AxiomGate

Agents breach their action boundary in 55.8-67.8% of measured tasks. AxiomGate enforces that boundary at the Codex hook, not in a prompt.
Blast Radius: the authority scope each mission may act inside, and every action the hook refused. 8 governed, 3 blocked, 4 scopes.
Offline receipt verification: contract hash, 40 chained evidence records, citations, completion gate. Change one byte and it fails.
The hook denies pull_request.create: it requires PUBLISH, above the mission boundary MODIFY_LOCAL. PatchPilot then flags vulnerable lodash.
Approval reaches the phone: single-use, bound to the exact command hash, expires in 15 minutes, recorded against a private-chat actor.

Inspiration

Coding agents finish real work now. What nothing checks is whether they stayed inside the boundary you intended, or whether "done" was ever true.

That gap is measured, not anecdotal. Across 2,208 prompt variants, UnderSpecBench reported action-boundary violation rates of 55.8 to 67.8%, including deterministic Wrong Target and OverScope oracles. OpenAI Codex issue #16798 records the same failure mode: an agent can ignore repository governance unless enforcement sits outside model narration.

Two assumptions cause most of it. Permissions usually live in a config file the agent itself can edit. Completion is usually whatever the model claims. AxiomGate removes both.

What it does

AxiomGate is a local-first governance runtime for OpenAI Codex. Every mission compiles into a versioned, hashed contract with explicit authority, then runs five governed stages:

Stage	What it guarantees
Plan	Objective and acceptance criteria compile into a hashed contract before Codex writes a line
Guard	Identity resolved, policy enforced at the Codex hook, not suggested in a prompt
Run	Codex builds under a sandbox and an intent boundary, with usage ledgered
Verify	Tests and scanners produce machine evidence. Model claims are inadmissible
Prove	Completion is gated on evidence and sealed in a tamper-evident Build Receipt

The receipt records the contract hash, a SHA-256 chained evidence trail, criterion citations, and the completion verdict. Anyone can verify it offline, on any machine, with no account.

Verify it yourself in 60 seconds

No login, no credentials, no network after install:

npx -y axiomgate@latest doctor
npx -y axiomgate@latest replay all

replay all runs three deterministic regressions through production logic: wrong-target ownership denial, exact-command approval binding, and missing-evidence completion blocking.

Then prove the receipt is real. Verify it, change a single byte, verify again:

axiomgate receipt verify evidence/<mission>-receipt.json   # PASS
# edit one character in the file
axiomgate receipt verify evidence/<mission>-receipt.json   # FAIL, naming the broken record

How we built it

Built with Codex end to end, routing GPT-5.6 by tier rather than using one model for everything: Luna at light effort to scout, Sol at max effort to implement, Terra at medium to remediate, and Terra at high as an independent verifier. The routing is recorded in each mission contract and shown in the dashboard.

AxiomGate integrates through native Codex surfaces rather than wrapping them:

Hooks for PreToolUse and PermissionRequest enforcement
An MCP server exposing six tools, read-only except approve
A Codex plugin and marketplace manifest
A custom read-only verifier agent, so no agent grades its own homework
The App Server for real account capacity, source-labelled, never estimated

Dependency verification runs through PatchPilot, consumed unmodified as the published patchpilot-cli through a process boundary. Approvals reach a phone over Telegram using Bot API long polling only, with no webhook or public listener, single-use and bound to an exact command hash.

Challenges we ran into

The hook fails open by default. A bare exit 2 deny is silently ignored under approval_policy="never". Enforcement only holds when the hook returns JSON with hookSpecificOutput.permissionDecision: "deny". We found this by spiking it, not by reading it, and every session id is logged.

Wildcard matchers also fail open. On Codex CLI 0.144.x a .* matcher does not reliably intercept. Tool names have to be enumerated exactly.

We found a bypass in our own security model. A governed agent could write into the .axiomgate directory and rewrite the authority that governs it. Enforcement that a model can edit is not enforcement. We hard-denied writes into governed state ahead of policy evaluation, added a 23-case regression suite, and published the fix.

Honest labelling is harder than faking it. Every replayed scene is labelled REPLAY, every sampled figure SAMPLE, and captured runs STORED LIVE EVIDENCE. The demo orchestrator prints that it launches no model. It would have been easier to imply everything ran live.

Accomplishments that we're proud of

Enforcement that holds even under bypass permissions, verified against a live Codex run
A receipt that genuinely fails when tampered with, not a checkmark that always passes
Evidence admissibility as a first-class rule: command, api, and hook sources count. Model narration never does
Finding and fixing a critical bypass in our own system rather than shipping past it

What we learned

Governance has to sit where the agent cannot reach it. Anything the model can edit is a suggestion. The moment we treated "done" as a claim requiring evidence rather than a status the model reports, most of the design fell out on its own.

What's next for AxiomGate

Receipts are hash-chained but unsigned, so offline verification proves internal consistency rather than publisher authenticity. Signing is the next layer. Beyond that: macOS and Linux verification, CI enforcement, and multi-repo fleet governance.