- Reliability 6/20
- Static review rests only on the root README plus the repo description; the SERVER MANIFEST is not cached, so the declared MCP tool surface cannot be matched against actual behavior, which caps this dimension. The README claims a genty start-server --transport stdio MCP server and a babysitter-mcp-server binary, but never lists that server's tools, parameters, or initialization handshake, so the core MCP path is unverifiable. The project is a large monorepo with many packages (@a5c-ai/babysitter, adapters-cli, genty-platform, SDK, atlas, kradle, kip-sdk) and layered runtimes with differing Node floors (20.0.0+ vs 22.13.0+), raising dependency and startup complexity while leaving error handling and failure diagnosis unverifiable statically. A CI badge pointing at ci.yml is a verifiable sign of automation, but no committed tests covering the MCP server's key paths are shown. Deductions: missing manifest, undisclosed tool list, heavy runtime dependencies, no static evidence of error handling or replay correctness.
- Security and permissions 7/20
- No red lines triggered: no malware, credential theft, covert exfiltration, or default irreversible delete/pay/deploy/remote-command behavior is evidenced, and install examples contain no real tokens or secrets. However, permission and data-flow disclosure is incomplete. The product's core premise is 'enforcing obedience' via hooks that register inside the host harness and impose mandatory stops and gates on agent behavior, which is a strong intervention into agent execution permissions, yet the README describes it only in marketing terms with no least-privilege design, scope boundaries, data-boundary statement, or confirmation mechanism for dangerous operations. State is written to ~/.a5c/runs/ by default with repo-local .a5c/runs/ compatibility reads, and the event-sourced journal records every task and decision, but there is no discussion of redaction, access control, or retention limits. The internal harness can discover and delegate tasks at runtime to other harness CLIs (Claude Code, Codex, Gemini CLI, etc.), widening the external-process invocation surface with no stated sandbox or allowlist. The compression subsystem processes prompts and shell output, but its data flow is not disclosed. Deduction: confirmation, scoping, and data-flow disclosure all incomplete.
- Maintenance 9/20
- The MIT license is explicit and consistent with the description, and there are CI badges, Discord, GitHub Issues/Discussions, CONTRIBUTING.md, and npm publishing channels, so maintenance and response channels exist and are discoverable. Governance and versioning gaps remain: maintainer identity is only asserted via the slogan 'Built with Claude by A5C AI' with no named owner or security-response process; the project is at v6 with a '0.0.x to v6' migration guide, indicating large breaking changes; kip-sdk is 0.0.1/private and unpublished, self-described as internal; and 427 open issues against 1783 stars is a heavy defect backlog, suggesting lagging issue response. Scored as active but with governance and versioning gaps.
- Documentation 11/20
- Documentation volume is substantial: the README offers a multi-harness install matrix, CLI and adapters-CLI references, a package/plugin and monorepo structure map, compression config examples, blueprint and process notes, and links to FAQ, troubleshooting, security, CLI reference, and process-library sub-docs, so a layered structure broadly exists. Deductions: the manifest is not cached, and the MCP server paths (genty start-server / babysitter-mcp-server) never disclose tool parameters, auth, limits, or cost in the README; harness support is mostly labeled Experimental/Beta while the capability claims read as mature; quantitative claims such as '2,000+ pre-built processes' and '50-67% reduction with 99% fact retention' have no verifiable evidence; and the install chapter carries hidden assumptions (manual Claude Cowork click-through, private-repo requirement for GitHub-synced org marketplaces). Usable, but with hidden assumptions and troubleshooting gaps, hence no higher score.
- Setup experience 7/20
- Install paths are numerous and must be carefully distinguished: npm global packages (@a5c-ai/babysitter, @a5c-ai/adapters-cli, @a5c-ai/genty-platform), per-harness marketplace commands, and babysitter harness:install-plugin. The README itself warns that the two install tracks 'should not be conflated', adding cognitive burden. Runtime prerequisites are heavy: Node 20+ with the host-side adapters CLI separately requiring 22.13.0+ (for the built-in node:sqlite), plus a supported AI coding harness and initial /babysitter:user-install, project-install, and doctor steps. Concrete Claude Code and Codex commands are given, which are real client-config examples and add some operability; but the manifest is missing, MCP client connection config lacks direct examples, and the primary plugin-marketplace path is fragile outside official marketplaces. Judged workable but multi-step, error-prone, and partly manual.