FlakeBrake is a commitment firewall for humans and agents.
A human-governed TrueForge agent that replans constrained work, pauses for exact authorization, mechanically blocks equivalent denied actions, executes one fenced mutation, verifies the result independently, and reconnects without repeating a single owner decision or effect.
TrueForge action chain every station below is a real TrueForge 0.1.4 interface, exercised on every judge run
Honest by construction: the judge path runs genuine TrueForge 0.1.4 sessions, turns, dynamic subagents, MCP connectors, sandbox execution, native approval events, and reconnect behavior — with a bounded local deterministic model provider, so judging needs no OpenAI or Daytona credentials and produces the same evidence every time.
01The operator problem
Agent systems are good at producing a plausible next action. They are far less reliable at deciding whether a new commitment stays feasible next to every promise already accepted — the human review budget, the agent work budget, the production window that protected orders already occupy. The dangerous failure mode is quiet: the agent says yes first and discovers the conflict mid-execution, when capacity is already spent.
Most agent demos never touch this. They show a happy path where the model's confidence is treated as authority, and they skip the questions an operator would actually ask:
A chat transcript that says "sounds good" binds nothing. FlakeBrake pauses the TrueForge turn and shows the owner the exact tool, arguments, expected effect, and a SHA-256 action digest before anything is allowed to happen.
Renaming an action or switching to another tool adapter is the oldest trick in the book. FlakeBrake's denials are typed, durable constraints that recognize the same material effect through equivalent representations — and block it without another human call.
A completed tool response is not success. FlakeBrake fences a single execution attempt, stores one receipt, reads the factory back independently, and only then exposes a verified terminal state. Refresh the browser and the counts don't move.
02Built on TrueForge
The mission runs inside the pinned TrueForge 0.1.4 server through the pinned 0.1.3 SDK — not a lookalike shim. TrueForge owns the session and turn graph, the dynamic subagent threads, the MCP connector routing, sandbox execution, the native approval pauses, and reconnection. FlakeBrake supplies what TrueForge deliberately doesn't decide: the admission kernel, exact authorization semantics, denial equivalence, fencing, and independent verification.
package.json, surfaced live in the judge UIflakebrake-root-obligation-commanderthe only role that talks to the ownerfactory-orders · factory-capacity · factory-simulator · factory-change-controlflakebrake-deterministic/m4-missiona bounded local model endpoint registered with the real TrueForge server
What the root agent spec declares before any run: four MCP services, sandbox enabled, dynamic subagents enabled, four approval-gated tools. Setup facts — never presented as runtime proof.
4 services configured · Dynamic · configured
What this run actually exercised, from durable runtime evidence: services reached, sandbox executions, subagent threads, owner calls, model requests.
4/4 services reached · 3 threads evidenced
The only state presented as success: an independent read-back of authoritative state confirming the one approved effect, recorded as a terminal event.
Terminal verified success
What the deterministic profile does and doesn't prove. The judge run proves the orchestration and safety mechanics through TrueForge's genuine public interfaces; it does not evaluate an external model's judgment, because the provider is a bounded deterministic endpoint built for reproducible judging. Separately, the repository carries credential-gated test coverage — skipped without an external M0 configuration — that exercises an OpenAI model provider and a Daytona sandbox provider through the same boundaries. That coverage is an optional assurance gate, never part of the credential-free judge path.
03The commitment firewall
TrueForge coordinates specialist agents, tool calls, sandbox execution, approval pauses, and reconnect. FlakeBrake sits behind the consequential MCP boundaries and checks capacity, authorization, denied-effect equivalence, execution identity, factory results, and replay — before another agent, or a human, relies on the consequential outcome.
Specialists recommend. Before a recommendation can become a consequential effect, the root's change-control call and FlakeBrake's stores independently re-evaluate the exact action against current authoritative state. Only the root invokes the consequential change-control tools, and in the deterministic fixture the effect arguments are constructed from authoritative SQLite state — raw prose cannot authorize, mutate, verify, or replay an effect. That precision matters, so the firewall's claim comes in two distinct layers:
Layer 1 · Recorded recommendation
TrueForge keeps each specialist thread and its output in durable history — context the root works from, evidence a judge can read. FlakeBrake makes no claim to understand or certify arbitrary prose, and this isn't deception detection: another agent can consume the authoritative domain outcome, but nothing verifies the semantic truth of a specialist sentence.
