Temple of Two
← Instruments

RFC

COSMIC-ALLOW

A cross-vendor proof-of-allow protocol for AI coding-agent cockpits: deny is the ground state.

RFCPublished · v1.1Supported within scope

Fail-closed by construction · Apache-2.0

The question
Agent harnesses fail open by default. What does it take to make deny the thing that happens when the system breaks?
The instrument
A proof-of-allow protocol: deny is the ground state, allow requires an unforgeable sentinel, and a kernel sandbox floor is the load-bearing boundary rather than the policy layer above it. Reference implementation in cosmic-cli.
The finding
Fail-closed is achievable across vendors without a shared runtime, provided the sentinel is unforgeable and the sandbox floor — not the policy engine — is what actually holds.
What failed
Policy-layer-only enforcement. Any harness where the policy engine is the boundary can be talked past by the thing it governs. The kernel floor exists because the earlier design could not survive that.
Standing
RFCPublished · v1.1Supported within scope
Verify it
DOI 10.5281/zenodo.21461197 ↗Reference impl · cosmic-cli ↗

Metrics with scope

Every number names what was measured, on what sample, and as of when.

  • Ground state

    Deny

    Protocol invariant; allow requires a positive unforgeable proof

    As of 2026-07-20 · source

  • License

    Apache-2.0

    Reference implementation, cosmic-cli

    As of 2026-07-20

From wonder to receipt

COSMIC-ALLOW

Wonder initiated the search. Rigor changed the answer.

RFCPublished · v1.1Supported within scope
  1. 01Wonder

    Every agent harness I have used fails open. What would it take for the broken state to be the safe one?

  2. 02Hypothesis

    If deny is the ground state and allow requires a positive unforgeable proof, then any failure of the policy layer degrades to refusal rather than permission.

  3. 03Instrument

    A cross-vendor proof-of-allow protocol with a kernel sandbox floor as the load-bearing boundary, implemented in cosmic-cli.

  4. 04Encounter

    Policy-layer enforcement can be talked past by the thing it governs. Only the sandbox floor survived that, which is why the floor — not the policy engine — is the boundary in the RFC.

  5. 05Standing

    Supported within scope: the protocol holds across vendors without a shared runtime. Not a claim that any specific deployment is secure.

  6. 06Receipt

    DOI 10.5281/zenodo.21461197 · cosmic-cli, Apache-2.0

DOI 10.5281/zenodo.21461197 ↗Reference impl · cosmic-cli ↗