railward: a self-attacking gate for AI agents that signs the proof

Armando Shkambi — Sun, 19 Jul 2026 11:19:01 +0000

Most guardrails for AI coding agents just ask you to trust them. I built one that attacks itself and hands you the proof.

What it is

railward is a fail-closed gate for untrusted AI coding agents. The agent can propose any action, a small pure function decides allow, deny, or ask, and the decision is fail-closed, so anything a policy does not explicitly permit is refused. The model never reaches the decision.

The part I care about

It ships with its own adversary: a battery of 41 dangerous commands it must refuse, plus fail-open probes. Every run signs a hash-chained Ed25519 proof of exactly what was blocked. Flip one rule from deny to allow and the proof goes red. The claim is falsifiable, and a stranger can reproduce it.

$ railward attack --out proof.json
41 attacks, 41 blocked, 0 leaked; 4 fail-open probes, 0 open -> proof.json

Verify it with nothing installed

Open the browser verifier at https://ourbando.github.io/railward/verify.html , paste a proof.json, and it recomputes the hash chain and checks the Ed25519 signature in your browser. Nothing is uploaded.

Use it

pip install railward, then use the CLI or the Python library.
As a Claude Code plugin: /plugin marketplace add Ourbando/railward then /plugin install railward@railward.
It runs offline, on your own hardware, in pure Python, with almost no dependencies.

It is a control layer, not a guarantee, and the threat model is honest about the ceiling no software gate can cross.

Contribute

The adversary is one line per attack. If you know a dangerous command class it should block, adding it is a one-line PR that joins the signed proof, with your name on the changelog line that closed it.