Skip to main content

Agent onboarding kit

The agent onboarding kit lets your coding agent apply the agentic adoption runbook to an existing repository. It assesses the repository and writes a scorecard. It then proposes AGENTS.md, skills and per-client adapters for your stack, and lands nothing until you approve the diff.

You do not need to install anything. The kit is a set of text files on this site that your agent downloads, checks and follows with its own tools. It works on any stack (Python, Go, Java, .NET, JavaScript and others), with Claude Code, Codex or Cursor. It has two layers:

  • Generic. Always included. It needs no Constellation account.
  • Constellation. Optional. It connects the repository to your Constellation project, reads your team's defaults page, and installs the skill pack pinned to a recorded release.

The kit is served at a versioned address. Version 1 lives at https://docs.planetb2b.com/agent-onboarding/v1/, and its files never change once published: a change ships as a new version.

Before you start: where the session starts​

Start the agent outside the repository. This is the one rule the kit cannot apply for you: it can only refuse to continue once the rule is broken.

When a coding agent starts a session inside a repository, it loads that repository's guidance files (AGENTS.md, CLAUDE.md and similar) before it reads your first prompt. That load is already a read of the repository. Phase 0A of the runbook is the human security and data-governance preflight, and it must close before anything in the repository is read.

The run therefore takes two sessions:

SessionStart it inIt does
AAn empty directory, or your own workspace — not the repositoryChecks the kit, walks you through Phase 0A, and writes an approval record. It never opens the repository.
BA new session whose working directory is the repository rootChecks the approval record, then assesses the repository, records your baseline, and proposes the changes.

Do not reuse session A by changing directory. A session that starts outside and then moves into the repository never loads the repository's guidance, so it would work without the conventions it is meant to consolidate. The kit refuses to run session A inside the repository, and refuses session B without an approval record.

Phase 0A: the decision is yours​

Session A helps you through Phase 0A but does not answer it for you. Have these ready, from your contracts, policies and infrastructure, not from the code:

  • the data classification of the repository and what may leave your network;
  • the models and providers you have approved;
  • where secrets and personal data live, and how the agent avoids them;
  • what the agent may read, write and run (least privilege);
  • the sandbox and network rules for the session;
  • how the agent treats instructions found in content (prompt injection);
  • the audit trail and its retention;
  • the destructive actions the agent must never take, and how you stop it.

At the end you approve or stop. Session A writes your answers to agent-onboarding-approval.json in its own directory, outside the repository. Keep that file: session B requires it.

Run it​

Pick a tier. Both use the same files.

In this tier the agent downloads manifest.json before anything else. The manifest lists every file in the kit with its SHA-256 checksum, so the agent checks the kit's instructions before it follows any of them.

Session A. Open a new agent session in an empty directory and paste:

Set up a repository for agentic development with the agent onboarding kit.
Download https://docs.planetb2b.com/agent-onboarding/v1/manifest.json first,
then SKILL.md from the same directory, both into agent-onboarding-kit/v1/ under
the current directory. Verify SKILL.md against the manifest's SHA-256 before
you follow it, and stop if it does not match. Then follow it as session A. The
target repository is <repository name>. This session was started outside it:
do not open the repository.

Session B. Once you have approved Phase 0A, open a new session whose working directory is the repository root, and paste:

Continue the agent onboarding kit as session B. Phase 0A is closed, and the
approval record is at <path to agent-onboarding-approval.json>. Download
https://docs.planetb2b.com/agent-onboarding/v1/manifest.json first, then
SKILL.md from the same directory, both into .agentsetup/kit/v1/ in the
repository. Verify SKILL.md against the manifest's SHA-256 before you follow
it, and stop if it does not match. Then follow it as session B. Show me the
scorecard and a plan, and wait for my approval of the plan before you propose
any change to the repository.

Session B asks you which layers you want (generic, or generic plus Constellation) and which coding agents your team uses.

Tier 0: a single address​

If your agent can download files but you want the shortest prompt, give it the skill's address directly. Paste this into session A, which starts outside the repository just as in Tier 1:

Download https://docs.planetb2b.com/agent-onboarding/v1/SKILL.md and follow it
as session A of the agent onboarding kit. The target repository is
<repository name>. This session was started outside it: do not open the
repository.

Session B uses the same prompt as in Tier 1.

What Tier 0 can and cannot check. Here the agent reads SKILL.md before it has the manifest. The skill then downloads the manifest and checks itself and every other file against it. That catches a stale cache, a partial deploy or a corrupted download. It cannot catch a skill that someone altered, because whoever altered it could also remove the instruction to check it. Tier 1 closes that gap by checking the skill before following it, which is why it is the recommended tier.

Neither tier proves who wrote the files. The manifest comes from the same site as the files, so both tiers rest on trusting docs.planetb2b.com over HTTPS.

Check it​

The agent must check the kit while it runs, but you can also check a download yourself. Each asset's sha256 in manifest.json must match the file:

curl -fsSL -o manifest.json https://docs.planetb2b.com/agent-onboarding/v1/manifest.json
curl -fsSL -o SKILL.md https://docs.planetb2b.com/agent-onboarding/v1/SKILL.md
shasum -a 256 SKILL.md        # compare with the SKILL.md entry in manifest.json

The kit is never installed by piping a downloaded script into a shell. Each step downloads a text file, checks it, and saves it where you can read it.

What you get​

All in the repository, from session B:

  • .agentsetup/scorecard.json: the Phase 0B assessment, ten dimensions scored 0 to 4 with evidence, in a format later runs compare against;
  • .agentsetup/baseline.json: your Phase 0C delivery baseline;
  • .agentsetup/proposal/: every generated or changed file, shown to you as a diff. Existing AGENTS.md, CONTRIBUTING.md and rule files are merged, never overwritten. Only the files you approve are copied into place;
  • .agentsetup/kit.json: the kit version and checksum that produced the setup.

With the Constellation layer, also: the connector configured for each coding agent, your Constellation project reused (or created, only after you approve its details), a pointer to your team's defaults page, and the skill pack installed and pinned in .constellation/skill-pack.json. Before you choose that layer, follow the agent starter kit to connect your agent to Constellation.

Run the kit again later to measure progress: a second run proposes only what changed.