01
Create
Agents produce software on a known Rails surface.
Technical Trust
Agent-built software still needs to earn trust.
Start personal, share with your team, and launch when it should exist.
That only works when the foundation stays inspectable, deployable, and portable.
02
Inspect
Humans and agents can read the code, context, and checks.
03
Run
Deployment stays portable as the audience grows.
The trust checklist
Every piece of software an agent creates should be reviewable across these six areas.
Code Architecture
Clear separation of concerns. Consistent conventions. No mystery structure only the generating agent understands.
Test Coverage & CI
Automated checks that run before deployment. Enough coverage to change software without guessing whether the agent broke it.
Security Posture
Dependency scanning, static analysis, no hardcoded secrets. Auth that follows framework conventions, not one-off inventions.
Deployment & Infra
Reproducible deploys. Not "SSH in and run commands." The agent needs a real path from change to running URL.
Documentation
Context files, setup notes, and architecture decisions. The next agent or developer can understand what exists.
Portability
Can personal software become team software or a public application without rewriting around a vendor lock-in?
Red flags that break trust
These are the findings that make agent-built software hard to own, operate, or grow.
"Works on my machine" deployment
No deploy scripts. No CI/CD pipeline. Deployment is a manual process that lives in one person's head.
No tests, or tests that don't run
A test suite that's been disabled, skipped, or never existed. Humans and agents cannot verify the app works as expected.
Hardcoded secrets, no security scanning
API keys in source code. No dependency auditing. No static analysis. This is not a shortcut; it is a liability.
Platform lock-in
Can't migrate without rewriting. Deep dependencies on a specific PaaS, proprietary APIs, or serverless functions that only run on one platform.
No documentation for the next developer
No README. No architecture notes. No context path. If the original agent session disappears, the codebase becomes an archaeology project.
Tangled architecture
No clear separation of concerns. Business logic in views. Database queries in controllers. Everything coupled to everything else.
How Omaship addresses each checkpoint
Every trust item maps to a specific part of the Omaship foundation.
01
Code architecture
Rails 8 conventions. Models, controllers, services in expected locations. AGENTS.md gives agents and humans project context.
02
Test coverage & CI
CI pipeline from day one. Every push can run tests, linting, and security scanning before deployment.
03
Security posture
Brakeman static analysis and bundler-audit run in CI. Rails 8 native authentication. Secrets stay out of source.
04
Deployment & infra
Kamal 2 with zero-downtime deploys to any VPS. Deploy config lives with the software. No manual server folklore.
05
Documentation
AGENTS.md with project context. README with setup instructions. Rails conventions tell agents where to look.
06
Portability
Self-hosted on any Linux VPS. No proprietary runtime. SQLite or Postgres when needed. Code and deployment stay portable.
Want the full technical breakdown?
The architecture guide covers the technical foundation behind software that agents can create and humans can still trust.
Read the architecture guideGive agent-built software a foundation people can trust.
Create personal software, team workflows, and public applications with code, context, and deployment that stay inspectable.
Get Omaship