Layer 2 · Governed effect
Capacity, authorization, equivalent denial, execution identity, read-back, and replay are enforced against current authoritative M1–M4 state before another agent or human relies on the consequential outcome. An unsupported, stale, conflicting, duplicated, or unverified consequential claim is mechanically unusable.
Capacity recommendations are recomputed against the authoritative versioned basis — the deterministic kernel re-evaluates the complete portfolio at the MCP boundary, and the assurance engineer independently recomputes demand, ranking, and protected-order preservation in the sandbox.
M1 kernel · versioned Promise Basis
A stale basis cannot be treated as current. Acceptance atomically compares the complete evaluated version tuple; once portfolio v2 is durable, the v1 REPLAN can never be accepted.
M2 ledger · version compare-and-swap
A differently worded denied action remains denied. Typed effect normalization matches the material effect across tool names and schemas, so the active denial blocks the equivalent representation — no new owner call, no mutation.
M2 ledger · typed denial equivalence
An executor cannot declare success merely because it returned a receipt. Independent read-back of authoritative factory state and a terminal verification event stand between the mutation and the word "success".
M3 boundary · independent read-back
A restarted agent cannot repeat an already completed effect. Attempts are fenced and idempotent: replay converges on the original durable result and creates no second mutation.
M2/M3 · fenced idempotent attempts
Routine inter-agent checks are automatic — nobody is interrupted while the firewall recomputes, matches versions, or converges a replay. Humans enter exactly where policy says a consequence needs an owner: the four approval-gated change-control tools that pause the TrueForge turn.
Architecture sequence the amber station is the only one that costs a human interruption — and only when policy requires it
04The deterministic hero scenario
A rush order arrives at a synthetic microfactory whose protected, important, and best-effort orders already consume finite human-review, agent-work, and production-cell capacity. Every run of the story below is the same, end to end, because the basis is canonical and the code is deterministic — which is exactly what makes it checkable.
Evaluation is side-effect free. The complete portfolio is checked against declared capacity: agent work would go over by 2 and owner decisions over by 1. Nothing is dropped, nothing mutates.
Replan candidates are whole portfolio states, not local patches. The winner modifies one best-effort display order from quantity 10 to 8. Protected work is a hard constraint and stays untouched.
TrueForge pauses the turn natively. The owner sees the mission, tool, expected effect, and the SHA-256 action digest — and authorizes only that.
Portfolio v2 is durable before readmission. The fresh ADMITTABLE evaluation and its exact authorization grant commit in one transaction — the stale v1 REPLAN can never be accepted.
The 09:10–09:40 slot conflicts with protected production commitments. The denial is not a chat message; it becomes an active, typed constraint in the ledger.
The planner submits the same material effect through a different MCP adapter, submit_schedule_change. Typed effect normalization recognizes it, and the active denial blocks it — no extra owner call, no mutation.
09:40–10:10 is a genuinely different effect, so it earns a real decision of its own. The owner approves it against its own digest.
The grant's allowance is claimed, the attempt is fenced and idempotent, one synthetic factory mutation runs, and one receipt is stored. A retry returns the original durable result instead of acting twice.
Verification doesn't trust the mutation's own response. Authoritative state is read separately, and actual consumption is appended to the ledger: 6 agent work units, 30 production-cell minutes.
The terminal verified event is recorded, and the root TrueForge mission is allowed to complete. The UI's outcome flips to "Verified success" — and it means it.
05The owner boundary
These are two different safety properties, and FlakeBrake demonstrates both in the same run. Conflating them is how agent demos oversell — a human "no" that evaporates on the next rephrase isn't governance.
Human judgment
A person looks at the exact 09:10–09:40 reservation — mission, predecessor turn, tool, expected effect, digest — and chooses Deny action. That choice is recorded durably, with its rationale, as an active constraint.
