Guardrail

• 

  Turn one production mistake into a deterministic, tested protection for Codex or Claude Code.

• 

  Attack tests prove dangerous force pushes are blocked while safe near misses stay allowed—before export.

• 

  Sourced incident → GPT-5.6 policy data → deterministic compile → attack-test → protected.

• 

  GPT-5.6 designs declarative policy data; deterministic code executes it. Hooks remain defense in depth.

Inspiration

AI coding agents are fast enough to make the same operational mistake at machine speed. Existing hook generators often ask a model to write executable safety code and then trust the result. That moves the risk instead of removing it. Guardrail started with a stricter question: can a model help design the policy while never owning the executable surface?

What it does

Guardrail turns a plain-English rule or a sanitized, sourced incident into an installable protection for Codex or Claude Code. GPT-5.6 returns a constrained PolicyBlueprint: declarative conditions, rationale, limitations, hard-control fallback, and proposed block/allow fixtures. A deterministic compiler—not the model—emits the JavaScript hook and platform configuration.

Before Guardrail marks anything verified, it runs seven static compiler checks and executes the proposed fixtures against the deterministic policy engine. The artifact must prove a dangerous case is blocked and a safe near miss is allowed. Inconsistent model-authored fixtures are rejected. The final downloadable kit contains the hook, platform config, install steps, executed evidence, limitations, and the server-side or CI control that must back it up.

The learning loop also preserves source URL, verification date, confidence, severity, and the lesson locally, so one failure becomes a reusable reflex instead of tribal memory.

How we built it

Codex was the lead builder and technical sparring partner. It challenged the original “LLM writes hook code” architecture, checked current Codex and Claude Code hook contracts, designed the declarative trust boundary, implemented the compiler and separate runtime adapters, built the product UI and test suites, and repeatedly ran production builds plus terminal Playwright QA. The full session trail is recorded in SESSION-HANDOFF.md and Git history.

GPT-5.6 is used through the OpenAI Responses API with Structured Outputs. It maps natural-language rules and incidents into schema-validated policy data only. It never writes executable JavaScript. Guardrail attaches provenance server-side, compiles deterministically, rejects inconsistent fixtures, and fails closed if the minimum evidence set does not survive.

Codex and Claude Code intentionally use separate adapters because their hook payloads and trust lifecycle differ. The emitted scripts have zero runtime dependencies and avoid eval, subprocess spawning, and network access.

Challenges

The hardest problem was defining a trust boundary that remained honest after model output. Schema-valid JSON does not make model-authored expectations true, so Guardrail added a second deterministic execution gate and now refuses to persist or export an artifact unless both a real block and a real safe near miss pass.

Production abuse controls were another challenge. The two GPT routes share durable atomic admission, bounded request bodies, zero SDK retries, output ceilings, trusted identity handling, and fail-closed behavior. A provider-side Vercel project anomaly then classified every documented pre-production path as Production. We removed every deployment and chose not to turn a hosting anomaly into a security claim.

Accomplishments that we're proud of

• GPT-5.6 remains the policy architect, never the executable author.
• Separate Codex and Claude Code adapters execute against representative real payloads.
• Every verified artifact requires static validation, blocking fixtures, safe near misses, limitations, and a hard-control fallback.
• The judge-visible learning loop shows Mistake → Analyze → Gotcha → Compile → Attack-test → Protected.
• A one-click verified kit contains executable output, config, installation, evidence, and residual-risk disclosure.
• The current suite passes 40 tests across seven files, plus typecheck, lint, and production build.

What we learned

Structured Outputs guarantee shape, not truth. Model-authored tests are still claims until a deterministic system executes them. Agent hooks are also defense in depth, not complete security boundaries: branch protection, CI policy, secrets scanning, least privilege, and provider controls still matter.

What's next for Guardrail

Expand the policy primitives and adapter coverage, then add a protected hosted sandbox only after the public cost and security launch gates have independent provider-level enforcement and live evidence. The current submission deliberately favors a truthful private-repo test path over an unsafe public GPT endpoint.

Built With

• claude-code-hooks
• codex
• codex-hooks
• gpt-5.6
• next.js-16
• openai-responses-api
• playwright
• react-19
• structured-outputs
• typescript
• upstash-redis
• vitest
• zod