SeeP.
The agent cannot execute a change.
Most agents that can run commands are a chatbot with a shell attached: the model decides, the machine obeys. That is fine on a scratch VM and unacceptable in production. SeeP inverts it. The agent investigates freely with read-only tools, and when it wants to alter something it produces a plan.
The invariant
No mutation happens without an authorization that is verifiable after the fact by someone who does not trust the gateway.
Identification
- Designation
- RGN-04 · SeeP
- District
- Sovereign Infrastructure
- Function
- Auditable Operations Agent
- Source
- Open
Answers
“Who is on call at 3am, and what stops it breaking production?”
- Approvals are ed25519-signed, single-use, and expire. A captured bundle replays into a refusal
- The executing node verifies the authorization itself against a key it pinned at enrollment
- Policy as code: two-person rules, change freezes, blast-radius tiers. Rules only ever tighten
- Hash-chained audit log: editing one entry breaks every link after it
- sovereign = true keeps every token on your own hardware, with no remote failover
One route, six stations
Refusal is the shape
of the code.
Not a line in a prompt. The agent is handed a tool registry with no mutating tools in it, and three stations on the path below can stop a run outright.
- 07Audit chainhash-chained
Station 01 / 06
Agent
Reads files, tails logs, lists processes, describes Kubernetes objects. Its tool registry contains no mutating tools, so a model that ignores its entire prompt still gets Forbidden back.
The guarantee, precisely
What holds, and
what does not.
Proven
A plan cannot be swapped after approval
Signatures cover a hash of the plan's steps, arguments and resolved node list. The executing node recomputes that hash from the plan it was handed.
An approval is single-use
Every approval carries a random nonce, burned in a durable ledger on the machine that executes. A captured bundle replays into a refusal.
An approval expires
A yes from six hours ago is not consent to act now.
A compromised gateway cannot forge authorization
Nodes pin the gateway key at enrollment and verify operator signatures against keys they hold. A gateway that lies is caught by the node, not trusted by it.
The audit log is tamper-evident
Entries are hash-chained and ed25519 signed. Editing one breaks every link after it; deleting one leaves a sequence gap, and verification names which.
Some things nobody can authorize
A compiled-in constitution refuses rm -rf /, overwriting a raw block device, and a handful of others outright. Configuration can add to that list and cannot remove from it.
Not proven
Deletion is detectable, not prevented
Someone with write access can truncate the log. Verification reports the chain is short; it cannot report what was removed. Export to append-only storage if that matters.
Chat approvals are channel-bound, not device-signed
Tapping Approve in Slack proves the allowlisted account tapped approve, and the record says channel-bound rather than device-signed. Hold your own key, or require one, for the stronger claim.
Redaction is defence in depth
Secrets with a recognisable shape are masked in output. One that looks like ordinary prose is not.
Overstating the first column would be the one failure this system cannot afford, so the second column is written down and shipped with it.
Policy as code
Rules only ever
tighten.
No rule ordering lets a permissive rule override a deny, and a policy file that cannot be read makes every action require approval. Failing to evaluate is failing closed.
~/.seep/policy/prod.toml
[[policy]]
name = "prod-irreversible-two-person"
decision = "require_approval"
require_signatures = 2
require_typed_confirmation = true
message = "Irreversible change to production requires two operators."
[policy.match]
env = ["prod"]
irreversible = true
[[policy]]
name = "weekend-freeze"
decision = "deny"
message = "Production change freeze: Friday 15:00 through Sunday."
[policy.match]
env = ["prod"]
read_only = false
[policy.during]
days = ["friday", "saturday", "sunday"]
hours_range = "15-23"Incidents
Triaged before
you wake up.
- 01The alert is normalized and deduplicated by fingerprint. A problem firing every thirty seconds updates one incident rather than paging you every thirty seconds.
- 02The agent investigates with read-only tools only. It physically cannot change anything while unattended.
- 03It posts a diagnosis and, where it can, a specific proposed fix.
- 04You approve from your phone. The plan runs. The postmortem writes itself.
Without a webhook secret configured, every incident endpoint rejects everything. An unauthenticated alert endpoint is a remote paging button for the internet.
Tools
Seventy-odd, compiled in.
No Python, no per-call process spawn, and they work on every enrolled machine the moment the agent lands there. Every tool declares whether it mutates; only the read-only set is reachable during unattended triage.
fs_*
read · write · list · search · stat · diff · hash · tail
sys_*
info · cpu · memory · disk · processes · ports · health
git_*
status · log · diff · blame · commit · pull · push
docker_*
ps · logs · inspect · stats · restart · compose · prune
svc_*
status · logs · start · stop · restart · reload
k8s_*
get · describe · logs · events · rollout · scale · rollback
http_*
get · request · health
shell_*
run · which
A model's claim about its own blast radius is a floor, never a ceiling. SeeP rescores every step independently and takes the higher of the two.
Model routing
sovereign = true
Absolute. If the local model is down, SeeP degrades rather than failing over to a remote one: an availability problem must not quietly become a confidentiality one. On Cordon, the same guarantee holds with an attestation behind it.
Next system
05 / 08