ProofGate

Deterministic authority control for model-proposed actions.

Comment

Inspiration

AI models can generate useful and plausible action proposals, but a proposal must not automatically become executable authority. This distinction becomes critical when an AI agent proposes a payment or another consequential action.

ProofGate was created to place a deterministic control boundary between model output and real effects:

The model proposes. ProofGate decides.

What it does

ProofGate is a local developer-control prototype for deterministic authority control over model-proposed actions.

A model may generate a candidate action, but ProofGate independently:

  • resolves the proposed action into an exact canonical action;
  • evaluates deterministic policy;
  • manages reservation, authority projection, and permit state;
  • releases execution only when the required authority is valid;
  • applies the permitted effect to a sandbox ledger;
  • generates a linked evidence chain; and
  • verifies the internal integrity of the resulting decision path.

The demo presents three scenarios:

  1. Authorized Transfer — Live OpenAI proposal generation
    Result: AUTHORIZED / APPLIED / VERIFIED

  2. Policy Denial — Deterministic Mock Test
    Result: DENIED / NOT APPLIED / VERIFIED

  3. Invalid Permit — Deterministic Mock Test
    Policy may allow and authority may remain active, but permit integrity fails.
    Result: REJECTED / NOT APPLIED / VERIFIED

OpenAI is used only to generate the candidate proposal in the recorded Authorized Transfer scenario. It does not authorize, permit, execute, or verify the action. The two safety scenarios use deterministic Mock inputs so judges can reproduce the exact denial and rejection paths.

How we built it

ProofGate is implemented as a TypeScript and Node.js monorepo with:

  • strict shared contracts and canonical serialization;
  • cryptographic signing and verification helpers;
  • a deterministic policy kernel;
  • authority, reservation, projection, permit, and execution state machines;
  • an in-memory sandbox ledger;
  • evidence-chain and manifest construction;
  • an internal-integrity verifier;
  • Mock and OpenAI proposal compilers;
  • a local competition web console; and
  • security, integration, concurrency, tamper, and fail-closed tests.

Codex using GPT-5.6 contributed to repository-aware implementation, testing, hardening, documentation, and submission preparation. The human retained responsibility for the product architecture, authority model, safety boundaries, intellectual-property decisions, Live-versus-Mock disclosure, review of generated changes, and final submission decisions.

The final repository passes formatting, linting, strict type checking, 342 tests across 30 test files, and builds all 16 workspace projects.

Build Week work

The broader ProofGate product direction, authority model, safety boundaries, and underlying intellectual-property foundation predate Build Week.

During Build Week, the working repository implementation was created and hardened, including the deterministic control components, OpenAI proposal integration, web console, test suite, documentation, fresh-clone validation, and private no-install/no-build judge bundle.

Challenges

The hardest engineering challenge was maintaining a strict boundary between an untrusted model proposal and executable authority.

Other important challenges included:

  • ensuring every failure path closes safely;
  • preventing policy approval from being mistaken for execution permission;
  • detecting invalid permits even when policy and authority state appear valid;
  • binding evidence to the exact instruction, action, decision, and effect;
  • testing concurrency and tamper resistance; and
  • creating a judge path that requires no dependency installation or build.

What we learned

Generative intelligence and executable authority should be separate system concerns.

Models are valuable for interpreting intent and proposing structured actions. Deterministic systems are better suited to deciding whether those actions are permitted, authorized, executable, and internally verifiable.

ProofGate evidence verifies internal integrity and linkage under the implemented rules. It does not claim to prove external-world factual truth.

Accomplishments

  • A working deterministic authority-control pipeline
  • One recorded Live OpenAI proposal path
  • Two reproducible deterministic safety paths
  • Verified fail-closed policy and invalid-permit behavior
  • 342 passing tests
  • A clean fresh-clone validation
  • A private prebuilt judge bundle requiring no installation or build
  • Complete internal evidence and verifier results for all three scenarios

What's next

Future work includes:

  • production-grade persistent storage;
  • authenticated multi-user deployment;
  • hardware-backed and managed key infrastructure;
  • richer policy-authoring tools;
  • additional action packs beyond sandbox payments;
  • broader platform validation; and
  • integration with agent frameworks and enterprise execution systems.

Limitations

ProofGate is a local competition prototype using a sandbox ledger.

It does not execute a real payment, is not presented as production-ready, and does not provide external-world factual verification.

Built With

Share this project:

Updates