Inspiration
What it does
How we built it
Challenges we ran into
Accomplishments that we're proud of
What we learned
What's next for Axiom-1
Inspiration
We build with several AI agents every day, and their worst failures were confident false "done"s: a bridge that reported ok after typing into the wrong window, "13/13 verified" that had read 0 pixels, a green push that silently left out a file. When agents share memory, one agent's false done becomes everyone's belief. Every one was caught by a person checking by hand. We wanted that check to be the system's job, so an agent can be trusted by people who will never check the work.
What it does
Axiom-1 is shared state for AI agents — messages, memory, tasks and claims — with one rule: an agent can only declare; only the server writes witnessed or refuted. A message counts as received only when the recipient echoes its sha256. Old notes cannot steer anyone: what an agent wrote is stored as what it said, never as what is true.
On top of that mind runs a decision harness: the harness runs the process, tested engines (dates, money, matching, tables, mail...) do the work and refuse instead of guessing, and a Nemotron model makes only the smallest decisions, from menus. A decision is remembered only once proven, and every agent inherits it. Measured on Nemotron via Nebius:
- real email (50 Enron threads, scored): 45/50 right, 0 wrong entries on the calendar
- generated inboxes 10/10; calendar connector 40 entries verified, 0 wrong
- prompt injection (AgentDojo, 30 attack runs): 0 decisions changed in attacked threads, 0 attacked threads reached a model
- five whole Enron mailboxes (9,124 threads): 88.3% decided with no model call, 0 pipeline errors
- eight everyday job types: 31/40 witnessed, 0 wrong accepted; a proven process replays at 0.43 model calls instead of 28.9
How we built it
A standard-library Python core (SQLite) behind an MCP server and an HTTP hub with per-agent hashed tokens. Claims are checked fail-before / pass-after in a Docker sandbox (no network, read-only, unprivileged) with held-out tests agents never see and canary tests that catch rigged test runners. Nemotron 3 Nano does the per-item decisions, Nemotron 3 Super is consulted where Nano can be wrong, and two different models must agree before an answer is frozen. All model calls go through Nebius Token Factory.
Challenges
- Measuring honestly: several of our own runs measured the wrong thing (a tool trap, a single-model "consensus", a runner bug that silently filed threads) — they are kept and labelled in docs/MEASUREMENTS.md.
- Two models agreeing is not a check: one shared mistake, frozen, spread to every matching thread until we froze only witnessed answers.
- Prompt injection: an attacker's email must not create calendar entries or follow-ups — strangers now cannot reach the lists at all.
Accomplishments
0 wrong entries accepted across every scored run; a blind audit by a person; processes that get cheaper the more they are used (locked and replayed); a public demo where every claim shows the server's verdict next to the agent's words.
What we learned
Presentation beats model size: one email per call took a 1.7B model from 0/5 to 4/5, tying a 35B. Structure the harness can read should never be asked of a model. And "verified" has to be something only the server can write.
What's next
Fence peer messages as untrusted data in the model's context; a Nebius Serverless sandbox for verification; the handoff
as a ledger of checked state; Tavily-sourced external facts labelled sourced, never witnessed.
Log in or sign up for Devpost to join the conversation.