Governance · Guard
Guard is the trust firewall in front of the ledger. It binds every connection to one scope before the first tool call, refuses a capture that cannot support itself — with the rule named and the remedy stated — and records the decision as an event you can audit later.
Guard has no fast path. A capture crosses the same five gates whether it came from an interactive session or an unattended agent — and a failure at any gate is visible, named, and recoverable rather than silent.
Gate 1
The connection presents a project, a repository, and a worktree. Guard issues a binding with an epoch. Nothing has been read or written yet.
Gate 2
A capture arrives carrying a claim, the files it cites, and the commit it was true at. Guard treats it as a proposal, not a fact.
Gate 3
Rules run against the proposal and its scope. A pass records the claim as unreviewed. A failure refuses it by name and says what would fix it.
Gate 4
T1 re-checks the cited anchors against the current files. T2 contrasts the claim against what the scope already believes and opens a contradiction if they disagree.
Gate 5
Contradictions and provisional claims land in a review queue that reads like a pull-request queue. Only an authenticated person moves a claim to confirmed.
This is what a blocked capture actually looks like: the rule that fired, the attempt that tripped it, and the refusal — with a remedy attached. Every card below is markup, not a screenshot. Select it, copy the digests, read it with styles off.
A claim that touches production credentials must cite a durable source and pass human review before it can be recalled as settled.
The agent tried to record a conclusion it drew from the conversation. It cited nothing — no file, no commit, no incident report.
Nothing entered the ledger as a belief — but the attempt, the policy that stopped it, and the moment it happened were all appended as an event. A refusal you cannot audit is indistinguishable from a bug.
Illustrative example — not live data
Trust is a measurement here, not an adjective. Each tier states what it can prove and what authority that earns it — and the tier with the most to say has the least power.
Anchor content-hash checks, artifact drift against the current file state, and reproducible commands whose pass/fail is machine-decidable.
The only tier that may change a belief’s validity on its own — because its verdicts are facts, not opinions.
Contradiction detection inside a scope, held as a graph of contradicts / supersedes / supports edges between belief versions.
Never auto-resolves. It surfaces the cluster and makes recall abstain until a T1 fact or a human settles it.
An advisory LLM judge under a hard per-org spend cap. When the budget runs out it refuses visibly rather than degrading to an unmarked cheaper path.
Proposes only. It can never change validity or review state — a human or a T1 fact disposes. No judge or provider code exists in the verifier today.
TrustBench measures trust behaviour, not retrieval scores: does a claim carry its provenance, does a contradiction surface, does recall abstain when it should, and does review state survive a handoff.
A published benchmark number is only worth reading if you can reproduce it. The rule we hold ourselves to: scores publish from a tagged public harness whose artifacts are archived, and the site links the harness version.
That harness is not released yet, so this page shows the suites and not a score. When it ships, the number and the command that produces it arrive together.
Illustrative example — not live data
Two of these are designed and not built. They are listed anyway, badged as such, because a governance layer that misrepresents its own coverage has already failed at its job.
A connection is admitted to one project, one repository, one worktree before its first tool call. First-tool-call binding is forbidden; changing scope requires a newly admitted connection.
Rules evaluate every write. A refusal names the policy that fired, the scope it protects, and the concrete step that would make the capture admissible.
Review state — unreviewed, needs review, confirmed, rejected — is metadata on every belief, set only by an authenticated human, and carried through handoffs with its origin intact.
Deterministic checks and semantic contrast run today with no judge, no provider, and no network. Their verdicts are recorded as verification events.
The budgeted judge is specified — spend cap, visible refusal, recorded model and prompt digest, no authority over validity — and deliberately not implemented yet.
TrustBench report cards block the pipeline. Gates may be tightened in a pull request; loosening one requires an architecture-decision amendment.
Published numbers must be reproducible from a tagged public harness whose artifacts are archived. Until that harness is versioned and released, no score is published here.
Admissions, refusals, and verifications are appended as digest-bearing events. Superseding a record never overwrites the one before it.
Guard is easiest to judge from its failures. Read the trust semantics, then walk the golden path and admit a scope yourself.