LFX Mentorship: Policy-as-Code Engine for Open Source AI Agent Orchestration

[Parvm1102]

Gitmesh is coming for the LFX mentorship program for the unpaid track: https://mentorship.lfx.linuxfoundation.org/project/42810656-3f94-4255-a527-6f05defeb2c4

Overview

As AI coding tools (Claude Code, GitHub Copilot, Cursor) become autonomous contributors, open-source projects face a critical operational gap: there is no shared coordination layer. This leads to duplicate work, API rate limit exhaustion, and maintainer burnout from PR floods.

GitMesh is an LFDT-native multi-agent orchestration runtime designed to close this gap. For this mentorship, we are implementing the core governance infrastructure to bring accountability and coordination to AI agents operating on open-source codebases.

Key Deliverables

The mentee will be responsible for building out two primary phases:

• Forge Integration Service (forge-sync): Build a bidirectional webhook receiver and outbound action service for GitHub/GitLab. This will securely listen for repository events and safely trigger agent wakeups.

• Policy-as-Code Engine: Integrate Open Policy Agent (OPA) with YAML-to-Rego auto-compilation. This evaluation middleware will be injected into all agent heartbeats and API routes.

• Tamper-Evident Audit Log: Enhance the activity log with policyVersion and policyOutcome metadata to ensure every agent action is recorded in an append-only, exportable format.

• Maintainer Dashboard: Develop a three-view dashboard (Active Agents, Pending Approvals, Audit Log). We are looking for a highly functional, minimalist user interface that prioritizes speed and utility over complex design systems.

Tech Stack

Required: TypeScript/Node.js, REST APIs/Webhooks, PostgreSQL, Git/GitHub.

Preferred: React, Docker, basic understanding of policy/authorization systems (OPA), and familiarity with AI agent tools.

Why Contribute?

This project tackles a crucial, underlying administrative challenge in the open-source AI ecosystem. The governance patterns built here—policy-as-code for autonomous agents and maintainer approval gates—will serve as reusable architectural templates across the broader LF Decentralized Trust and CNCF ecosystems.

Note to Applicants: You don't need to be an expert in all the preferred skills. Curiosity about AI agent governance and a passion for building robust open-source infrastructure matter most!

start contributing now to increase your chances of getting selected! You can also attend our weekly meetings here: https://zoom-lfx.platform.linuxfoundation.org/meeting/96608771523?password=211b9c60-b73a-4545-8913-75ef933f9365&invite=true

[mustafa-sayyed]

Hey @Parvm1102
I am interested in Working on this Project
but I have already applied to 3 LFX projects

Since I have reached the application limit, is there another way I can contribute to this project?
I asking this bcz, I am eagerly interested and passionate to work AI agents and this project idea is really interesting

[Parvm1102]

Hi @mustafa-sayyed,
Thanks for showing interest in the project! There is no other way to become a mentee if you do not apply on the LFX mentorship website for this project. However, you can still contribute and contributions are always welcome.

[mustafa-sayyed]

Thanks @Parvm1102
I will start contributing to this project.

And if I got rejected for any of the three applications before 22, I will surely apply for this project through LFX

[bastizol-wq]

Re: “LFX Mentorship: Policy-as-Code Engine for Open Source AI Agent Orchestration”. When agents call tools, the brittle part is usually the tool boundary (auth/hosts/inputs).

We’ve had good luck turning this into a small policy step: validate tool description + transport, then only allow the call if checks pass.

ATCP is an API-first gate that evaluates a tool/OpenAPI and returns a structured allow/warn/block result.

ATCP OpenAPI: https://api.sp-ai.io/v1/openapi.yaml

Curious what you’re using today for tool allowlists / safety receipts — happy to compare notes.

[Parvm1102]

@bastizol-wq Interesting! I've been thinking about enforcing validation at the tool boundary as well, especially around schema + execution safety.

How does ATCP handle dynamic inputs and runtime safety constraints? I am curious about how it works.

[ManthanNimodiya]

Hi @parvmittal @Ronit-Raj9 @vibhor05,
I'm Manthan Nimodiya, and I'd like to express my interest in this mentorship.

The problem you've framed here resonates with me strongly, as AI agents start contributing autonomously to open source repos, the absence of a coordination and governance layer is going to cause real damage: duplicate work, conflicting PRs, and maintainer fatigue at scale.
My thinking on the approach: the policy engine needs to be the source of truth before an agent acts, not an audit trail after. That means the webhook integration and OPA evaluation need to be tightly coupled with low latency, and the YAML-to-Rego compilation layer needs to be expressive enough for maintainers who don't want to write Rego directly.

Before anything else, I'd love to join the community, attend the meetings, and get a better feel for how the project is evolving. Could you point me to where the team meets regularly, is there a Discord, Zoom, or another channel for the weekly syncs?

Looking forward to connecting.

[AnuragGupta181]

Hi @ManthanNimodiya,

I’m Anurag , I am also currently exploring contributions for the GitMesh LFX project and recently joined the community discussions. Most of the discussions are happening in the GitMesh/Labs section of the LFDT Discord community.

Discord: https://discord.gg/hyperledger

The weekly meeting link is also mentioned in the mentorship issue description above.

Looking forward to contributing and collaborating with everyone here.