FinePrint — Cross-Examine your agent's rules

FinePrint — Cross-Examine your agent's rules against what it actually enforces

FinePrint is an independent, verifiable inspector for AI coding agents. Developers write house rules (invariants) for their agents; FinePrint cross-examines three things against each other: the declared intent, the harness's native policy-engine decision, and the observed live effect. A disagreement between any two is a finding, with sealed evidence.

The demo walks three gates on the same adversarial scenarios: the Decision gate (what the harness's own rules decide — including cases where the rules say nothing at all), the Approval gate (whether anyone is ever asked before something runs — for silent cases, nobody is), and the Effect gate (what actually happens — in the demo, nothing destructive runs by design, with a tamper-evident record).

In this entry, NVIDIA Nemotron-3 running on Nebius Token Factory acts as the adversarial scenario generator: it proposes tricky wrapper and variant commands that probe the invariant set, and the deterministic FinePrint checker adjudicates each one, with live effects observed in containment. The public repo contains the full engine, method, Catalogue v1, the Nemotron integration module, tests, and the sealed live demo evidence from Oct 30, 2026.

Real proof in the demo: starting from 2 forbidden and 4 silent verdicts, four added policy rules — covering shell wrappers, production deploys, forced deploys, and environment-variable wrappers — re-run through the same checker produce 4 forbidden and 2 prompt, with zero silent cases. The environment-wrapper case routes to a human (prompt) rather than a silent pass, because prefix rules cannot see through an environment prefix.

Real-repo validation: FinePrint measured langchain-ai/openshell-deepagent, a Nemotron-powered coding agent — every agent command came back undecided at the command layer (a policy-coverage gap, not a vulnerability). The fix is preserved at https://github.com/vroomanalytics123/openshell-deepagent (branch fineprint-command-guard) because the upstream repo is archived and cannot accept pull requests.

Second real-repo validation: FinePrint measured earendil-works/pi, a widely used open-source coding agent — by default its command path has no Decision gate and no Approval gate, and its only shipped command check uses raw-string patterns that miss trivial variants. The structural fix is in PR https://github.com/earendil-works/pi/pull/11608 (48-case behavior matrix verified, tests passing). The PR was auto-closed by that repo's new-contributor gate, which requires maintainer approval before a PR can stay open — not a judgement on the fix — and approval has been requested.

Built With

• factory
• nebius
• nemotron
• nvidia
• python
• token