Agent Floor

Inspiration

A Codex worker appeared to consume 555.3 million tokens. A request-level audit showed that its actual incremental usage was 1,492,621 tokens.

The 372.03× discrepancy came from inherited cumulative history after full-history delegation. The same investigation exposed a broader problem: subagents can receive excessive context, execute without firm boundaries, and return conclusions whose citations are genuine while their meaning remains false.

Agent Floor was built to govern that boundary.

What it does

Agent Floor is a zero-dependency Node.js control layer for governed Codex delegation.

Before execution, it:

• rejects full-history delegation;
• creates a clean, self-contained worker packet;
• projects only allowlisted source files;
• limits depth, fan-out, cycles, runtime, output, and authority;
• launches an ephemeral child process without access to the parent task history.

After execution, it:

• attributes only unique request-local usage;
• separates cached input, fresh input, and output;
• verifies file, line, excerpt, and source hash;
• checks whether the evidence semantically supports the conclusion;
• admits or rejects the worker result at the parent boundary.

How we built it

Codex and GPT-5.6 were used to investigate the original attribution defect, design the governance boundary, implement the runner and accounting engine, construct sanitized regression fixtures, build the evidence-admission system, generate adversarial controls, and verify the public release.

The implementation uses the Codex non-interactive JSONL interface and a deterministic Node.js test and demonstration path. GPT-5.6 Terra also executed a governed native smoke test through the finished wrapper.

The deterministic public demo requires no model call or Codex authentication.

Challenges

The main technical challenge was distinguishing genuine child activity from cumulative and inherited telemetry reproduced across parent and subagent histories.

A second challenge was proving that valid citations alone are insufficient. Agent Floor therefore validates both source evidence and the semantic contract of the conclusion.

Accomplishments

• 14/14 automated tests pass.
• AF-G0 passes from a fresh public clone.
• fork_turns="all" is mechanically rejected before execution.
• 555,300,000 raw cumulative tokens are reconciled to 1,492,621 verified request-local tokens.
• 553,807,379 tokens of false attribution are removed.
• The correction factor is 372.03×.
• A valid evidence result is admitted.
• A contradictory conclusion is rejected even though its citations are genuine.
• The public release has zero runtime dependencies and zero npm vulnerabilities.

What we learned

Agent telemetry and worker attribution are separate problems. Cumulative counters can describe the history visible to an agent without describing the work performed by that agent.

Clean context, bounded authority, request-local accounting, and semantic admission must operate together. Any one of them alone leaves an uncontrolled boundary.

What's next

The current AF-G0 release is intentionally read-only. Future phases can add separately authorized mutation, broader telemetry adapters, additional evidence schemas, and organization-level governance without weakening the clean-context boundary.

Built With

• codex
• github
• gpt-5.6
• javascript
• jsonl
• node.js
• terra