Agency OS Radar

Daily open-source discoveries for a one-person AI software agency

Report date: Monday, October 26, 2026 · Agency OS Edition · Addis Ababa (EAT)

Start Here (plain English)

The problem: a one-person AI agency needs its coding agent to behave like a disciplined software team — ask what the client really needs before building, write the spec down, plan the work, test first, and review everything — not a code-spitting chatbot that improvises. Stitching those habits together by hand, every day, is exactly what a solo vibe coder has no time for.

The solution in today's radar: obra/superpowers is a free, MIT-licensed methodology, delivered as skills, that plugs into the coding agent you already use (Claude Code, Cursor, Codex CLI, OpenCode, and many more). Once installed, your agent automatically follows one connected workflow: brainstorm the requirement → get your sign-off → isolate a git worktree → write a task-by-task plan → build with subagents under strict test-first rules → review each task → finish the branch with a human merge decision. It works end-to-end like a mini software factory — and today it shipped a fresh release (v7.0.1, Oct 21, 2026) plus repo commits on Oct 20, putting it inside the 7-day activity window.

Format note: per the standing focus set Oct 25, 2026, this report uses the single-featured-factory layout (one connected project, mapped stage-by-stage) and the Ethiopia business-opportunity section remains removed. Prior reports (Oct 20–25, as listed on the previous page: SkillSpector, vercel-labs/skills, OMA, Strivy, agent-device, Trivy, OSV-Scanner, Playwright, OpenCode 2.0, promptfoo, Codex CLI, dzhng/skills, cve-lite-cli, QA Wolf CLI, paperclip, Astryx, and others) were available — Superpowers was not among them, so it is not a repeat.

The Featured Factory: obra/superpowers TEST NOW

Link: github.com/obra/superpowers
What it is (simple English): a complete software development methodology for coding agents, built from composable skills that trigger automatically. It is not a new IDE — it is the discipline layer that makes your existing AI IDE work like a factory.
What changed recently and when: v7.0.1 released Oct 21, 2026 (VERIFIED from the repo's release notes): brainstorming retuned to read your project/spec before asking anything, three long skills trimmed so they survive context compaction, and issue/PR templates now require a human-written summary. v7.0.0 (Oct 10, 2026) rebuilt brainstorming entirely. Repo commits Oct 20, 2026 updated README/templates. 686 commits, 38 tags. (VERIFIED from the GitHub repo page.)
Why it matters to a vibe coder: the agent checks for relevant skills before any task — these are mandatory workflows, not suggestions. Your AI IDE stops jumping straight to code and starts producing specs, plans, failing tests first, and review evidence — the exact artifacts Agency OS gates want to consume.
License & costs: MIT (VERIFIED from the repo LICENSE, Jesse Vincent). Free. It drives your existing coding agent, so model/subscription costs are whatever your Claude/Codex/Cursor plan already costs — open source ≠ free model access. Enterprise commercial support exists (sales@primeradiant.com) but is optional.
Windows & install: installs as a plugin into harnesses that run on Windows (Cursor: /add-plugin superpowers; Claude Code: /plugin install superpowers@claude-plugins-official; Codex CLI via /plugins). A Feb 2026 repo commit fixed Windows hook window spawning, showing Windows is a supported target — but plausible, untested on this PC today. Repo test scripts (run-*.sh) are bash-oriented; running the skills themselves needs no bash.
Verdict: TEST NOW — free, local, no new subscription, works with tools you already have.

The Factory Map — Superpowers onto the Agency OS Lifecycle

All skill names and artifacts below are VERIFIED from the repo README (workflow and skills library sections).

