Gavel.
How it works

How a decision flows through Gavel.

An agent decides, Gavel records it, and the owner confirms or reverses it later. Nothing waits, and nothing is lost.

An agent decision

Four steps from "I decided" to "the owner confirmed."

  1. The agent records it

    Through Gavel's MCP tools, an agent logs a decision with a title, a summary, its rationale, how to undo it, its scope (program, lane, repositories), and evidence links.

  2. Gavel checks and stores it

    Fields are validated and redacted for secrets. The decision becomes revision 1, and a hash-chained event is written beside it.

  3. It waits in Review

    An agent decision is marked unreviewed and appears on the Review page, within a review window of seven days by default.

  4. The owner rules on it

    He confirms it, or reverses it with a reason. Either one is a new revision; the original is never edited.

Gavel's Review page: agent decisions awaiting the owner's confirmation, each with its lane, program, and a View record link.Gavel's Review page: agent decisions awaiting the owner's confirmation, each with its lane, program, and a View record link.
Review: agent decisions waiting for the owner to confirm or reverse them.
Gavel's Log page: a searchable list of every record with filters for kind, status, gate, program, lane, machine, and outcome.Gavel's Log page: a searchable list of every record with filters for kind, status, gate, program, lane, machine, and outcome.
Log: every record, searchable and filterable.
What gets recorded

Four kinds of record, five levels of assurance.

Every record says what it is and how much weight it carries, so a reader can tell an agent's call from an owner's order at a glance.

Record kinds
KindWhat it is
DecisionSomething an agent decided under "decide, don't wait," or an owner decision.
AskA question only the owner can answer, with options and a recommendation.
DirectiveAn owner order that applies from now on.
WaiverA one-time exception, with a scope and an expiry.
Assurance levels
AssuranceMeaning
DirectThe owner decided on the web or with a tap.
RelayedAn agent recorded his answer from a session, with his verbatim words.
AgentAn agent decided on its own authority.
DefaultAn ask closed on its recommendation when time ran out.
ImportedBrought in from an older source, with its provenance attached.
Changing your mind

Nothing is edited. Everything is revised.

A record is never changed in place and never deleted through the API. A reversal, a correction, or a replacement is a new revision with its own event, and the chain of events is hash-linked so a gap or an edit shows.

A decision the owner reversed: the history lists the original agent decision and his reversal with the reason, and the page shows the undo guidance.A decision the owner reversed: the history lists the original agent decision and his reversal with the reason, and the page shows the undo guidance.
A reversal: the original decision stays, and the owner's reason is on the record.
A decision marked superseded, with its history showing the successor that replaced it and the reason for the replacement.A decision marked superseded, with its history showing the successor that replaced it and the reason for the replacement.
Supersession: the old decision points at the one that replaced it.
Staying trustworthy

The rules Gavel enforces.

Only the owner decides asks

Agents record their own decisions and request his. An agent can relay his answer, but only with his verbatim words, the session, and the time, and the record says it was relayed.

Held asks never default

A gated action stays open until the owner answers. It never closes on its own recommendation.

Secrets never get in

Record fields pass through a redactor before they are stored, and context excerpts are redacted again on the way in.