Trust-aware AI work routing
ZivLabs
Open source · public V1What it does
A dependency-free multi-AI workspace: AgentLane routes by capability and trust, ContextForge keeps context grounded, and delivery fails closed without current evidence.
Read the source on GitHubProof
A delivery is not a model answer.
The public core stays local by design. It allows delivery only when the conditions below are independently present.
A bounded candidate change
| Check | Observed state | Decision |
|---|---|---|
trusted execution surface | REQUIRED | Required |
source-bound handoff | CURRENT | Required |
non-empty diff receipt | PRESENT | Required |
declared check receipt | PASS | Required |
model response alone | UNVERIFIED | Not trusted |
stale handoff | STALE | Refuse |
This is a documentation example of the public policy, not a claim that a provider ran or that a change was delivered.
Case study
- Public V1 modules cover routing, context, execution, verification, delivery, persistence and a desktop shell
- Deterministic demos and current CI exercise the same orchestration contracts
- MIT licensed and dependency-free at the public core
- Problem
- A useful AI worker still needs a reliable answer to a simpler question: may this proposed change cross the delivery boundary?
- Approach
- Keep routing, handoff freshness, verification, and delivery as small pure functions. A host application supplies any provider adapter and its independently proven isolation boundary.
- Architecture
- A task signature selects an eligible execution surface. A source-bound handoff and a receipt containing both a diff and a declared passing check are required before delivery is allowed.
- What went wrong
- A policy library cannot create isolation by itself. Treating a provider name or a successful command as proof of confinement would make the boundary fictional.
- Result
- The public V1 makes the whole contract inspectable: route by capability and trust, ground continuation against the current revision, and deliver only after verification.
- Limits
- The repository is a host-neutral foundation, not a claim that providers ran or that a host has proven confinement. Production adapters must establish those boundaries separately.