Five safety gates for LLM agents, wired as one lifecycle, with one hash-chained audit log — and the measurements that say what each gate does not do.
This repository is the documentation, the limits and the evidence. The implementation ships as a paid bundle; five of the layers it composes are my own MIT-licensed repositories and are free, linked below. Nothing here is a teaser: the limits file and the changelog are the same files a buyer gets, not a trimmed version of them.
The input guard blocks 27 of 27 prompts in our own corpus and 5 of 42
in the corpus that was written to break it. No threshold setting closes that
gap — the sweep is in docs/LIMITS.md §1. Both corpora ship
with the package, so the bad number is reproducible in one command rather than
quoted:
python bench/run_bench.py --corpus ./corpus/reviewer # 5/42, 0 false alarmsGates 2, 3 and 5 are where this earns its keep. If a safety package tells you only the good numbers, you are reading marketing.
| Claim | Measurement | Where |
|---|---|---|
| Side effects executed twice | 4 attempts at one $24.00 refund on one broken order: 11 duplicate refunds ($264.00) without gate 3c, 0 with it | docs/PRODUCT-README.md, bench/dup_probe.py |
| The same under real concurrency | 40 concurrent OS processes racing one identical refund: 1 executed, 39 deduplicated | same |
| The approval gate under attack | all four ways into 1.2.0 re-run across 46 attempts; 45 failed closed, the one exception raised TypeError instead of denying — and is written down |
NOTICE.md |
| The audit log is tamper-evident | entries are hash-chained; a removed or edited entry is visible; guardstack verify returns the answer |
evidence/ |
No test count appears in this repository, on purpose. That number has gone
stale twice in this project's own documents — once as "under a second", once as
"337 tests, ~2.3 s" — because a figure copied by hand into four files will be
wrong in at least one of them. In the package it lives in one place, and
tests/test_documented_counts.py fails the build if it drifts from what
pytest actually collects. NOTICE.md tells that story in full.
| File | What it is |
|---|---|
docs/LIMITS.md |
What the five gates do not do, measured. Read this before trusting any of the above. |
NOTICE.md |
What you buy and what is free, including an idempotency contradiction this project shipped for four releases and how it was resolved |
CHANGELOG.md |
Every release, and every correction — old sentences are struck through in place rather than deleted |
docs/PRODUCT-README.md |
The package's own README: the five gates, the lifecycle, the configuration surface |
docs/QUICKSTART.md |
The first five minutes, as a buyer sees them |
docs/TUNING.md · docs/CORPUS.md |
Threshold behaviour, and how to bring your own corpus |
evidence/ |
Two generated evidence reports — the ordinary run, and the adversarial one |
Commands and paths in these files (bench/, corpus/, tests/) refer to the
package, which is not in this repository.
GuardStack is assembled from five of my own MIT-licensed projects. All five are free on GitHub and will stay free.
| Layer | Repository |
|---|---|
| Input / output guard | llm-guardrails |
| Permission grants + hash-chained audit | mcp-permission-server |
| Approval gate | agent-approval-gate |
| Retry / circuit breaker | agent-reliability-kit |
| Read-only enforcement | readonly-guard |
The five are five separate demos: separate configs, separate audit logs,
separate ideas of what "denied" means, and they do not compose. Wiring them
into one lifecycle behind one log — and finding out where that composition
leaks — is the paid work. NOTICE.md says exactly which parts
were portable and which had to be built.
If you would rather assemble the five yourself, you can, and the free repos are a fine place to start.
Current release 1.3.1 — https://buy.polar.sh/polar_cl_Zgd01SZaW8RwTEc8j7MMpWryCwLBFmoeMoPt53a4yoV
MIT-licensed, like the five repos it draws on. What you are paying for is the composition, the limits document, and the fact that every number above was measured rather than asserted.
MIT — see LICENSE. Copyright (c) 2026 Jigon Yoo.