Agency OS stage	Superpowers skill	Artifact it produces	Which gate consumes it
LEAD	— (not covered)	—	—
DISCOVERY / PROBLEM_DEFINITION	brainstorming	Questions, a played-back understanding, and a written design document for projects (small changes agreed in chat)	PROBLEM_DEFINITION gate: the design doc is the first evidence a real requirement exists
PROPOSAL / SPECIFICATION	brainstorming (per v7.0.1 notes: lays out 2–3 approaches, recommends one, asks you to pick) + human sign-off	Approved design document; approach choice recorded	SPECIFICATION gate: human approval of the design before any build
ARCHITECTURE / DEVELOPMENT	using-git-worktrees → writing-plans → subagent-driven-development (or executing-plans)	Isolated worktree with verified clean test baseline; plan of 2–5-minute tasks with exact file paths and verification steps; per-task commits	DEVELOPMENT gate: plan file + task completion evidence per subagent
QA	test-driven-development, requesting-code-review, verification-before-completion	Failing test → passing test diffs (RED-GREEN-REFACTOR; code written before tests is deleted); review reports by severity where critical issues block progress	QA gate: test evidence + review report, not agent claims
SECURITY	— (not covered; see Honest Gaps)	—	—
CEO_REVIEW / RELEASE	finishing-a-development-branch	Verified test results + human merge/PR/keep/discard decision	RELEASE gate: human approval step is built into the skill
MAINTENANCE	systematic-debugging (4-phase root cause), diagnosing-superpowers	Root-cause traces; session-transcript reports with line-level evidence; scrubbed bug-report bundles	MAINTENANCE gate: evidence-based incident records
REUSABLE_COMPONENT	writing-skills (partial)	New reusable skills, tested via the superpowers-evals drill harness	REUSABLE_COMPONENT gate: a skill is reusable only after its eval passes

Honest Gaps

Not covered (VERIFIED from the README's skill list): no LEAD tracking, no SECURITY stage (no dependency scanning, secret detection, or vulnerability auditing), no deployment/RELEASE automation, and no governance layer — nothing like project-state.json or a gate engine. Superpowers disciplines the build; it does not govern the factory.
Biggest gap, one verified filler: SECURITY. cloudflare/security-audit-skill (MIT, VERIFIED from its LICENSE) is a coding-agent skill that runs a six-phase security audit — reconnaissance, coverage-led hunting, candidate validation, structured machine-readable findings (findings.json validated against report-schema.json), independent record verification, target-neutral reporting. It seeds Cloudflare's own vulnerability-discovery harness. Honest note: its latest commit is Sep 14, 2026 — verified to exist and work as documented, but NOT active within the last 7 days. INVESTIGATE

Why It Fits Agency OS

No invented facts: verification-before-completion makes the agent prove it's fixed before declaring success — the same VERIFIED-before-advancing rule Agency OS enforces.
Evidence before advancing: TDD skill deletes code written before tests; code review blocks critical issues — external, checkable evidence, not claims.
Human approval points built in: design sign-off before planning; merge/PR/keep/discard decision at branch finish — matching Agency OS's human-approval rule for scope and release.
Isolation: git worktrees keep every change on a verified-baseline branch, so nothing touches main without evidence.
Complements, never replaces: Superpowers produces the artifacts; gate_engine.py stays the authority over whether a gate advances. Agency OS compatibility: plausible — untested until you run it alongside your scripts.

Limitations, Risks & Human Review

Telemetry: by default, an optional visual-companion logo is loaded from the project's website, including your Superpowers version (nothing about your project/prompt, per the README). Disable with SUPERPOWERS_DISABLE_TELEMETRY — worth doing for client work.
Model costs: subagent-driven development spawns fresh agents per task — thorough but token-hungry; executing-plans is the cheaper inline mode.
Autonomy risk: the README says sessions can run autonomously for a couple of hours — run in a scratch repo with scoped permissions first; never grant unrestricted computer access; keep human approval for commercial decisions and anything touching client repos.
Windows: hook spawning has Windows-specific fixes in the repo, but plugin behavior on Windows is untested here — verify on a scratch project before client use.
Discipline depends on the model: skills are instructions, not hard enforcement — a weak model can still skip them; that's why gate_engine.py stays in charge.

