{"slug": "central-agentic-ops-cao", "title": "Central Agentic Ops (CAO)", "summary": "GitHub Next released Central Agentic Ops (CAO), an open research prototype that gives teams one view of shared agentic-workflow activity, costs and outcomes with controls over where those workflows run. CAO builds on GitHub Agentic Workflows and GitHub Actions, drawing on more than 100 specialized workflows the team operated in github/gh-aw, and preserves repository permissions, branch protections and human review. The project's specifications and a public sample dashboard are published at githubnext.github.io/gh-cao.", "body_md": "A workflow that keeps documentation current or investigates a failing build can be a useful teammate. Once it works, the next question is tempting: what if we ran it across all our repositories? But who would maintain it, notice when it stopped helping, or decide whether another run was worth the cost?\n\nCentral Agentic Ops (CAO) is a GitHub Next research prototype exploring those questions. It brings workflow activity, costs, and available outcomes into one view, with controls for teams that want to operate shared workflows. The goal is useful work, at the right time, within limits people control.\n\nRead the [CAO documentation](https://githubnext.github.io/gh-cao/), explore the\n[campaign catalog](https://githubnext.github.io/gh-cao/catalog/) and\n[public sample dashboard](https://githubnext.github.io/gh-cao/cao/),\nor contribute at\n[github.com/githubnext/gh-cao](https://github.com/githubnext/gh-cao).\n\n### From an agent factory to many repositories\n\nWe arrived at this problem by using agentic workflows ourselves. In\n[Peli’s Agent Factory](https://github.github.com/gh-aw/blog/2026-01-12-welcome-to-pelis-agent-factory/),\nwe built and operated more than 100 specialized workflows in [`github/gh-aw`](https://github.com/github/gh-aw).\nThey triaged issues, investigated failures, improved tests, maintained\ndocumentation, and even helped us understand other workflows.\n\nAs useful patterns emerged, we wanted them to help more repositories. Simply copying them everywhere would leave us with another maintenance problem: which copies were current, which had drifted, and who was responsible for them? We needed a way to maintain shared workflows without losing sight of what ran, what failed, and what was wasting effort.\n\nThe building blocks were taking shape in\n[GitHub Agentic Workflows](https://githubnext.com/projects/agentic-workflows/).\n[Safe outputs](https://github.github.com/gh-aw/reference/safe-outputs/) let\nworkflows request changes through declared, limited operations. They could\ndelegate work to coding agents and refer to newly created items later in the\nsame workflow run. Workflow markers, run audits, and correlation identifiers\nmade the resulting work easier to trace. Patterns such as\n[CentralRepoOps](https://github.github.com/gh-aw/patterns/central-repo-ops/)\nlet shared workflows live in a central repository while the software they\nworked on stayed with its own team.\n\nOur work on\n[token efficiency](https://github.blog/ai-and-ml/github-copilot/improving-token-efficiency-in-github-agentic-workflows/)\nmade the need more tangible. Auditors exposed unused tools, blocked loops,\nand expensive runs. That raised broader questions: were several workflows\nrepeating the same reads? Could shared evidence replace work each agent\nrediscovered? And were lower costs accompanied by useful results?\n\nBackground and event-triggered agents are already part of today’s development tools. CAO’s focus is operating the factory, not building another agent: maintaining shared workflows, seeing their combined costs and results, and using that evidence to guide what happens next.\n\n### A concept and an implementation\n\n[Continuous AI](https://githubnext.com/projects/continuous-ai/) is our term for automated AI that\nsupports software collaboration. Agentic Workflows are one way to implement\nit: instructions written in Markdown, run through GitHub Actions with declared\ntools, permissions, and outputs, using engines such as Copilot CLI, Claude\nCode, or Codex. CAO governs whether and where shared work may run; Agentic\nWorkflows governs how it executes.\n\nCAO is an operations layer, not an all-purpose agent. It builds on Agentic Workflows and GitHub Actions while preserving repository permissions, branch protections, and human review.\n\nThe open\n[specifications](https://github.com/githubnext/gh-cao/tree/main/specs) describe\nthe evidence and control boundaries of an agentic-workflow factory: a\ncollection of specialized workflows maintained and operated together.\n[`githubnext/gh-cao`](https://github.com/githubnext/gh-cao) is one opinionated implementation, not the only possible\narchitecture. Other implementations can explore the same contracts with\ndifferent infrastructure.