Quorum

The Inspiration: The Autonomy Paradox

As AI software engineering agents (like Devin or Antigravity) gain write access to file systems and terminal shells, we observed a fundamental paradox:

The Promise: Highly productive agents working in the background to fix bugs, upgrade dependencies, and clean code. The Reality: Developers are terrified of giving agents complete autonomy because a single hallucinated terminal command or prompt-injected payload could wipe a database, leak environment variables, or commit a security vulnerability. The Bottleneck: To mitigate this, developers use "human-in-the-loop" review. But clicking "Allow" on every file read or compile command creates massive approval fatigue, completely destroying the velocity benefits of autonomy. We asked ourselves: How might we build a system that allows developers to safely delegate execution rights to autonomous agents, without requiring constant human oversight?

Our answer is Quorum: an independent, decoupled gatekeeper that uses multi-model consensus, strict permission layers, and relational audit trails to guard agent actions.

How We Built It: Architectural Foundations

We designed Quorum to be modular, robust, and decoupled from the primary agent executing the work. The project is built using:

Node.js & TypeScript: Enforcing strict type safety across all orchestration runners. Hono & Model Context Protocol (MCP): Providing a standard API interface to connect with any modern agent system. SQLite Relational Database: Building a robust auditing schema with tables for Runs, Tasks, and Failures to record every single action. The Guardrail Pipeline Context-Bound Permissions: Before an agent can propose an action, its target repository files are validated. The validation engine hashes the files and enforces strict relevance limits to prevent directory traversal and unauthorized data reading. The Consensus Council: When a potentially destructive or high-risk action is proposed, it is broadcast to the Quorum Council. The council queries multiple independent LLM backends (Gemini, Claude, GPT) concurrently. Audited Execution & Fail-safes: The consensus decision and all individual model outputs are saved in the relational database. If consensus is reached, the action executes. If any model flags a high severity threat, execution halts immediately, and a manual override notification is generated.

What We Learned

Decoupled Security is Essential: You cannot ask an agent to audit itself. If an agent is jailbroken or hallucinating, its internal security prompts are bypassed. The guardrail must exist as an independent gateway. Structured Failures Drive Recovery: In multi-agent systems, knowing that a task failed is not enough. We learned to programmatically classify failures into structured codes (e.g. rate limits, timeouts, safety blocks) to enable automated retries or escalations without failing the entire run. Auditing Builds Trust: By keeping an active, relational audit trail in SQLite, we can generate real-time compliance dashboards for security teams, proving exactly which model approved which command and why.

Challenges Faced & Overcome

Concurrency & Rate Limits: Running parallel LLM queries across different providers caused frequent API throttling. We solved this by implementing a custom ProviderSessionPool that dynamically manages connection limits and handles retry backoffs exponentially. Context Freshness Mismatches: Codebases change rapidly during a developer agent's run. If an agent proposes an action on a file that was modified mid-run, static validation files fail. We introduced real-time context digests and warnings (ValidatedCouncilContext) that detect file drifts. Balancing Latency vs. Security: Querying multiple models adds latency. We overcame this by only invoking the full council for "high-risk" tools (like terminal execution or file writing) while allowing low-risk tools (like reading files) to pass through lighter validation.