Goose module

[bpmct]

A discussion dedicated to the Goose module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	15 / 25	10 / 20	0 / 20	8 / 10	46 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two examples shown: basic usage and "Run in the background and report tasks" with custom prompts. However, no examples for different provider choices beyond Anthropic, and the custom extensions example is minimal. Partial coverage of major modes.
Coder-context framing	8	7	README states "Run the Goose agent in your workspace" and mentions Coder Login prerequisite. Shows Goose integration with Coder MCP for task reporting. Minor: could be clearer about Coder's role in the overall flow.
Visual preview	5	0	No image, GIF, or video in README. Only references an icon file.

Agent Integration — 15 / 25

Criterion	Max	Score	Notes
AI governance	10	5	Documents Coder MCP integration for task reporting via the coder extension in config. No mention of Agent Firewall. Only one governance mechanism documented earns half.
Dashboard entry point	5	5	Full coder_app support via the agentapi module, with both web app (goose) and CLI app (goose-cli) documented in main.tf outputs and module configuration.
Session continuity	5	0	No documentation of session resume, session IDs, or persistent session managers (tmux, screen, boo). The agent runs directly without continuity support.
Managed configuration	5	5	Documents managed configuration via additional_extensions variable for MCP extensions, GOOSE_SYSTEM_PROMPT for system prompts, and GOOSE_TASK_PROMPT for task prompts. Config file generation shown in install.sh.

Credential Hygiene — 10 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	The example shows variable "anthropic_api_key" marked sensitive = true, which is correct. However, the README example includes inline placeholder pattern var.anthropic_api_key # or use a coder_parameter suggesting direct variable usage. Module itself has no sensitive inputs (provider/model are not secrets). Half credit for mixed approach.
Non-hardcoded auth path	4	2	README mentions "or use a coder_parameter" as an alternative to variables, showing awareness of better paths. However, the primary documented example uses a template variable. Partial documentation of non-hardcoded path earns half.

Restricted-Environment Readiness — 0 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable to override the Goose download URL. The install.sh script hardcodes https://github.com/block/goose/releases/download/stable/download_cli.sh. Version can be set via goose_version but the base URL cannot be changed.
Bring-your-own binary	5	0	The install_goose = false option exists and is documented, but the scripts still require goose to be available and fail with "Error: Goose is not installed" if not found. No documentation of how to pre-install or where to place the binary.
Egress transparency	3	0	No dedicated section enumerating external endpoints. The GitHub download URL is visible in code but not documented in a network/offline/air-gapped section.
Runs without sudo	2	0	Scripts (install.sh, start.sh) do not invoke sudo and install to user directories ($HOME/.local/bin, $HOME/.config). However, the module depends on agentapi module which is not inspected here. Based on visible scripts alone, they run without sudo, but the "Runs without sudo" criterion applies to the complete module behavior. Given dependency on external module, cannot verify full no-sudo operation. Conservative score: 0. Actually, re-reading: the scripts shown never use sudo. Full credit: 2. Correction applied.

Correction: Runs without sudo scripts visible (install.sh, start.sh) never invoke sudo, install to user paths. Score: 2.

Restricted-Environment Readiness — 2 / 20 (corrected)

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module variable to override the Goose download URL. The install.sh script hardcodes https://github.com/block/goose/releases/download/stable/download_cli.sh. Version can be set via goose_version but the base URL cannot be changed.
Bring-your-own binary	5	0	The install_goose = false option exists and is documented, but the scripts still require goose to be available and fail with "Error: Goose is not installed" if not found. No documentation of how to pre-install or where to place the binary for the skip-install case to work.
Egress transparency	3	0	No dedicated section enumerating external endpoints. The GitHub download URL is visible in code but not documented in a network/offline/air-gapped section.
Runs without sudo	2	2	Scripts install.sh and start.sh never invoke sudo, use only user directories ($HOME/.local/bin, $HOME/.config/goose). Full credit from code inspection.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (goose_version = "stable", subdomain = false, install_goose = true). Required inputs (agent_id, goose_provider, goose_model) appropriately have no defaults. No validation blocks present but types are appropriate.
Test coverage	4	2	Comprehensive TypeScript tests in main.test.ts covering install, config, prompts, subdomain behavior. No .tftest.hcl file present for Terraform-level testing. Half credit for TypeScript-only coverage.

Overall — 46 / 100

Recalculation:

• Presentation: 13
• Agent Integration: 15
• Credential Hygiene: 10
• Restricted-Environment: 2
• Engineering Quality: 8
• Total: 48 / 100

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.