CommitGate

What the company appears to be: CommitGate is a proof-of-concept project that implements a governance mechanism for agent-based systems. The author states it enforces an invariant: "The action that executes must be the exact action that was evaluated and authorised." It sits between structured proposals and consequence-producing adapters, binding approvals to canonical SHA-256 digests of proposals.

What changed: This is a self-reported project built during a hackathon. The author describes extending an existing AgentGate FastAPI baseline with new logic for enforcing proposal identity, approval binding, single-use tokens, and pre-execution validation.

Single most important open question: Is there any evidence that this concept has been applied in production or tested beyond the described proof-of-concept?

The description states that CommitGate is a system designed to enforce one invariant: "The action that executes must be the exact action that was evaluated and authorised." It operates between an agent’s structured proposal and a consequence-producing adapter.

It computes a canonical SHA-256 digest of the complete proposal, binds policy decisions or human approvals to that digest, issues five-minute, single-use execution authority scoped to the exact request, decision, action, policy, tenant, and approving authority, recomputes and validates every binding immediately before execution, and refuses drift, invalid scope, expired authority, consumed tokens, and conflicting duplicate attempts.

It produces a terminal receipt binding the proposal, decision, policy, authority, token, adapter, status, and reported result. The demonstration uses a mock customer-refund workflow.

Evidence: The project description states these features, but no evidence of actual implementation or usage beyond the described proof-of-concept exists.

The author claims CommitGate enforces one invariant: "The action that executes must be the exact action that was evaluated and authorised." This is presented as a solution to a failure mode where an agent can receive the right approval but still execute the wrong action if the proposal changes before execution.

The project evolved from an existing AgentGate FastAPI baseline, with new logic added during Build Week. The author notes that GPT-5.6 was used for adversarial reasoning and architecture design, while Codex was used for implementation and testing.

Evidence: The description states these claims, but no external validation or prior versions are provided.

Not evidenced. The description does not identify a specific customer base or ideal customer profile (ICP). It describes the system's function in abstract terms without specifying who would use it or how they would interact with it.

Not evidenced. There is no mention of pricing, revenue models, monetization strategies, or any business model elements in the provided description.

The project was built using Python, FastAPI, Pydantic, pytest, standard-library canonical JSON and SHA-256, and an in-memory repository. It uses GitHub for development and includes adversarial tests proving refusal before adapter invocation.

The implementation preserves existing endpoint paths, request bodies, decision outcomes, precedence rules, tenant boundaries, approval semantics, replay isolation, and demo scenarios from the baseline AgentGate.

Evidence: The description states these technical details, but no evidence of deployment, scalability, or operational delivery beyond the proof-of-concept is provided.

Not evidenced. There is no mention of customers, revenue, usage metrics, product adoption, or any signs of traction or maturity beyond the described hackathon project.

Not evidenced. The description does not reference competitors, market positioning, or competitive landscape.

• Proof-of-concept only: The system is described as an in-memory, single-process proof with no durable storage, distributed delivery, or real external adapters.
• No production evidence: There is no indication that the concept has been applied beyond a hackathon project.
• Limited scope: The deepest implemented workflow is customer refunds; no broader application is described.
• Development placeholders: Authentication uses development placeholders, and policies are static code.
• No external validation: The system has not been independently verified or tested in real-world conditions.

Inference: These limitations suggest that the project is not yet ready for commercial deployment or adoption.

1. What specific use cases beyond customer refunds are you planning to support?
2. How do you plan to address the current limitations such as in-memory storage and lack of distributed delivery?
3. Have you tested this system with real-world data or external adapters?
4. What is your roadmap for moving from a proof-of-concept to a production-ready solution?
5. Are there any existing customers or partners interested in piloting this technology?