TrustShell · the trust harness
Earned autonomy, inside a signed ceiling
Safer and cheaper are the same design, not a trade.
Three controls work together: a sandbox limits where an agent can reach, a guardrail limits what it can try, and a harness is the signed record that travels with it. An agent earns trust, learns skills, uses tools, and unlocks more autonomy — but only ever inside a ceiling the person already signed. The same structure that keeps it safe is what lets it run on small, cheap models.
Three controls, pulling the same direction
Each one is blind to exactly what the others catch, so you need all three — /layers is the deeper tour. The part told less often: the same three controls are what make an agent cheap to run.
Sandbox
limits WHERE
A room: the files, hosts and money the agent can reach at all.
Safety A prompt injection that lands still cannot touch what the room walls off.
Efficiency A specialist only needs its own corner, so you run a smaller, cheaper model in a tighter space instead of one giant one with the run of the house.
Guardrail
limits WHAT
A rule the agent cannot edit: a schema, a payee list, an amount, a two-family check.
Safety The limit is named, not hoped for — this tool, this host, this cap. A jailbreak cannot argue it away.
Efficiency A typed, bounded task is one a small model can do reliably. The guardrail is what makes cheap models safe to delegate to.
Harness
the signed RECORD
Who owns the agent, what it agreed to, and what it has earned — carried across every surface.
Safety A person is at the root. The owner revokes, and everything under that grant stops at once.
Efficiency Standing travels with the agent, not the vendor, so switching to a cheaper or better model is a routing change, not starting over.
The ladder: earn trust, then climb
Autonomy is not granted up front; it is earned and it is reversible. An agent starts narrow, builds a record of checked behaviour, and that record is what widens — or, after a bad call, narrows — the band it is allowed to act in.
Earn trust
Behaviour that checks out builds a portable reputation. A clean streak can restore a band the owner granted — it can never raise the cap above what the person signed. A Caught, an off-list payee, or a dispute drops the band and asks the person.
Learn skills, then use tools
Skills are added read-only first; the tools that spend, post, or cannot be undone sit behind the higher bands. More standing unlocks more reach — never the reverse order.
Unlock autonomy, inside the ceiling
The ceiling is a grant the owner signs once: a cap, a payee list, an expiry, a purpose. Lowering the cap and pulling the grant happen immediately; raising it waits and can be cancelled. On money and health, a person still breaks the tie. A rented agent gets the session, not the key, the memory, or root.
The tier bands, the exact score moves and the restore cadence are engine governance and are published, open by design, on /repid — this page describes the shape and links there rather than restating the numbers.
Why more than one family checks a claim
Shipped today Today the check on /check asks two model families, from different builders, and both must agree for a pass. A lone FALSE flags the claim, and a lone TRUE with no independent second abstains, so one family that is wrong or offline cannot carry a verdict alone. This is the same principle as disjoint-family verification.
Roadmap The design goes further, and none of this runs today. A third vote from a different family would break a tie without letting one lineage decide alone, and agreement would have to clear a golden-ratio supermajority across more families. A split would be handled honestly: a clear supermajority would be a real result, while a 2–1 split would only set a provisional label and not move the score. A bare majority is a note that something is contested, not a verdict that it is settled.
Neither writes anything to a score on this site. How scores do move is documented on /repid.
Design: a clear supermajority
RoadmapIndependent families would clear the bar. It would count as a real check. A check on this site writes nothing to a score.
Design: a 2–1 split
RoadmapNot a clean result, so it would not be treated as one. The label would record the disagreement; the score would stay where it was.
The router: cheaper because safer Shipped today
Behind the check is a router over many models — open-source LLMs and specialized small models (SLMs), each good at a narrow job. Work routes to free-tier models first and reaches paid ones only when the free tier is exhausted or the task needs more, with the paid fallbacks ordered cheapest-first.
That is where safety and cost stop fighting. Because each check only needs a handful of independent families — not one enormous model doing everything — more independence is also cheaper per check. Adding a decorrelated family hardens the quorum and lowers the bill at the same time. The router chooses who answers; it does not grade the answer — grading is the families' job, and the constitutional-audit layer that would add a fuzzy score on top is a gated-off stub, carrying no weight today.
Skills and tools: a note is not an install
The skills and tools surface is built to do less than it looks like — on purpose, because a control that reads as doing more than it does is worse than none.
Picking a belt is a note in your browser
Choosing a belt writes a preference down locally. It does not give any agent a role and it installs nothing. A role is a signed grant another app can check — made on the Agents page, not by a click here. The tools a belt lists start read-only, with the setting that keeps them read-only shown beside each one.
Suggesting a skill stores a link, nothing more
The box keeps the link, in your browser. It does not install, download, run, fetch or even open it — the saved address is shown as plain text, not a clickable link, so there is no action from that screen that reaches it.
Try the harness
The PAI is the agent at the root that holds the session. Claiming an agent is the signature that makes it yours. Both run on Base Sepolia testnet — the money there is practice money with no value, and the on-chain spend path and escrow are still being wired.
Go deeper