Test Today: Superpowers in your AI IDE (~45 min)

Why this one: installs into the AI IDE you already use on Windows; free, MIT, no new subscription, no API keys beyond your existing plan.
Prerequisites: Windows PC; your existing coding agent (Cursor, Claude Code, or Codex CLI) with a working subscription; git installed; a scratch folder.
Official installation (from the README): Cursor: /add-plugin superpowers in Agent chat. Claude Code: /plugin install superpowers@claude-plugins-official. Codex CLI: /plugins → search "superpowers" → Install. Update later by reinstalling (updates are often automatic).
Practical test: in an empty scratch repo, ask the agent to build a tiny feature (e.g., a CLI tip calculator). Expect it to (1) start brainstorming and ask what you really want, (2) present a design for sign-off, (3) create a worktree, (4) write a task-by-task plan, (5) write a failing test first, then code. Intervene only at the approval points.
Expected results: a written design doc + plan file in the repo, RED→GREEN test commits, a code-review report, and a human merge decision at the end. If the agent skips straight to writing code, the skills didn't load — reinstall.
Safety precautions: scratch repo only; set SUPERPOWERS_DISABLE_TELEMETRY for privacy; keep permissions scoped; do not point it at any client repository during the test; never let the agent run unattended with broad shell access.

Agency OS Integration Proposal: Superpowers as the DEVELOPMENT→QA evidence producer

Problem solved: the dev and QA agents currently rely on prompts to behave well; Agency OS has no enforced plan-artifact + test-first evidence chain from the coding IDE itself.
Exact workflow/agent it improves: the dev agent's implementation loop and the QA agent's unit-test evidence — feeding, never replacing, gate_engine.py, precommit_check.py, and prepush_release_check.ps1.
Where in the lifecycle: SPECIFICATION (approved design doc) → DEVELOPMENT (plan file, worktree) → QA (TDD test evidence, review report).
Inputs: your feature request; existing project files (brainstorming reads them first, per v7.0.1).
Outputs: design document, plan file with exact file paths, per-task commits with RED→GREEN tests, severity-ranked review report, merge decision record.
How results are validated: a task counts as done only if the failing-test commit, passing-test commit, and review report exist in the repo — artifacts, not claims. A SUPERPOWERS-sourced claim without its artifact stays UNVERIFIED in project-state.json.
What happens on failure: critical review findings block task progress inside the session; a missing artifact blocks gate advancement in gate_engine.py as it does today.
Blocks a gate or needs human approval? Neither change is proposed: the gate engine keeps its current rules; Superpowers feeds it better evidence. Design sign-off and merge remain human decisions — matching Agency OS governance.
Smallest safe experiment: build one small internal tool with Superpowers in a scratch repo; copy its plan file, test commits, and review report into your project-state.json evidence format; then add one artifact-existence check to a copy of precommit_check.py on a test branch and observe. No gate-engine changes.

Daily Learning: subagent-driven development with fresh-context review

Concept (simple English): instead of one agent writing everything, a dispatcher sends each small task to a fresh subagent with no history, then a reviewer subagent inspects the result against the plan. Fresh eyes catch what invested authors miss; two-stage review checks spec compliance first, then code quality.
How an AI agent might get it wrong: the implementer subagent reports "task complete" without ever running the tests, or the reviewer rubber-stamps because the dispatcher shared its own optimistic summary instead of the actual diff.
How you recognize the failure: a "complete" task with no failing→passing test pair in git history; a review report that praises code that doesn't match the plan's file paths.
Which tool/test detects it: Superpowers' test-driven-development skill (deletes code written before tests) and verification-before-completion, plus git history inspection — and at the Agency OS level, the gate engine's existing evidence checks before QA advancement.

Final Summary

Best discovery today: obra/superpowers — a full, MIT-licensed, factory-grade methodology that installs into your existing AI IDE (v7.0.1, Oct 21, 2026).
Best security/reliability improvement: pairing it with cloudflare/security-audit-skill for the SECURITY stage Superpowers lacks — machine-readable, independently verified findings.
Best Agency OS integration: Superpowers as the DEVELOPMENT→QA evidence producer (plan files, RED→GREEN tests, review reports) feeding — never replacing — gate_engine.py.
One practical action today: install Superpowers in Cursor or Claude Code and build one tiny scratch-repo feature with the full brainstorm → plan → TDD → review loop.