railward: a self-attacking gate for AI agents that signs the proof

Most guardrails for AI coding agents just ask you to trust them. I built one that attacks itself and hands you the proof.

What it is

railward is a fail-closed gate for untrusted AI coding agents. The agent can propose any action, a small pure function decides allow, deny, or ask, and the decision is fail-closed, so anything a policy does not explicitly permit is refused. The model never reaches the decision.

The part I care about

It ships with its own adversary: a battery of 41 dangerous commands it must refuse, plus fail-open probes. Every run signs a hash-chained Ed25519 proof of exactly what was blocked. Flip one rule from deny to allow and the proof goes red. The claim is falsifiable, and a stranger can reproduce it.

$ railward attack --out proof.json
41 attacks, 41 blocked, 0 leaked; 4 fail-open probes, 0 open -> proof.json

Verify it with nothing installed

Open the browser verifier at https://ourbando.github.io/railward/verify.html , paste a proof.json, and it recomputes the hash chain and checks the Ed25519 signature in your browser. Nothing is uploaded.

Use it

• pip install railward, then use the CLI or the Python library.
• As a Claude Code plugin: /plugin marketplace add Ourbando/railward then /plugin install railward@railward.
• It runs offline, on your own hardware, in pure Python, with almost no dependencies.

It is a control layer, not a guarantee, and the threat model is honest about the ceiling no software gate can cross.

Contribute

The adversary is one line per attack. If you know a dangerous command class it should block, adding it is a one-line PR that joins the signed proof, with your name on the changelog line that closed it.

MIT, 116 tests green. Stars, forks, and attacks welcome: https://github.com/Ourbando/railward