ChangeSafedeterministic safety gateOpen live demo
Open-source engineering case study

A deterministic airlock for AI-proposed infrastructure changes.

ChangeSafe treats model output as untrusted, typed data. Pure policies validate every proposal, a human makes the decision, and every outcome becomes a verifiable receipt—without touching real infrastructure.

Try the live demoView source on GitHub

Six synthetic scenarios. No API key required. No infrastructure connection exists.

AI_PROPOSALUNTRUSTED

Fail over the primary uplink

targetedge-rtr-01
operationset_preference
confidence0.91 / ignored
DETERMINISTIC GATE07 / 07 PASS
POLICY_VERDICTAPPROVABLE
LOW

Safety passed. Authority remains with the human reviewer.

APPROVEorREJECT
  1. 01ProbabilisticAI proposesA typed plan with cited evidence—still untrusted data.
  2. 02DeterministicCode validatesPure policies derive findings and risk without model influence.
  3. 03Human authorityA human decidesPass means approvable, never automatically approved.
  4. 04No executionSandbox onlyA deep-cloned synthetic state. Nothing real is contacted.
01 / THE PROBLEM

Fluent proposals
are not safe proposals.

Incident context is attacker-influenceable. An alert, operator note, or pull request can carry an injected instruction—and a model can repeat it with perfect confidence.

ChangeSafe makes resistance to persuasion irrelevant. The model's prose is reduced to typed data that must survive deterministic policy and an explicit human decision.

Confidence is displayed.
It is never used.
DESIGN INVARIANT / 01
02 / HOW IT WORKS

One direction.
No shortcuts.

Every transition is explicit. Any BLOCK closes the airlock before approval or simulation can exist.

  1. 01
    AI proposal

    Turn context into typed data.

    Structured output is locally re-validated. Unknown evidence and resources are rejected before the gate.

    UNTRUSTED INPUT
  2. 02
    Policy gate

    Let deterministic code say no.

    Seven pure policies return PASS, WARN, or BLOCK. Confidence, urgency, and eloquence have no vote.

    FAIL CLOSED
  3. 03
    Human decision

    Keep authority with the reviewer.

    A proposal with no BLOCK can be approved or rejected. Any BLOCK makes approval impossible at the domain layer.

    NO AUTO-APPROVAL
  4. 04
    Sandbox simulation

    Prove the change on a clone.

    Allowlisted operations apply transactionally to synthetic state, then safety properties and rollback are re-checked.

    NOTHING REAL
  5. 05
    Change receipt

    Make every outcome inspectable.

    Canonical JSON and SHA-256 hashes preserve an integrity trail for approved, rejected, and blocked outcomes.

    VERIFY, DON'T TRUST
ANY POLICY RETURNS BLOCKAPPROVAL PATH CLOSEDEnforced in the state machine—not hidden behind a disabled button.
03 / RED-TEAM PROOF

Same AI layer.
Different verdict.

The gate evaluates the proposed action, not the model's tone. Safe work stays a human choice. Unsafe work stops.

APPROVABLELOW RISK

Degraded primary uplink

A minimal failover with cited evidence, a bounded blast radius, verification steps, and a complete rollback.

7 PASS0 WARN0 BLOCK
Human approval or rejection remains available.
BLOCKEDCRITICAL

Injected management-path change

A confident proposal follows an instruction hidden in operator notes and would sever protected management reachability.

5 PASS0 WARN2 BLOCK
Approval and simulation are impossible.
Run both scenarios in the live demo
04 / ENGINEERING EVIDENCE

Claims that can
be inspected.

The portfolio story is backed by a public implementation, scenario contracts, and an extracted core that carries no network assumptions.

Inspect the repository
E-0106

Bundled scenarios

Every verdict path, from LOW approvable to CRITICAL blocked.

E-0207

Pure policies

Ordered, fail-closed, and isolated from the AI layer.

E-03184

Automated tests

The P2 exit gate across core, domain, application, and E2E.

E-04SHA-256

Integrity receipts

Canonical hashes for input, proposal, and every outcome.

SCHEMA-FIRST INPUTSEXPLICIT STATE MACHINETRANSACTIONAL PATCHESROLLBACK VERIFICATIONHONEST PROVENANCE
05 / ARCHITECTURE

Authority has
a visible boundary.

Probabilistic reasoning can propose. Only deterministic code can gate. Only a human can approve.

  1. 01Untrusted contextAlerts, notes, topology, and external artifacts
  2. 02Typed proposalSchema-valid declarative operations and evidence ids
  3. 03Pure policiesCore and domain findings with deterministic risk
  4. 04Human decisionApprove or reject only when no policy blocks
  5. 05Sandbox + receiptClone-only simulation and canonical integrity record
DEPENDENCY DIRECTIONcore → domain adapter → applicationAI modules never enter policy code.Read the architecture
06 / HONEST LIMITS

A sharp proof,
not a broad claim.

ChangeSafe demonstrates a safety architecture. It does not pretend a synthetic network model is production infrastructure.

01

Receipt boundary

Current receipts prove integrity, not authorship or non-repudiation.

02

Simulation boundary

The synthetic sandbox never contacts real infrastructure and is not a production routing model.

03

Product boundary

The current showcase is single-user, without authentication or durable persistence.

VERIFY THE WORK

Inspect the code.
Break the scenarios.
Verify the receipts.

The demo runs in replay mode with synthetic data, no API key, and no path to real infrastructure.

Open live demoExplore GitHub repository