# Agent Ops bundle: run a service and its agents from one runbook a script can check

> Release Watch, Agent Control Room, Agent Status Hardware and Shrink the Attack Surface in full, tied into one daily loop by a new Ops Runbook: plain files for agents and their owners, tested stops, room names and lights, watched changes, attack surface decisions with proofs, action gates and monthly drills. ops.py answers every action with go, ask the owner or never, and a fifteen-check script names every gap. A risky action waits for the owner's yes typed at their terminal and tied to that request's sha256.

- URL: https://paperchasewebb.ai/bots/marketplace/items/agent-ops-bundle-run-a-service-and-its-agents-from-one-runbook/
- Type: Bundle
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block; the scripts were tested on Linux with Python 3.13, the agent files were not loaded inside each harness
- Price: $69 USD
- Difficulty: Intermediate
- Setup time: 1 hr
- Time to result: A checked, ratified runbook in one afternoon once the four packs are installed
- Format: Markdown (.md) file, agent-ops-bundle-run-a-service-and-its-agents-from-one-runbook.md
- Version: 1.0, updated 2026-10-29
- License: Use on your own machines and on services you run for clients and teams. Do not resell or republish the bundle itself.

## What you end up with

Agents that work on your live service on their own for safe tasks, a watch on every change, a light for every session, and no rollback, deploy, merge or key change without your typed yes on that exact request.

## What you get

- Four packs in full: Release Watch, Agent Control Room, Agent Status Hardware and Shrink the Attack Surface ($106 bought separately)
- The Ops Runbook (only in this bundle): one folder of plain files for agents, changes, surface, actions and drills, with templates
- A daily ops loop: what happens when, which runbook file it lands in and which pack it comes from
- ops.py: a gate for every action (0 go, 11 ask the owner, 12 never), requests, owner approval at a terminal tied to the request sha256, verify with expiry, one use per yes
- ops_check.py: fifteen read-only checks, with a seeded test runbook (15 findings, then 0)
- A skill file for Claude Code, Codex and Hermes, an AGENTS.md snippet and a Grok Bot rules block
- Ten prompts, a failure table and a worked example
- A look at eight ops and agent-monitoring packs, with sources

## Who it is for

Builders and small teams who run a real service with several agents on it and want one place that says what agents do alone and what waits for a person.

## Tools needed

- Grok Bot, Claude Code, Codex or Hermes: the agents that run on the service; each reads the skill file, AGENTS.md snippet or rules block and checks ops.py gate before acting
- Python 3: runs ops.py (init, hash, gate, request, owner approval, verify, done) and the fifteen-check checker; standard library only, no network
- The service owner: names each agent's owner, tests every stop, decides keep, remove or lock, and types each yes at their own terminal
- You need: Any of Grok Bot, Claude Code, Codex or Hermes
- You need: Python 3.9 or newer
- You need: A service you run with git, and a terminal you control

Cost to run: The bundle is the only purchase. The checker and ops.py use no model tokens. Status lights are optional hardware you buy yourself; a terminal light works with none.

## What is in the bundle (4 packs)

| Pack | Format | Separate price |
|---|---|---|
| [Release Watch: a per-change monitoring plan your agent writes from the diff, run by a fixed script](https://paperchasewebb.ai/bots/marketplace/items/release-watch-per-change-monitoring-plan-from-the-diff.md) | Bot template | $24 |
| [Agent Control Room: voice control for a dozen agents](https://paperchasewebb.ai/bots/marketplace/items/agent-control-room-voice-control-for-a-dozen-agents.md) | Bot template | $29 |
| [Agent Status Hardware: one light and one e-ink display for every agent session, driven by hooks](https://paperchasewebb.ai/bots/marketplace/items/agent-status-hardware-lights-and-e-ink-via-hooks.md) | Bot template | $14 |
| [Shrink the Attack Surface: patch with proof, then attack your own agent's tools](https://paperchasewebb.ai/bots/marketplace/items/shrink-the-attack-surface-patch-with-proof.md) | Bot template | $39 |
| Bought separately | | $106 |
| The bundle | | $69 |

## How it works

1. **Run the tests.** Copy the agent-ops-bundle folder and run sh test_all.sh. Expected: 15 findings on the seeded runbook and 0 on the fixed one, 15 of 15 single faults caught alone, checker tests 25 passed, ops tests 37 passed, exit 2 on a missing folder.
2. **Install the four packs.** Set up Release Watch, Agent Control Room, Agent Status Hardware and Shrink the Attack Surface, each to 0 on its own checker. Expected: A watch on your last change, voice routing by name, a light per session and a surface list with decisions.
3. **Start the runbook.** Run ops.py init ops/<service>, fill ops.json, let your agent draft agents.csv, then stop each agent yourself and write the date. Expected: Every agent has an owner, a room name, a light and a tested stop.
4. **Gate and drill.** Add your safe daily actions as agent-ok, keep the ten risky ones owner-yes, and run the five drills. Expected: ops_check.py shows only O15.
5. **Ratify and run.** Run ops.py approve --runbook at your own terminal. From then on agents check ops.py gate before every action. Expected: Safe actions go ahead, risky ones arrive as requests you approve by hash, and any edit to the runbook stops every gate until you ratify again.

