Combo Draft: Dev Workflow Governance Stack (agent-governance-toolkit + code-review-graph + herdr)

Scenario

Daily dev workflow = block disallowed actions before writing code (policy gate) → build graph/review after writing code (impact graph) → manage sessions and workspaces once running (session oversight). The three tools cover gate / graph / runtime capability classes, with no duplicate CLI write surfaces (combo measurement 001 verified). Users usually get stuck on "will all three conflict, what order to install" — this combo answers that.

Combo members

agent-governance-toolkit (agt): policy gate and compliance checks

Download: official PyPI (package agent-governance-toolkit); China uses the Tsinghua mirror https://pypi.tuna.tsinghua.edu.cn/simple
Version: [4.1.0, 4.1.0] (manifest locked to a single version; CLI = agt, meta-package form; the [full] extras all-in-one and Claude Code plugin path see the guide, this combo only uses the CLI surface)
Install:

pip install agent-governance-toolkit --index-url https://pypi.tuna.tsinghua.edu.cn/simple
agt --version   # expected output: agt, version 4.1.0

code-review-graph (crg): code association graph

Download: official PyPI (package code-review-graph, ==2.3.8); China must use the Tsinghua mirror (official PyPI direct connection times out, probe 2026-08-27)
Version: [2.3.8, 2.3.8] (manifest locked; Python >= 3.10)
Install:

pip install -i https://pypi.tuna.tsinghua.edu.cn/simple code-review-graph==2.3.8
code-review-graph --version   # expected output: code-review-graph 2.3.8

note: the code-review-graph install subcommand registers MCP/hooks for Claude/Codex/Cursor/OpenCode (writes ~/.claude.json etc.) — this combo only uses the CLI surface (build/status), doesn't run the install subcommand, avoiding registration-surface writes.

herdr: session and workspace oversight (heavy piece)

Download: official GitHub release (v0.8.2, herdr-linux-x86_64); China direct GitHub is slow, use the gh-proxy prefix
Version: [0.8.2, 0.8.2] (manifest locked; Linux x86_64 single binary, no runtime dependencies; macOS/Windows assets see the release page)
Install:

curl -sL -o herdr https://gh-proxy.com/https://github.com/herdrdev/herdr/releases/download/v0.8.2/herdr-linux-x86_64
chmod +x herdr && ./herdr --version   # expected output: herdr 0.8.2

Install order

agt first (pip, pure CLI, no background process) — the policy gate is in place first, so subsequent install actions are within its visibility.
Then crg (pip, pure CLI) — co-install with agt in the same venv measured compatible; don't run the crg install registration subcommand (avoid the ~/.claude.json write surface).
Finally herdr (standalone binary) — heavy piece last, so its background server can't disturb earlier installs; status/config check doesn't start the server (measured).

Dependency warnings

Conflicts: agt×crg compatible (verified 2026-08-28, combo measurement 001, CLI surface); agt×herdr compatible (verified); crg×herdr compatible (verified) — 3/3 pairs verified, source: site docs + local repro log. Unmeasured surface: the three's Claude Code plugin/MCP registration forms (Claude not logged in on this machine), matrix stays at possible-conflict/possible-compatible inferred state.
Versions: agt [4.1.0,4.1.0]; crg [2.3.8,2.3.8] (Python >= 3.10); herdr [0.8.2,0.8.2] (Linux x86_64).
Environment: crg build writes workspace .code-review-graph/ (graph data); the full herdr client writes ~/.config/herdr/ + ~/.local/state/herdr/ and may start a background server (port on demand, no fixed port conflict with other entries, inferred); agt CLI surface has no config-directory writes.
China network: pip two-piece via the Tsinghua mirror (PyPI direct times out); herdr binary via gh-proxy (GitHub direct slow). The most likely sticking point = herdr binary download, the command already carries gh-proxy.

Acceptance check (one shot)

Run this block after installing; all green = combo ready; any failure -> back to the matching step in the install walkthrough.

agt --version
code-review-graph --version
herdr --version

预期输出: agt, version 4.1.0; code-review-graph 2.3.8; herdr 0.8.2. All green = governance stack command surface ready

Note: member-level commands measured; combo-level end-to-end run pending.

Verification evidence

Every combo is measured in an isolated environment (smoke + write-surface check); unmeasured items are honestly marked in the text, and measurement dates are listed in the verification section below.

Verified 2026-08-29 · TTL expires 2027-02-25 (180 days)

Local verification record（2026-08-28）

Evidence path: local repro log (contains the mixed-use log); matrix pair states see site docs.
Not measured (stated honestly): Claude Code plugin/MCP registration form co-install (not logged in on this machine); herdr full interactive session (this combo only verified status/config).

Combo Draft: Dev Workflow Governance Stack (agent-governance-toolkit + code-review-graph + herdr) ✓ Verified