Heat Agent Router

What the company appears to be: Heat Agent Router is a governance layer for AI coding agents that controls task routing, enforces policy, stops unsafe execution, and produces cryptographic proof of boundaries. The author describes it as a system that sits between agents and models, classifying work by capability and risk, selecting reviewed model routes, enforcing limits, validating responses, and recording durable audit events.

What changed: The project evolved from the author's realization that current LLM optimization focuses on single-shot correctness rather than shifting enforcement into cheaper, more deterministic layers. It emerged as a response to issues like poisoned context, debug doom loops, cost management, and lack of verifiable safeguards in AI agent usage.

Single most important open question: Does Heat Agent Router actually function as described, or is it a conceptual framework that has not yet been implemented in a working system? The description states the author built it using Codex but provides no evidence of actual deployment, testing, or operational capability beyond a demo.

The description states that Heat Agent Router:

• Is a governance layer that sits between agents and models
• Decides what is allowed before work begins
• Validates what comes back
• Records evidence that can later be verified
• Classifies work by capability and risk
• Selects reviewed model routes across providers
• Enforces context, cost, retry, tool, and capability limits
• Sends bounded prompt packets instead of uncontrolled conversation history
• Validates responses against explicit contracts
• Stops or escalates malformed, unsafe, or unsupported outcomes
• Records durable audit events, routing decisions, costs, and outcomes

The author describes it as not being another coding agent but rather a system that gives agents meaningful freedom inside explicit boundaries. It is presented as a way to guard against poisoned LLM context, debug doom loops, runaway subagent sprawl, cost issues, and repeated failures without learning.

The description states that Heat Agent Router:

• Is positioned as a governance layer rather than another coding agent
• Aims to shift correctness and enforcement into cheaper, faster, more deterministic layers (like compilers)
• Addresses problems with optimizing for single-shot correctness in LLMs
• Focuses on "stronger assurances and safeguards at lower quota spend"
• Claims to provide "cryptographic proof that its boundaries held"
• Positions itself as a system that "gives them meaningful freedom inside explicit boundaries instead of unlimited authority"

The author's claim evolution shows a shift from seeing AI governance as primarily about model selection to recognizing that the harder problem is deciding when an agent should act, how much authority it should receive, and how to verify those decisions later.

The description states:

• Heat Agent Router helps individual developers govern AI agents
• The next step is expanding into a "team control plane"
• It targets users who want richer organizational policy, additional runtime integrations, shared audit views, stronger capability brokers, and outcome-driven model rankings

The author describes the current target as individual developers but indicates expansion toward team-level use cases. No specific customer segments or personas are named beyond these general categories.

Not evidenced. The description does not contain any information about pricing models, revenue streams, monetization strategies, or business model details.

The description states:

• Built with Python runtime for providers, credentials, tools, and durable storage
• Uses SvelteKit interface that presents validated evidence rather than raw logs
• Implements "OpenAI as the reviewed default execution path, with explicit local-model opt-in"
• Has policy-selected GPT-5.6 routes with bounded prompt packets and response contracts
• Includes Intervention Proof showing exactly which boundary fired
• Features Sealed Execution Proof with signed receipts, offline verification, browser-local witness challenges
• Uses a deterministic judge path that reproduces the proof without requiring private credentials
• Built using Codex as an engineering collaborator throughout Build Week

The author describes technical architecture including explicit terminal events, hash-bound run stores, signed receipts, complete boundary coverage, and verification rules that reject incomplete evidence.

Not evidenced. The description contains no information about revenue, customers, user adoption, market traction, or product maturity beyond the author's own account of building it for a hackathon.

Not evidenced. The description does not contain any information about competitors, competitive positioning, or market context beyond what the author describes about their own approach.

• Unverified claims: The entire description is self-reported and unverified; no independent evidence of functionality
• Demo vs. reality gap: The author states "Don't trust the demo. Verify it" suggesting the demo may not demonstrate actual working capabilities
• Limited scope: Only one team member (the author) is mentioned, raising questions about scalability and development capacity
• Unproven architecture: The description mentions "explicit terminal events," "hash-bound run stores," and "signed receipts" but provides no evidence these are actually implemented or functional
• Hackathon origin: Built for a hackathon suggests early-stage development with unknown production readiness
• No validation: The author claims to have built it using Codex but provides no evidence of actual testing, deployment, or operational capability beyond the demo

1. What specific technical implementation details support the claims about "explicit terminal events" and "hash-bound run stores"?
2. Can you demonstrate actual functioning of the system rather than just a demo?
3. How does the system handle edge cases or failure modes that weren't covered in the demo?
4. What are the actual performance characteristics and limitations of the bounded prompt packets?
5. How does the cryptographic proof actually work in practice, not just in theory?
6. What specific security vulnerabilities or threats is this system designed to prevent?
7. How would you handle situations where the system itself fails or becomes unavailable?
8. What validation has been done on the actual effectiveness of these governance mechanisms?
9. How do you plan to scale from individual developer use to team-level control planes?
10. What specific metrics or evidence demonstrate that this approach is better than existing alternatives?