The One Shot

OneShot is a host-owned workflow harness for agent-driven engineering. Instead of trusting an agent to self-police, a deterministic host runs six stages (Research, Audit Discovery, Planning, Fixture Validation, Build, Build Validation) with explicit host gates between them. Each stage has a typed Pydantic contract. Artifacts are content-addressed and serialized with RFC 8785/JCS plus SHA-256, state changes go through a single controller, and checkpoints support interruption recovery. Authorization is default-deny with path containment and symlink-escape prevention. A structural gap analysis must produce a host-issued receipt before Planning can advance or the Scanner can be dispatched. Planning is frozen by the host before fixtures are validated, and Build only executes admitted actions. The default model provider is Meta Muse Spark, behind a provider-neutral adapter registry.