\n\n### Run when the evidence calls for it\n\nScaling a factory should not mean keeping every agent busy. Two workflows can succeed while repeating the same investigation. A documentation check can run when nothing relevant changed; a failed task can retry before its missing prerequisite has been fixed.\n\nCAO asks how evidence about outcomes, cost, reliability, and review effort can guide whether and when work runs. Monitoring can continue on a schedule without launching an agent for every observation. The research goal is a factory that selects useful tasks, skips duplicates, and waits when there is no reason to act.\n\nOne [design proposal](https://github.com/githubnext/gh-cao/blob/main/specs/state-mediated-coordination.md)\nis to store shared facts once, use deterministic code to identify actionable\nchanges, and call agents only for the judgment those changes need. That would\nmake coordination less dependent on repeated scans and conversations between\nagents.\n\nThe current [intelligence layer](https://githubnext.github.io/gh-cao/intelligence/)\ngroups recurring failures into review-only recommendations.\n\nThe feedback loop closes through reviewed change. Agents can learn from evidence generated by live workflows: outcomes, failures, costs, and human feedback inform proposed improvements to instructions, tools, or campaigns. Reviewed updates guide subsequent runs, which produce new evidence.\n\nThis is operational learning, not automatic model retraining. Choosing and dispatching the most valuable interventions remains research; feedback does not grant agents broader authority.\n\n### Start small. Roll out with confidence.\n\nCAO can grow with you; a complete factory is not a prerequisite. Imagine a\nteam keeping documentation current across several repositories. It can\ndescribe that goal in natural language and use CAO’s\n[agent skills](https://githubnext.github.io/gh-cao/agent-plugin/) to start with\none reviewable operation.\n\nShared workflows, policy, and runs live in a control repository. The repositories being worked on are targets; their teams still decide which changes to accept. A small rollout might look like this:\n\n1. **Observe what already runs.** CAO’s Activity collector gathers a bounded,\nread-only snapshot from explicitly selected repositories. Monitoring does\nnot move existing workflows or take control of them.\n2. **Try one target in review mode.** Define the task, repository scope,\ncredentials, and allowed outputs.`review` is real execution: the agent\nruns, but proposed outputs go to the control repository—or another\nconfigured review destination—rather than the target.\n3. **Inspect the result before expanding.** Was the proposed documentation\nchange useful? What did it cost, and how much review did it need? If the\nevidence supports proceeding, explicitly authorize live outputs to the\ntarget. Creating a pull request is still not the same as accepting it.\n\nOne bounded run may be enough. An agentic campaign packages a repeatable goal with\nan orchestrator and separate workers when targets need independent execution\nor retries. The\n[operating-pattern guide](https://githubnext.github.io/gh-cao/operation-patterns/)\nexplains when to use each structure, including ordinary Actions for\ndeterministic work. The catalog\noffers examples of repository assistance, dependency maintenance, and\narchitecture review; installing one does not authorize it to run.\n\n### Focus attention, not just activity\n\nHuman attention is scarce. The dashboard should focus it on what needs judgment next, not every run. We want a mobile-first view for the agentic engineer: quick check-ins, then deeper investigation.\n\nPeople and agents share the same operating plane:\n[named queries](https://githubnext.github.io/gh-cao/agent-analysis/) serve both\ndashboard views and agent APIs.\n[Dashboard Language](https://githubnext.github.io/gh-cao/dashboard-language/)\nlets you shape views around your team’s questions. The local Copilot canvas\nsupports generating, previewing, and saving custom views. These stay\nworkspace-local and grant no execution authority.\n\nA completed run, a proposed change, a maintainer’s acceptance, and a lasting improvement are different things. A workflow might open many pull requests while creating more review work than it saves. Cost and reliability therefore belong beside accepted outcomes and review effort, not in place of them.\n\nThe [value specification](https://github.com/githubnext/gh-cao/blob/main/specs/value.md)\ndefines success before measurement and counts outcomes equally, whether\nachieved by people or agents.\n\nThese are snapshots, not a live feed. Results may be stale, partial, or unavailable; missing evidence must not look like a healthy zero.\n\n### Keep control with the team\n\nWe favor explicit processes over bigger swarms. Policy is reviewed alongside the workflow version and checked before invoking the agent. Each run must fit its policy, request, credentials, tools, and safe outputs. Missing authority, access, or required evidence blocks execution.