Goose module

[bpmct]

A discussion dedicated to the Goose module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 25	18 / 20	7 / 20	7 / 10	59 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README covers multiple distinct modes with sensible defaults: standalone launcher-app mode, extensions/MCP config, pinned-version install, and downstream-script serialization via scripts output.
Visual preview	5	0	No image, GIF, or video embedded in README.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	Module defines no secret input variables of its own; README example injects the key via resource "coder_env" referencing var.anthropic_api_key rather than an inline literal key.
Non-hardcoded auth path	4	2	Only pattern shown is plain env-var injection (ANTHROPIC_API_KEY); no ServiceAccount/OAuth/API-key-helper/AI-Gateway path documented.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	install.sh.tftpl hardcodes https://github.com/aaif-goose/goose/releases/download/stable/download_cli.sh; no module variable overrides this download URL.
Bring-your-own binary	10	5	install_goose = false variable exists ("goose must already be on PATH") and is tested, but it is not shown or explained in a dedicated README example/section — only in the variable description.
Egress transparency	3	0	No dedicated network/air-gapped section enumerating endpoints contacted.
Runs without sudo	2	2	install.sh.tftpl never invokes sudo; installs to user home / .local/bin.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All variables have clear descriptions and most have sensible defaults (goose_version="stable", install_goose=true), but no validation blocks anywhere.
Test coverage	4	4	main.tftest.hcl covers business logic (defaults, workdir trimming, extension merging, scripts output ordering); main.test.ts exercises end-to-end install/config/symlink/system-prompt behavior in containers.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in README.
Dashboard entry point	5	5	README shows explicit coder_app example (slug = "goose", open_in = "slim-window") launching goose session.
Session continuity	5	0	v4 explicitly dropped Coder Tasks/AgentAPI support (per changelog warning); no resume or persistent session-manager (tmux/screen) documented.
Managed configuration	5	5	additional_extensions (MCP config), workdir, and GOOSE_SYSTEM_PROMPT are documented mechanisms for managed config.

Overall — 59 / 100

Raw 54 / 92 → round(54 / 92 × 100) = 59

---

Scored against SCORECARD.md on 2026-10-28 with solstice-1.