"To achieve great things, two things are needed: a plan and not quite enough time." - Leonard Bernstein
why the name?
Bernstein is named after Leonard Bernstein, the American conductor and composer. The project orchestrates a crew of CLI coding agents the way Bernstein conducted the New York Philharmonic: every player on cue, the score deterministic, the conductor accountable for the result. He is the original orchestrator the project takes its name from.
deterministic multi-agent CLI orchestration
website · docs · install · first run · glossary · limitations · sponsor
Bernstein is a deterministic Python scheduler that runs a crew of CLI coding agents (Claude Code, Codex, Gemini CLI, and 40 more) against a single goal in parallel git worktrees, with an HMAC-signed audit chain over every step.
at a glance
- 44 CLI agent adapters in v2.2.x: 41 third-party wrappers, 2 leaf-node delegators, plus a generic
--promptwrapper. Source of truth: the supported agents table below. - HMAC-SHA256 audit chain per RFC 2104, one record per scheduling decision, tamper-evident. Operator guide: docs/security/audit-log.md.
- Bearer-token task server authenticates the manager and every worker. Per-session zero-trust JWT in
.sdd/runtime/agent_tokens/, legacyBERNSTEIN_AUTH_TOKENfallback, opt-out viaBERNSTEIN_AUTH_DISABLED=1. Flow + diagnostics: docs/security/manager-auth.md. - Signed agent cards use detached JWS (RFC 7515 §A.5) over RFC 8785 (JCS) canonicalization, with Ed25519 / EdDSA keys. Code: src/bernstein/core/security/agent_card_signer.py.
- Per-artefact lineage records every file write linked back to producer + inputs + prompt SHA + model + cost. CLI:
bernstein lineage verify <run_id>. - Deterministic scheduler: zero LLM in the coordination loop. Plain Python decides who runs, where, with what budget. Replay yesterday's plan, get yesterday's task graph.