Mechanical enforcement
When the same material effect arrives through a different tool name and schema, typed effect normalization matches it to the active denial and blocks it automatically. No second interruption, no mutation, no chance to relitigate by rewording.
About that digest: every consequential action is bound to a SHA-256 content digest of its exact identity and arguments. It's a precise fingerprint for matching decisions to actions — a digest, not a cryptographic signature, and FlakeBrake never pretends otherwise.
06Exactly once, then proven
Counts rendered live by the judge UI and asserted by the deterministic test gates — including zero duplicate approvals and zero unauthorized mutations. Refreshing the browser changes none of them.
This record proves the one-time-locked factory command committed. By itself, it is not verified success — and the UI says so in exactly those words.
Authoritative factory state is read separately from the mutation result, and actual consumption facts are appended to the immutable ledger.
Only after the read-back matches is a terminal verified event recorded and the root mission allowed to finish.
07Reconnect without regret
Mission identity, the TrueForge session and turn graph, approvals, tool results, and the terminal projection are all durable. A refresh calls the read-only state API and replays that projection — it does not restart the mission, reopen an approval, or repeat an effect. The harness ribbon labels the state plainly: Durable session replayed.
The same discipline runs deeper than the browser: a lost approval response reconciles to its existing successor turn, same-mission retries converge on the original durable result, and the client's monotonic request generations and durable revisions mean an old poll can never overwrite a newer decision or regress a verified outcome.
08Operator proof center
Judges shouldn't have to reconstruct the causal chain from a timeline. The Operator Proof Center sits at the top of the judge UI and answers the four operator questions at a glance — direct plan, safe winner, owner boundary, durable outcome — then backs each answer with disclosure drawers built from the same canonical projection the ledger holds: exact control decisions, capacity before/after impact, durable proof and replay, and optional technical identities.
Architecture
The model can propose; deterministic code evaluates and authorizes; the owner decides; the ledger remembers; verification reads back independently. Each layer exists so no other layer has to be trusted for something it can't prove.
Pure portfolio feasibility, candidate ranking, Promise Basis versioning, and typed effect comparison. Returns ADMITTABLE, REPLAN, or REJECT — and never mutates anything.
Append-only admissions, owner decisions, denials, grants, shared allowances, fences, attempts, receipts, and actual-consumption facts. Acceptance and grant issuance commit atomically; database-incarnation identity keeps replaced files from impersonating state.
An invocation-owned factory behind four Streamable HTTP MCP services. Exact-once mutation, independent read-back, and idempotent replay live here — the browser never touches SQLite.
The root obligation commander, three dynamic subagents, sandbox execution, four MCP connectors, native approval pauses, and durable session/turn recovery — TrueForge 0.1.4 running the loop for real.
A loopback-only service projecting canonical backend state, with strict request validation, monotonic polling, bounded shutdown, and the Operator Proof Center on top.
The full trust-boundary and data-flow write-up, including the end-to-end mermaid diagram, lives in docs/architecture.md; the frozen normative contract is PRODUCT_SPEC_v0.1.md.
Code quality
Every implementation PR was reviewed by the GitHub Qodo application, remediated with focused regression tests, re-reviewed at the exact head, and merged only after separate human adjudication. The trail is public — and it's presented here as evidence of process, not as a claim that automated review replaces testing or human approval.
FlakeBrake went through 16 Qodo-reviewed pull requests, resolving more than 50 findings, with zero unresolved findings on the merged release. Earlier milestone trails live in merged PR #2, #3, and #4; later rounds — submission readiness, M5 polish, and the Judge Clarity corrections — in #8, #9, and #14. Each preserves initial findings, remediation rounds, exact-head re-reviews, and the final human adjudication.
Three-minute demo
Run it yourself
git clone https://github.com/dvellon/flakebrake.git
cd flakebrake
npm ci
npm run m5:ui
# open http://127.0.0.1:4173 · choose "Start hero mission"
# no OpenAI or Daytona credentials requiredThe judge service binds to loopback only, creates its stores in an invocation-owned temporary root, and cleans up on Ctrl+C. The full credential-free verification ladder — typecheck, deterministic test suites, and the Firefox browser gate — is in the README.