Warden

warden

**A governor for autonomous agents. Autonomy is admitted by reversibility, not by confidence.**

Zero dependencies. Bring your own model, or none at all. Every test in this repo runs offline.

from warden import Action, Ledger, Warden, parse

w = Warden(articles=parse(open("constitution.md").read()),
           scope={"restart": ["A1"]}, always=["A1"],
           ledger=Ledger("warden.jsonl"))

d = w.propose(Action(
    kind="restart",
    target="ingest-worker-7",
    apply=lambda: subprocess.run(["systemctl", "restart", "ingest-worker-7"]),
    undo=lambda: subprocess.run(["systemctl", "stop", "ingest-worker-7"]),
    signal=lambda: worker_is_processing(),   # True == the problem is fixed
))

d.lane      # "A" it ran unattended, or "B" a human decides
d.outcome   # verified | reverted | failed | refused

If the signal does not go green inside the window, the undo runs by itself. If that fix type gets rolled back twice on the same target, it demotes itself to Lane B and stops asking.

---

The problem this solves

You give an agent the ability to fix things. Now you have two questions you cannot answer: *did the fix work?* and *should this thing still be allowed to try?*

Most agent frameworks answer the first with "the tool call returned 200" and the second with "yes, forever." That is how you get a loop that confidently retries a broken fix every night for a month.

The design, in order

Every gate that can be answered deterministically runs **before** the one that needs a model. A model failure can then only ever cost you an unnecessary approval, never an unattended action.

#	Gate	Where
1	Protected-target exclusion	pure Python, no override
2	Reversibility precondition	pure Python, no override
3	Earned trust (has this fix type been demoted?)	ledger, fails closed
4	Constitution scoring	your judge, veto only
5	Execute, then poll the original signal	anti-windup clamp