Francis — Governed Local Execution for AI Agents

Francis is a local-first governed AI operating layer where agents receive exact one-run authority, execute in isolation, prove every result, deny replay, and always leave control with the human.

Comment

Inspiration

One permission. One execution. No replay.

AI agents are becoming capable of operating tools, files, and infrastructure, but their authority is often implicit: a prompt becomes a tool call, the tool call becomes a side effect, and the operator has to reconstruct what was permitted afterward.

Logs can show that something happened. They rarely prove that the exact actor was allowed to perform the exact action only once, in the exact environment, against the exact input.

Francis starts from a different rule: a model may propose an action, but a proposal is never permission.

What it does

Francis is a local-first governed execution layer for agentic work. The OpenAI Build Week vertical proves one complete lifecycle:

  1. A one-run lease binds one actor to one route, method, action, run, and expiration window.
  2. Separate approvals bind runtime start and container isolation to exact fingerprints.
  3. Francis revalidates tenant lineage, source code, the fixed image, command, mounts, security limits, and input before Docker starts.
  4. The runtime executes as a non-root user with no network, read-only tenant input, dropped capabilities, and bounded resources.
  5. A handshake and heartbeat correlate Docker's host PID with PID 1 inside the container namespace without pretending those identifiers are equal.
  6. The runtime performs useful work on synthetic local work items.
  7. The controller independently recomputes the result instead of trusting the runtime's assertion.
  8. Exact cleanup removes only the proof-owned container.
  9. Replaying the consumed lease returns the governed public denial contract.
  10. Immutable receipts remain available for local verification.

The proof is deliberately legible:

USEFUL RESULT -> REPLAY DENIED -> CONTAINER GONE -> RECEIPT REMAINS

Without Francis, a capable agent may retain authority longer than the task that justified it. Francis makes that authority exact, consumable, and provably gone.

Judges can verify that claim without rebuilding Docker: the public Execution Flight Recorder loads the exact frozen proof bundle, recomputes its receipt hashes locally, rejects malformed or weaker states, and begins at the truthful default NO BUNDLE LOADED.

After the official bundle verifies, judges can select RUN 3 ATTACKS AGAINST THIS PROOF. The viewer derives three temporary copies in browser memory and requires the same verifier to reject altered receipt bytes, reusable authority, and a hidden leftover container. The official proof remains unchanged. The full judge scorecard maps the four official criteria directly to public evidence.

The first user is a technical founder managing multiple AI agents alongside sensitive local work. Their recurring job is to permit one bounded task against the correct tenant, verify the result, remove the runtime, prevent replay, and retain evidence they can inspect later.

How we built it

Francis separates proposal, authority, execution, evidence, and cleanup into explicit contracts. The Build Week implementation crosses:

  • FastAPI permission gates;
  • one-run pilot-scope leases;
  • exact approval and lineage bindings;
  • a fixed, digest-bound Docker image;
  • a real non-fixture Francis runtime process;
  • network, mount, user, capability, and resource restrictions;
  • cross-namespace process-identity correlation;
  • runtime handshake and heartbeat verification;
  • independent output recomputation;
  • exact cleanup ownership;
  • replay denial; and
  • immutable, locally verifiable receipts.

The judge experience includes a dependency-free Execution Flight Recorder at https://ap3pp3rs94.github.io/Francis-Build-Week-2026/judge-viewer/. One click loads the exact official bundle from the same origin, binds its bytes to the published SHA-256, recomputes receipt hashes locally, rejects malformed or weaker states, and visualizes the lifecycle without inventing success data. Its default state is explicitly NO BUNDLE LOADED.

How Codex and GPT-5.6 were used

Codex was the primary engineering collaborator for the Build Week extension. Austin assigned stable names to replaceable Codex sessions so their roles could survive a session ending. ATLAS is the primary named Codex build session; other named sessions identify bounded implementation, review, and verification lanes. They are not characters, separate products, or independent authorities.

The names anchor a durable continuity system. The canonical roadmap defines the direction. The completion ledger records validated progress, exact commits, receipts, blockers, and handoffs. If a Codex session is stopped or replaced, its successor resumes from those artifacts instead of relying on lost private model context. ATLAS coordinates work against the roadmap, but it cannot rewrite ledger truth or grant Francis runtime permission.

GPT-5.6 powered the primary ATLAS build task and independent review lanes that inspected contracts, implemented bounded slices, ran tests, diagnosed real Docker failures, and challenged claims before promotion. Deterministic Francis contracts and Austin's explicit decisions remain the execution boundary.

The most valuable moments were not one-shot code generation:

  • Codex reconstructed repository and CI truth before mutations.
  • GPT-5.6 helped split authority from execution instead of creating one privileged tool call.
  • A real Docker run exposed two equivalent spellings of no-new-privileges; the implementation accepted only the proven equivalent forms and continued rejecting malformed or weaker values.
  • A later run exposed the difference between Docker's host-side PID and PID 1 inside the container namespace. The identity model was corrected to preserve both identities and bind them to the same container evidence.
  • Review lanes challenged receipt truth, denial behavior, source drift, cleanup, replay, and preservation of unrelated containers.

GPT-5.6 provides build intelligence, not hidden runtime authority. Francis's governance layer remains deterministic and fail-closed: model reasoning proposes work; explicit code contracts decide whether execution is permitted.

Austin retained the key product and engineering decisions: keep execution local-first, make authority consumable rather than ambient, require useful work instead of a start-only demo, preserve public denial redaction, protect unrelated runtimes, and refuse to call Stage 18 closed without the wider evidence. Codex accelerated the implementation and proof loop; it did not choose the authority boundary or promote the capability by itself.

Challenges we faced

The hardest part was refusing to turn a passing mock into a capability claim. Real Docker behavior forced the design to change.

Readiness timing on Docker Desktop was slower than the first bounded lease. Process IDs also meant different things on the host and inside the container namespace. Finally, the public denial response intentionally redacted its internal reason, which meant the proof harness had to verify the governed public contract while independently confirming consumed lease state.

Each failure became a narrower contract and regression test instead of a broader exception.

Accomplishments we are proud of

  • The same authority cannot be used twice.
  • The runtime produces useful output that is independently recomputed.
  • Identity is correlated across the Docker trust boundary without false PID equality.
  • Cleanup targets only the exact proof-owned container.
  • Unrelated running containers remain untouched.
  • Receipts can be recomputed locally rather than trusted as screenshots.
  • Failure, denial, cleanup, and uncertainty are first-class product states.

What we learned

The next leap in agent usefulness will not come only from more model capability. It will come from making capability governable enough to trust.

Observability is not governance. A log says what happened. Governance must establish who was authorized, which exact action was allowed, what environment actually ran, what changed, and whether that authority can be reused.

What's next

Francis is an active Phase 2 system, not a finished product. This proof uses synthetic, non-sensitive input in a bounded local pilot. It does not claim production multi-tenancy, persistent actor grants, credential access, live Orb authority, or external network action.

The next work is to advance the remaining Stage 18 evidence gates while preserving the same operator-controlled authority model, then make the proof and receipt surfaces understandable without requiring the operator to read implementation code.

Most demos ask you to watch what an agent can do. Francis asks you to watch what it is not allowed to do twice.

Build Week disclosure

Francis existed before OpenAI Build Week. The repository identifies the pre-event baseline, the eligible event-window delta, the exact submitted head, and the new managed-copy execution vertical. Austin Peppers is the individual entrant. Development assistance from OpenAI Codex and GPT-5.6 is disclosed in the submission and judge materials.

Built With

Share this project:

Updates