\n\nCampaign workers handle one assigned target. They cannot discover extra targets, dispatch more workers, or promote themselves to live mode. Writes use declared safe outputs, not unrestricted access.\n\nWorkflow versions, policy, runs, and proposals leave an audit trail. Shared updates still need review of version changes and local customizations. CAO governs explicitly integrated workflows, not every job it observes; these limits reduce risk rather than eliminate it.\n\n### From individual maintainers to enterprises\n\nYou do not need to start with an enterprise-wide platform. The\n[setup paths](https://githubnext.github.io/gh-cao/setup-compatibility/) cover\ndifferent levels of access:\n\n- **No additional App or PAT.** Monitor the control repository and explicitly\nselected public repositories with the built-in Actions`GITHUB_TOKEN` .\nAuthenticated setup still needs control-repository settings access; this\npath does not grant cross-repository writes.\n- **Fine-grained PATs.** Where suitable Apps are unavailable, use eligible,\napproved tokens scoped to each resource owner, subject to API limits,\nexpiration, and rotation.\n- **Organization Apps.** Use approved private Apps with separate read and\nsafe-output write access. Repository administrators can extend approved\ninstallations where organization policy permits.\n- **Enterprise Apps.** Across organizations in one enterprise, use approved\nenterprise-owned private Apps with selected-repository installations in\neach organization. Enterprise ownership alone grants no access.\n\nPages, secrets, and App setup may require administrator help beyond repository write access.\n\n### Choose the stack you need\n\nHosting is independent of credentials. Start with GitHub Actions and Pages:\nbrowser-side queries, no external server, database, or cloud account. Normal\nGitHub plan limits apply. Or bring your own Go server and PostgreSQL on a\ncompatible container platform; see the\n[deployment guide](https://githubnext.github.io/gh-cao/deployment/).\n\nAdd only what you need. The optional\n[Webhook Gateway](https://github.com/githubnext/gh-cao/blob/main/server/README.md#enrolled-jira-linear-and-azure-devops-sources)\nconnects Jira, Linear, and Azure DevOps events to approved GitHub workflows,\nwith authentication, reviewed scope, and fresh access checks. OpenTelemetry,\nprivate archives, and deeper analytics are optional too. The\n[storyboards](https://githubnext.github.io/gh-cao/#backend-title) show possible\ncombinations, not a mandatory stack.\n\nThe [Azure profile](https://githubnext.github.io/gh-cao/deployment-azure/)\nuses Functions, PostgreSQL Flexible Server, and Key Vault. ADX is a separate,\noptional paid destination. The native deployment command supports fresh\ndevelopment deployments only; the guide covers supporting services, costs,\nand exporter requirements.\n\nWhatever the stack, verify dashboard visibility before publishing private evidence: a private repository does not automatically make Pages private.\n\n### Toward factories that learn\n\nA workflow run is an accounting unit, but not always the right unit of learning. We want to connect episodes of work to their original intent, context, actions, and independently assessed outcomes, including work that spans runs or campaigns.\n\nWith approved data use and reliable outcome labels, these episodes could support reusable evaluations and RL research. Campaign definitions, evaluation methods, and lessons could be shared across the Agentic Workflows community without publishing private traces.\n\nWhat transfers across domains: successful strategies, objective functions, or ways to measure effectiveness? Those patterns might help connect technical evidence to resource allocation, project roadmaps, and ROI. At hyperscale, the aim is to grow useful work without overwhelming human attention. Domain-specific goals and causal evidence still matter: these are research questions, not a shipped training system or universal measure of business value.\n\nCAO is still an early research prototype. As we did with Agentic Workflows, we are shaping it quickly in the open: its specifications, terminology, interfaces, and operating patterns will change as we learn. We want to understand not just how much work agents can do, but which work is worth doing.", "url": "https://wpnews.pro/news/central-agentic-ops-cao", "canonical_source": "https://githubnext.com/projects/central-agentic-ops/", "published_at": "2026-11-05 00:00:00+00:00", "updated_at": "2026-11-06 14:53:28.425649+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "mlops", "ai-infrastructure"], "entities": ["GitHub Next", "Central Agentic Ops (CAO)", "GitHub Agentic Workflows", "GitHub Actions", "github/gh-aw", "githubnext/gh-cao", "Copilot CLI", "Claude Code"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/central-agentic-ops-cao", "markdown": "https://wpnews.pro/news/central-agentic-ops-cao.md", "text": "https://wpnews.pro/news/central-agentic-ops-cao.txt", "jsonld": "https://wpnews.pro/news/central-agentic-ops-cao.jsonld"}}