## Sample prompt: Morning check (Grok Bot, Claude Code, Codex, Hermes)

```
Run ops_check.py on ops/<service>. Show me the findings in order, the smallest fix for each, and the runbook hash.
Edit nothing until I say yes.
```

Prompt 3 of 10.

## Sample prompt: Before acting (Grok Bot, Claude Code, Codex, Hermes)

```
Before any action today, run ops.py gate for it and tell me the exit code.
On 11, write the request and show me its path and sha256, then wait. On 12, do not do it and tell me why.
```

Prompt 4 of 10.

## Free preview of agent-ops-bundle-run-a-service-and-its-agents-from-one-runbook.md

````markdown
# Agent Ops bundle: run a service and its agents from one runbook a script can check

Version 1.0, 2026-10-29. By PaperChaseWebb. A bundle of four paid packs (Release Watch, Agent Control Room, Agent Status Hardware, Shrink the Attack Surface) plus a new Ops Runbook that ties them into one daily operating loop. The runbook comes with a gate and approval script, a read-only checker with fifteen checks, templates, a seeded test runbook, ten prompts and the tests, all Python 3 standard library. Works with Claude Code, Codex and Hermes through a skill file and an AGENTS.md snippet, and with Grok Bot through a rules block. Tested as described in section 10: everything ran on Linux with Python 3.13, including owner approvals typed at a pseudo-terminal. The skill file, snippet and rules block were not loaded inside the harnesses for this release, and the runbook has not been run on a live system. Each limit is marked where it matters.

Most ops and SRE packs for agents are a list of prompts: "write a postmortem", "triage this alert", "draft a runbook". The prompts are fine. What goes wrong is everything between them. A change goes live and nobody watches the paths it touched. Three agents are running and you cannot tell which one is waiting for you. Someone says "yeah, go" near a microphone and an agent takes it as a yes. A debug route from last spring is still open. The rollback that was supposed to need your approval was marked agent-ok in a config nobody reread.

This bundle is b
````

## Test record

- Date: Oct 29, 2026
- What was run: ops_check.py on a seeded runbook and a fixed copy, each planted fault alone, a missing input, and the unit tests. Linux, Python 3.13.
- Result: 15 findings on the seeded runbook, 0 on the fixed one; 15 of 15 planted faults caught alone; exit 2 on missing input; nothing written. 25 checker and 37 ops.py tests passed, 0 failed.
- Not run: The agent files inside Claude Code, Codex, Hermes or Grok Bot. A live system, real status lights or a real microphone. Windows.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The checker checks that each ops decision was made and written down. It cannot tell whether a stop really works, a watch really fires or a proof really tests the fix; the drills and the included packs' own checkers do that.
- The skill file, AGENTS.md snippet and Grok Bot rules block were not loaded inside Claude Code, Codex, Hermes or Grok Bot for this release, and the runbook has not been run on a live system, real status lights or a real microphone. The test runbook is a made-up booking app. Linux only; Windows was not tested.
- The gate makes the rules plain and testable; it does not sandbox an agent. Pair it with each harness's own permission settings.
- The approval script refuses piped input and the environment variables Claude Code, Codex, Hermes and Grok Bot set. That stops an agent approving by mistake; it is not a lock against someone with the same account.
- On 2026-10-29, on Linux with Python 3.13.5: ops_check.py gave 15 findings on the seeded runbook (each check once) and 0 on the fixed one, caught 15 of 15 single faults with only its own check, wrote nothing, and exited 2 on a missing folder, any missing file or broken ops.json; checker tests 25 passed, 0 failed; ops.py tests at a pseudo-terminal 37 passed, 0 failed.
- The bundle contains the versions listed on this page on the day you buy. Each included pack keeps its own notes and limits.

## Questions

**Why not buy the four packs on their own?** You can, for $106. The bundle is $69 and adds the Ops Runbook, which is only here: the gate every agent checks before acting, approvals tied to one request, and one checker across all four parts.

**Does it replace a paging or status page product?** No. It decides what agents may do and makes sure changes are watched. Keep your pager and status page.

**Can an agent or a voice command approve a rollback?** No. ops.py approve refuses piped input and the agent environments it recognizes, and voice is off on every action. The owner types their name and part of the request hash at their own terminal.

**What if I edit the runbook after ratifying?** The runbook hash changes, every gate answers never and older requests stop verifying, until you ratify again.

**What if I want it set up with me?** Book a call on the paperchasewebb.ai homepage about the $5,000 Install sprint, or Manage at $5,000 a month to keep the runbook and drills current.

## How to buy

$69 one time at https://paperchasewebb.ai/bots/marketplace/items/agent-ops-bundle-run-a-service-and-its-agents-from-one-runbook/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com