Inspiration Sooner or later someone asks a company running AI agents: "Who approved what your agent did, and can you show it?" Most setups cannot answer this question reliably, the worker might do the same mistake again as there's only a chat window, no log to see who did what exactly. We wanted to try and fix this issue with one small loop.
What it does: draft → gate → correct → sign → learn → prove Firstly, as a test GPT-5.6 Terra writes an outreach email for a made-up company. The Governor calls it R3 — it would go outside the company, so a human has to approve. Claim Guard stops it: the draft promises "95% for every team" with nothing behind it. Human Gate — a person rewrites it and approves. Claim Guard checks again right then, so a lazy fix doesn't get through. The approved version is signed with a local Ed25519 key and added to a hash chain — the Evidence Passport. Exam Runner turns that correction into a test. The old text fails it, a fresh GPT-5.6 run passes it, and the older tests still pass. No email is sent. Nothing touches a real system. All data is made up.
How we built it Built entirely with Codex, from a written spec — a goal, hard rules, and a clear definition of done — rather than blindly trusting the output. The Codex mainly wrote the Python API and state machine, the risk classifier, Claim Guard, the Ed25519 ledger, Exam Runner, the web page, the tests and the Docker setup. Then it ran its own tests and fixed it's errors until all 22 tests have been passed succesfully.
GPT-5.6 has two jobs, kept apart on purpose: it writes the drafts, and it can comment on a claim review — but it can't remove a finding. Only the rules block, and only the rules unblock.
draft (GPT-5.6) → Governor: R3 → Claim Guard: BLOCKED ↓ Human Gate ← checks again ↓ Evidence Passport (Ed25519, hash-chained) ↓ Exam Runner: correction → test → regression
Challenges Getting the same answer twice. If a model decides what's blocked, the same text can pass today and fail tomorrow. So every blocking decision is a plain rule; the model only adds comments. A gate that actually holds and does not ignore it's own rules. Our first version trusted whatever the person typed. It shouldn't. Now Claim Guard runs again on approve — and while recording the demo it rejected our own first fix, because it still had a bad claim in it. That rejection is in the video. Not pretending the model learns. It would sound better to say it does. The correction becomes a test and a short prompt example. The API says it plainly: "model_weights_changed": false.
There are two ways to run this. First is fixture mode by default so anyone can clone and run without an API key; second is live GPT-5.6 mode for the hosted demo, labelled in the interface.
What we learned The useful part isn't the model — it's the work that has been done around it. Decide what the agent may do, stop it at the step that matters, keep a record someone else can check. And one person's fix becomes a test every future run has to pass. The work doesn't get thrown away.
What's next More correction types · letting someone verify the chain without trusting us · real keys instead of a demo signer.
Honest scope This certifies nothing, isn't legal advice, and makes no compliance claim. R0–R5 are labels we made up for the demo. The signature shows records weren't changed under a local demo key — it isn't a legal e-signature. You get a record of what happened with a human in the middle, and you can test it in about ninety seconds.
Log in or sign up for Devpost to join the conversation.