical gates — verdicts are computed by opc-harness synthesize: any red = FAIL, any yellow = ITERATE, all green = PASS. No LLM gets to decide if a finding is "important enough."

  • Cycle limits — max 3 loops per edge, 5 re-entries per node, 20-30 total steps depending on flow. Oscillation detection catches A↔B loops.

Quick Start

Install

npm install -g @touchskyer/opc

Skill files are automatically copied to ~/.claude/skills/opc/.

Manual install (no npm)

git clone https://github.com/iamtouchskyer/opc.git
cp -r opc ~/.claude/skills/opc

Use it

# Review — dispatches 2-5 role agents in parallel
/opc review the auth changes

# Build — implements + independent review + gate
/opc implement user authentication with email/password

# Autonomous loop — decomposes, schedules cron, runs unattended
/opc loop build features F1-F4 from PLAN.md

# Interactive mode — asks clarifying questions first
/opc -i redesign the onboarding flow

# Explicit roles
/opc security devil-advocate

# Flow control
/opc skip          # skip current node
/opc pass          # force-pass gate
/opc stop          # terminate, preserve state
/opc goto build    # jump to node

Extensions

OPC has a capability-routed extension surface. Extensions live in ~/.claude/skills/opc-extension/<name>/ — each with ext.json (capability declarations) + hook.mjs exporting any of promptAppend / verdictAppend / executeRun / artifactEmit hooks. No fork, no rebuild. Hooks are sandboxed via per-extension timeouts + circuit breakers, so a broken third-party extension can't take down the harness.

The companion repo opc-extensions ships 4 extensions: design-intelligence (theme injection + design coverage + VLM visual eval), git-changeset-review, memex-recall, and session-logex.

Full authoring guide: docs/extension-authoring.md — zero-OPC-context quickstart + reference, plus a starter template at examples/extensions/_starter/.

Flow Templates

TemplateNodesWhen
reviewcode-review → gatePR review, audit, "find problems"
build-verifybuild → code-review → test-design → test-execute → gate"implement X", "fix bug Y"
full-stackdiscuss → build → review → test → acceptance → audit → e2e → gatesComplex/vague requests
pre-releaseacceptance → audit → e2e → gates"verify before release"

Autonomous Loop (v0.6)

/opc loop build the math tutoring app features F1-F4

What happens:

  • Runbook lookupopc-harness runbook match "<task>" checks --dir flag → OPC_RUNBOOKS_DIR~/.opc/runbooks/ for a matching recipe. If one hits, its units / flow / tier become the plan; otherwise fall through to step 2. Disable per-invocation with OPC_DISABLE_RUNBOOKS=1. See docs/runbooks.md and examples/runbooks/add-feature.md.
  • Decompose (runbook miss only) — breaks task into atomic units (spec, implement, review, fix, e2e)
  • Definition of done — establishes verify/eval criteria per unit before any work starts
  • Schedule — durable cron (survives process restart) fires every 10 min
  • Execute — each tick runs one unit through the appropriate OPC flow
  • Guardopc-harness enforces: git commit required, ≥2 independent reviewers, no plan tampering, no state forgery, artifact freshness, tick limits
  • Terminate — auto-stops when plan complete, tick limit hit, or wall-clock deadline reached

Guardrails (code-enforced, not prompt-level)

GuardEnforcement
Write nonceRandom SHA256 at init; state written by harness only
Atomic writeswrite → rename (POSIX atomic); no truncated JSON on crash
Plan integritySHA256 hash at init; verified every tick
Review independence≥2 eval files, identical content rejected, line overlap warned
Git commit requiredHEAD must change for implement/fix units
Screenshot requiredUI units must produce .png/.jpg artifact
Tick limitsmaxTotalTicks (units×3) + 24h wall-clock deadline
Oscillation detectionA↔B pattern over 4-6 ticks = warning/hard stop
Concurrent tick mutexin_progress status blocks overlapping cron fires
JSON crash recoverytry/catch on all JSON.parse; structured errors, not crashes
External validatorsPre-commit hooks, test suites detected at init and leveraged

Built-in Roles

Product:     pm, designer
User Lens:   new-user, active-user, churned-user
Engineering: frontend, backend, devops, architect, engineer
Quality:     security, tester, compliance, a11y
Specialist:  planner, user-simulator, devil-advocate

Devil's Advocate (the 10th person) is auto-included when consensus is near-unanimous or decisions are irreversible. Comes with an automated verification script that checks its own findings.

Custom Roles

Add a .md file to roles/:

---
tags: [review, build]
---
# Role Name

## Identity
One sentence: who you are and what you care about.

## Expertise
- **Area** — what you know about it

## When to Include
- Condition that triggers this role

Available immediately, no configuration needed.

Testing

bash test/run-all.sh

84 test files covering init-loop, complete-tick, next-tick, review independence, JSON crash recovery, compound defense, scope registry, criteria lint, pipeline E2E lint, D2 calibration, and orchestrator-level E2E flow tests.

Reproducing benchmarks

OPC ships with an extension system (v0.5, Run 1) so you can plug in additional hooks — visual checks, design-system audits, a11y scans — without forking the skill. The extension loader honors three bypasses so a single harness invocation can ignore locally-configured extensions:

# Disable every extension for one harness run
OPC_DISABLE_EXTENSIONS=1 node bin/opc-harness.mjs init --flow review --entry review --dir .harness

# Same effect, CLI flag form
node bin/opc-harness.mjs init --flow review --entry review --dir .harness --no-extensions

# Whitelist specific extensions only
node bin/opc-harness.mjs init --flow review --entry review --dir .harness --extensions visual-check,a11y

Priority order: OPC_DISABLE_EXTENSIONS=1 env var > --no-extensions CLI flag > --extensions foo,bar whitelist > config in ~/.claude/skills/opc-extension/config.json. See docs/specs/2026-04-16-opc-extension-system-design.md for the full contract.

Note: bash test/run-all.sh runs OPC's own internal test suite, which includes tests that intentionally load extensions to exercise the system. Don't set OPC_DISABLE_EXTENSIONS=1 when running the suite — use the bypasses only on real benchmarking / workflow invocations.

Requirements

  • Claude Code (CLI, desktop app, or IDE extension)
  • Node.js >= 18
  • No runtime dependencies, no MCP server, no build step

Works better with memex (optional)

OPC works standalone — pair it with memex for cross-session memory. Memex remembers which roles were useful, which findings were false positives, and your project-specific context.

npm install -g @touchskyer/memex

Community

Using OPC? Share your setup in Discussions → Show and tell. Questions go in Q&A. Feature ideas in Ideas.

License

MIT

Keywords

claude-code

FAQs

Package last updated on 22 Apr 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts