I build the boundaries between AI autonomy and the systems that must trust it.

An AI system's own account of what it did is not independent evidence. Fornax builds an external evidence layer around AI behavior so actions, outputs, and observable reasoning signals can be checked against what actually happened — separate from what any system reports. The signal taxonomy is designed for any observable AI system; reasoning summaries and model-internal telemetry activate as providers expose them.

First surface: Coding agents (Claude Code, Codex, opencode) — the first and most deeply instrumented environment.

Current boundary: Evidence collection today covers execution traces; model-internal reasoning is available only when a provider exposes it and is never fabricated.

source · architecture invariants External signals: Reasoning trace integrity — OpenAI · Agent monitorability — METR

Every AI agent action happens under some authority — but who granted it, under what policy, and what actually occurred is rarely observable. Agent Assembly is governance infrastructure: policy enforcement on every agent action, a tamper-evident audit trail, and independently deployable enforcement mechanisms each with an explicit capability boundary. An absent mechanism is reported absent, never assumed present.

First surface: AI developer tools (Claude Code focus), with an evidence-backed protection lifecycle from detection through host enforcement.

Current boundary: RC series — API not stable; eBPF terminates processes after the fact, not before.

source · limitations and known bypasses External signals: Agent Control Standard — OWASP · Agentic misalignment — Anthropic

Protected compute — hardware accelerators and other high-value resources — should not be reachable by default. Eltanin enforces that default-deny posture: a workload must hold a scoped, expiring authorization or the resource stays closed. Monitoring after the fact does not satisfy this requirement.

First surface: Linux/NVIDIA as the hard device-enforcement proof target; Apple Silicon/Metal as a distinct functional evidence class.

Current boundary: Enforcement crates not yet merged; device-level proof not yet established on hardware.

source · security model · North Star External signal: Cloud compute abuse — Microsoft

Disk cleanup that defers to AI recommendations without a deterministic policy gate is dangerous. Glomeris discovers reclaimable developer storage on macOS, explains why each candidate is or isn't safe to remove, and executes only policy-approved typed actions — re-measuring actual freed bytes. An optional LLM may rank candidates; it cannot invent or authorize a deletion.

Current boundary: macOS-only experimental MVP; Homebrew and Docker cleanup have architectural constraints.

source · safety model · known limitations External signals: Excessive Agency — OWASP · Agentic misalignment — Anthropic

Faster AI-assisted implementation makes it easier to efficiently produce work that should never have existed. Requirement Zero forces a requirement to justify its existence using observable evidence — who actually needs it, what breaks without it — before implementation begins. Codebase Zero applies the same challenge to complexity that already exists.

Delivered as: Agent Skills for AI coding agent workflows.

Current boundary: Evaluation on six cases shows modest accuracy improvement; downstream cost savings are unmeasured.

source · evaluation results External signal: Capability ≠ judgment — METR

Evidence over claims. Observations are recorded before interpretation runs. A missing signal is never treated as a pass.

Failure paths are part of the design. What happens when enforcement is absent, evidence is missing, or authorization is refused matters as much as the happy path.

Security boundaries stay explicit. Compatibility is not protection. An absent mechanism is reported as absent.

Negative results stay visible. An evaluation superseded because its confound inflated the numbers is published with the corrected, less favorable results.

• Can AI behavior be independently verified without modifying the system being observed? Coding agents are the current test; the harder question is whether it holds for any observable AI system.
• Which enforcement point — in-process SDK, proxy, or kernel-level eBPF — genuinely prevents unauthorized agent action, and what does each one actually stop versus observe?
• How do you prove "no protected compute without authorization" on real hardware rather than in a simulator?

PyFake-API-Server · 🛠️ Maintenance paused · v0.4.2 · PyPI
Configurable mock HTTP server; define API responses in YAML or import from an OpenAPI spec.

multirunnable · 🗃️ Legacy · v0.17.0 · PyPI
Unified Python API across multiprocessing, threading, gevent, and asyncio.

@horonomy — Fornax · Eltanin
@ai-agent-assembly — Agent Assembly
Software Engineer · LINE corp. · LinkedIn