Aegis Proofbound Codex Control Tower

Inspiration

Software agents are most useful when they can move quickly without making authority ambiguous. We built Aegis to demonstrate a narrow control-plane contract: adaptive assistance may read, propose, and review, but deterministic state, explicit human authority, and evidence decide what can run and what can be claimed.

What it does

Aegis Proofbound Codex Control Tower is a dependency-free Developer Tools demo for bounded software-agent work. An invented checkout task moves through three deliberately separated roles: Explorer is read-only, Builder is proposal-only, and Reviewer is proof-only. The seeded implementation deterministically fails at the exact $50 boundary, passing 3 of 4 tests. The workflow stops until a human approves one comparator-only correction. The same immutable test then reruns to 4 of 4, while the final diff, proof, provenance, approval order, and receipt history remain inspectable.

The public browser is an operator visualization over synthetic data. The committed Wave 2 core separately creates a short-lived, zero-remote Git fixture, applies fixed patches, runs immutable Node tests, captures the real diff, binds one-use approval to hashes, scope, base revision, and workspace fingerprint, proves denial causes zero mutation, and rejects replay. It never connects to a production or customer repository.

How we built it

The browser authority kernel is a dependency-free ES module shared by the UI and Node tests. It owns every transition and rejects unknown or out-of-order actions without mutating the prior state. The fixture adapter accepts no arbitrary command or path input: it copies one committed fixture, initializes a local zero-remote repository, applies fixed patches with Git, and runs one committed test through Node's test runner.

An initial implementation established the deterministic browser workflow and authority state machine. A later material GPT-5.6/Codex pass added the fixture-only Git/test/diff execution adapter, hash-bound one-use approval, denial/approved/replay proof, SHA-256 receipt verification, and adversarial authority-integrity tests. Human decisions fixed the product boundary: synthetic local data, explicit authority before mutation, immutable proof, and public-safe provenance.

Challenges and lessons

The hardest part was making the demonstration honest at every layer. The UI cannot declare success independently of the state kernel; a model suggestion cannot confer authority; a passing result cannot exist without the earlier failing proof and approval receipt; and the public package cannot imply arbitrary repository access. Encoding those constraints as executable invariants made the system easier to explain, test, and audit.

We learned that useful agent tooling is not only about stronger generation. Clear role boundaries, small approval scopes, deterministic tests, replay rejection, and durable evidence turn assistance into something an operator can safely reason about.

Judge path

No credentials or rebuild are required. Open the live demo, select Run seeded mission, inspect the 3/4 proof failure, approve the comparator-only scope, select Apply correction + rerun proof, and inspect Diff, Proof, Provenance, and Event history. The public repository contains setup instructions, tests, the real fixture-execution proof, and the exact committed source.

Built With

• cloudflare-pages
• codex
• css
• git
• gpt-5.6
• html
• javascript
• node.js