Gatehold

Local air-traffic control for coding agents.

Comment

Judge in 90 seconds

  1. Open the live replay — no account, API key, payment, or workstation access is required.
  2. Press Play 4-step demo. Scene B is the key GPT-5.6 counterfactual: exact workstream and scope identifiers do not match, so deterministic checks alone would admit the request; GPT-5.6 may add a semantic HOLD, but it can never grant clearance.
  3. Continue to Scene C for deterministic FIFO capacity waiting and Scene D for verified cleanup before authority is released.
  4. Inspect the source evidence and the green main CI gate. The public dashboard is explicitly labeled REPLAY; live-local state stays on loopback.

Product boundary: Gatehold decides whether cooperative work may start and retain a local runtime lane. ProofLatch evaluates release evidence after checks. They have different inputs, state machines, outputs, codebases, and demos.

Inspiration

AI coding sessions can run in parallel, but the developer workstation is still one shared physical system. Worktrees isolate files; they do not decide who owns a product flow, who may use the only simulator or browser profile, or whether several agents should start heavy builds at the same time.

Gatehold was built for a solo developer or small team running cooperative coding agents on one machine. Without a control plane, the human becomes the scheduler: track ownership, watch CPU and memory pressure, reserve ports and simulators, and clean up after sessions finish. The goal is one rule: claim the work, wait for the machine, run in an owned lane, and restore that lane before it clears.

What it does

Gatehold is local air-traffic control for coding agents. Before controlled work begins, it checks workstream clearance and host-capacity clearance. Only one active owner can hold overlapping protected work and exclusive resources. Heavy tasks wait in deterministic FIFO order when local CPU or memory policy says the machine cannot carry more work.

Admitted work receives a TTL-bound lease with heartbeat and cleanup-before-release or cleanup-before-expiry paths. A governed command runs in a private process group. Exclusive resources can include a port, dedicated browser-profile directory, or configured exact simulator UDID.

The lifecycle is fail-closed: ACTIVE -> CLEANUP_PENDING -> RELEASED or EXPIRED. Partial or ambiguous cleanup becomes QUARANTINED. Conflicts and allocations remain held, and unproven processes receive no signal. Gatehold records simulator boot intent before boot, confirms ownership only after a positive check, and shuts down only that exact owned simulator.

The public judge experience is a judge-controlled, continuously labeled synthetic replay. Local mode reads only the loopback daemon on the same machine.

How we built it

The control plane uses Python 3.12, FastAPI, Pydantic, SQLite, psutil, and uv. Its transactional deterministic engine owns conflicts, resource exclusivity, TTL, heartbeat, expiry, FIFO capacity waiting, and cleanup finalization.

A process-group supervisor runs governed commands with durable process identity and secret-derived provenance. Cleanup uses bounded TERM then KILL only after identity verification. Browser-profile deletion requires an exact marker; port release requires bind-free verification.

The macOS simulator adapter uses xcrun simctl and an exact-UDID state machine: external, boot_intent, positively confirmed owned, then cleaned. Fake-adapter tests cover pre-booted, owned, and ambiguous paths; a disposable Simulator smoke verified the live lifecycle without claiming an app or device UI test.

The optional OpenAI Responses API integration uses GPT-5.6 with strict hold-only output, store=False, bounded input, and deterministic fallback. The CLI supports claim, status, heartbeat, release, governed run, and demo. State mutation stays in the CLI/local service with shell=False; HTTP is sanitized and read-only. The public dashboard uses React 19, TypeScript, vinext, and OpenAI Sites. A reusable Codex skill operationalizes claim-before-edit, governed heavy work, heartbeat, and release.

Challenges

The hardest challenge was limiting AI authority. A persuasive model explanation must never become a hidden permission system, so clearance stays outside the model schema. We test failure, refusal, timeout, malformed output, and prompt-injection-shaped input.

The second challenge was honest observability. A public site cannot read a judge's processes or machine pressure, so the hosted experience is visibly labeled REPLAY. Live-local state is a separate loopback path.

The third was cleanup without collateral damage. A vanished agent may leave descendants running, but a reused PID or human process must never be mistaken for owned work. Gatehold verifies provenance; uncertainty becomes quarantine, not optimistic release.

