Open Integrity Forge is an extension of Open Integrity that controls the output of AI agents, ensuring that a human always oversees any agentic commit. It does so through integration with cloudflare passkeys.
Why is Open Integrity Forge Important?
The core Open Integrity architectures ensures the transparency and immutability of your software projects. It creates a root of trust and builds a chain of trust from that, allowing for the empowerment and revocation of keys, which must always be used to authorize commits.
But more is needed to ensure Open Integrity in the age of AI. Open Integrity Forge takes the next step by reining in AI agents with Open Integrity rules. This ensures that they don’t make unauthorized changes to your code base, and that a human instead oversees every update.
How Does Open Integrity Forge Work?
Building on Open Integrity, Forge starts with an inception commit. A second commit then lays out a set of rules for the repository:
| Rule | Statement |
|---|---|
| R0 | The first commit of main is the root of trust. Its approval verifies against the promoter key in its own policy. Its hash is the repository id. |
| R1 | Each later commit of main carries an approval from a promoter in the policy of its first parent. |
| R2 | Only a commit of main with such an approval changes .repo/. A key that a commit adds has no say over that commit. |
| R3 | Each other commit that main reaches carries a valid SSH signature from a key in the policy in force when it came in. |
| R4 | An approval names this repository, the ref, the parents and the tree of its own commit. |
| R5 | An author key signs only inside its validity window. |
| R6 | A key a promoter revoked signs nothing after its revocation; its earlier work still verifies. |
| R7 | Where the policy says mergesOnly, a commit of main with one parent changes only .repo/, so no squash drops the authors’ signatures. |
| R8 | A release tag of a main commit carries approvals of that tag from as many distinct promoters as releaseApprovals asks. |
All AI agents are given their own forks and one-hour signing
keys. Changes they make go to their forks. Only the human with the
passkey can merge these changes into main.
Cloudflare Integration
Cloudflare runs the whole forge, but it doesn’t decide what is valid: that lives in the repositories.
- Artifacts holds every repository. A project is an Artifacts repository; each agent works in an Artifacts fork of it, with a short-lived write token scoped to that fork alone. Anyone can clone a repository straight from Artifacts with a read-only token that lasts an hour and verify it, with no forge in the loop.
- Workers: the forge is one Worker on a custom domain. It serves the page, prepares each commit for a passkey to sign, speaks Git to Artifacts with isomorphic-git, and serves the one-file verifier that each repository pins by digest.
- Queues: Artifacts push events reach a Queue, and the Worker checks every push against the repository’s own rules. A push from outside the forge, by an agent or from a laptop, is judged the same way.
- Durable Objects (SQLite) keep each project, each agent run, and each person.
passkey-cloudflare, Blockchain Commons’ passkey-only identity library, is built for Cloudflare too, and the forge’s sign-in and every approval run on it. It deploys inside the application’s own Worker and keeps identity in Durable Objects, so no identity provider, password, or email stands between a person and their account: https://github.com/BlockchainCommons/passkey-cloudflare
Open Integrity Forge Demo
|
A full demo of Open Integrity Forge is available at https://forgedemo.gordianstack.com/. After you create & login with a passkey, you will be able to make a first commit, admit two agents, watch them work, promote one change, and bounce another when the AI goes rogue. |
Open Integrity Forge Video
|
|
This video of Open Integrity Forge is broadly split into three parts: a discussion of the problem and solution (2 minutes), a demo of the project (3 minutes), and a look at the principles and libraries used in this project (1 minute). |