Bernstein

Overview

Bernstein is an open-source governance layer for AI agents. You write policy as code defining who may do what, what needs approval, and what must be recorded; Bernstein enforces it and produces a verifiable record. A deterministic Python scheduler runs agents in parallel without a model in the coordination loop, so the same plan can replay byte-identically. It supports CLI coding agents out of the box and governs other agent workloads whose deliverables can be diffs, reports, datasets, or audit evidence packs.

Key Features

• Policy-as-code enforcement: you write the rules, Bernstein enforces them, and produces the verifiable record.
• Deterministic Python scheduler with no model in the coordination loop, enabling byte-identical replay of the same plan.
• Parallel agents run in isolated git worktrees behind merge gates; artifact-mode tasks use separate working directories.
• Offline verification through signed run receipts, HMAC-chained audit logs, and a replay journal that surfaces divergence at the exact step.
• Support for CLI coding agents such as Claude Code, Codex, and Gemini CLI, plus more than 50 selectable adapters.
• Runs on laptops, on-prem, air-gapped environments, Cloudflare Workers, and Kubernetes without forcing a SaaS hop.

Use Cases

• Running multiple CLI coding agents in parallel on a repository while verifying each diff with tests, lint, and type checks before merge.
• Producing audit evidence packs with a declarative YAML workflow and signed lineage receipts.
• Governing research reports, datasets, action logs, or operations results through artifact contracts.
• Operating agent workloads on-prem, air-gapped, in Cloudflare Workers, or on Kubernetes.

Getting Started

• Install with uv tool install bernstein or pipx install bernstein.
• Run bernstein init to create the .sdd workspace and bernstein.yaml.
• Run bernstein doctor to check that a CLI agent is installed and authenticated.
• Start a goal with bernstein -g "fix the failing test in tests/test_foo.py".

Deployment & Requirements

• Deployment can be on a laptop, on-prem behind a firewall, air-gapped, Cloudflare Workers, Kubernetes, or a hybrid of those.
• The air-gap install profile and air-gapped wheelhouse are documented.
• Sandbox execution mode is supported with Cloudflare Sandbox and local Docker.
• Python 3.12+ is indicated in the repository badges.

Before You Adopt

• License: Apache-2.0. Review its terms before using, modifying, or distributing the project.
• The project describes itself as beta software maintained by one person.
• Release numbers indicate release count rather than maturity, and minor versions may change interfaces; pin versions for dependent work.
• Telemetry is opt-in and defaults to local-only; data leaves only according to the user's configuration.