Accomplishments

Gatehold includes a local daemon and CLI that work without an OpenAI key; deterministic one-owner and one-resource invariants under concurrent claims; machine-aware FIFO waiting; provenance-backed cleanup of process groups, descendant dev servers, dedicated browser profiles, ports, and exact Gatehold-owned simulator boots; fail-closed quarantine; a no-secret public replay plus a separate live-local desk; and a reusable Codex skill.

The release inventory records 247 Python contract cases and three Node web contract tests, plus Ruff, Pyright, TypeScript, ESLint, privacy and link checks, dependency audit, production build, and a reproducible judge route.

What we learned

Parallel-agent safety is mostly an authority-design problem. File isolation, semantic understanding, and CPU telemetry solve different layers. Combining them works only when the system is explicit about which component can say go.

Waiting is a product outcome, not an error. A useful control plane explains the hold and recovery condition. Finished cannot mean only that the direct child exited; owned descendants and runtime surfaces must be verified clean without touching anything Gatehold cannot prove it owns.

Codex and GPT-5.6 roles

Codex was the primary engineering collaborator and later became a controlled client of the product it helped build. It translated invariants into the repository and decomposed the daemon, lease model, API, CLI, tests, UI, replay, threat model, and submission package. The human selected the direction and retained the key product and risk decisions.

GPT-5.6 has a separate runtime role. It reviews bounded descriptions for semantic overlap that exact identifiers may miss. Its structured output can only add a hold. It cannot admit work, clear a deterministic collision, allocate a resource, reorder capacity, execute a command, or mutate a lease.

Competitive differentiation

Gatehold does not claim to be the first or only tool for parallel agents. Worktree managers, multi-agent workspaces, process governors, queues, and cleanup utilities already solve valuable parts of the problem.

Gatehold focuses on their intersection: product-work ownership, machine-capacity admission, named runtime lanes, and fail-closed owned cleanup across a cooperative agent's lifecycle. GPT-5.6 may add a semantic hold, but only deterministic local policy can grant clearance, and only verified cleanup can free authority.

Pre-existing work disclosure

Private EVL Labs workstation-coordination prototypes predated the Submission Period start on July 13, 2026 at 09:00 PT. The clean Gatehold repository was assembled during the Submission Period and generalizes collision checks, queued heavy work, named ownership for ports/browser profiles/simulators, host-health signals, recovery, receipts, and fail-closed cleanup.

No private source code, repository history, user data, credentials, or private prompt transcripts were copied into Gatehold. Competition-period work adds the generalized state machine, schemas, daemon/API/CLI, hold-only GPT-5.6 boundary, synthetic replay, public UI, tests, documentation, and Codex skill.

The submitted Codex session is a long-running product thread containing an earlier, clearly separate ProofLatch workstream before the explicit Gatehold pivot. The shared session ID reflects thread continuity, not shared source.

Distinction from ProofLatch

Gatehold prevents parallel local agent/workstation collisions before work starts. Its inputs are work claims, resource requests, and local capacity; its output is a lease and admission receipt. ProofLatch evaluates a bounded release-evidence packet after checks; its output is a deterministic release decision and evidence receipt. They use different codebases, product contracts, state machines, tests, user flows, videos, and submission narratives. They share no product source code.

Fast judge path

No account, API key, payment, or workstation access is required. Open https://gatehold-buildweek.e-vigelis.chatgpt.site and confirm the mode is labeled REPLAY. In about 90 seconds, the replay shows admitted ownership, a semantic collision held before editing, FIFO capacity waiting, exclusive runtime lanes, exact-UDID simulator ownership, and verified clean finish.

For the local source path on macOS 13+, install Python 3.12, uv, Node.js 22.13+, and npm, then run uv sync --dev, npm ci, uv run gatehold init, uv run gatehold demo, and npm run verify. The deterministic product and demo require no OpenAI key; an optional server-only key enables the GPT-5.6 adviser.

What's next

Next: signed local client identity, richer agent-runtime adapters without expanding model authority, workstation policy profiles, privacy-preserving aggregate metrics, and opt-in remote coordination only after a new authentication and threat model.

Built by Evaldas Vigelis at EV1 Labs · Explore the OpenAI Build Week collection.

Built With

Share this project:

Updates