Governed autonomy for serious repositoriesGoverned autonomy
arbiterForge builds the governance layer for AI coding agents: hard gates instead of hopeful prompts, durable project context, and an audit trail that survives whichever host you use.
You decide. The gates enforce.
Evidence
This is not a description of enforcement. It is a replay of it. Both transcripts below come from direct invocations of the shipped pre-bash.py hook. Same file, same digest, real exit codes.
$ git push origin main
BLOCKED [H-01]: Pushing to a protected branch ('main') is prohibited
(ORCHESTRATOR §3) — main moves only via a merged PR.
.codearbiter/gate-events.log
[2026-08-03T07:59:05Z] BLOCK [H-01] host=claude hook=pre-bash.py$ git add -A
BLOCKED [H-03]: 'git add -A' / 'git add .' / 'git add --all' / 'git add -u'
are prohibited. Stage files explicitly (commit-gate skill).
.codearbiter/gate-events.log
[2026-07-30T13:34:06Z] BLOCK [H-03] host=claude hook=pre-bash.pyEvery guarantee is backed by something you can read. The hook is local-only Python stdlib, and both captures are pinned to the exact source revision below. Hash the pinned file yourself and compare.
The threat model, plainly: hooks block at the tool-call boundary, so an agent cannot argue past them. A human with shell access can remove them, deliberately, and that removal lands in the append-only audit trail.
The system
arbiterForge exists so autonomous coding can be trusted at the moment it matters: the commit. codeArbiter carries the gates to today’s agents as a repository-owned plugin. arbiterIDE comes next and moves the same gates into the editor’s tool-dispatch layer, designed so that not even a hostile client can talk past them. One policy core. One portable, auditable record.
Multi-host governance plugin for Claude Code and Codex CLI, with Pi in preview. One policy core, expressed as 40 commands, 23 skills, and 28 agents.
Five hard refusals
Nine phases. The only path to a commit.
Tests, lint, secrets, behavioral proof, diff review. Nothing reaches version control on “looks good.”
A reviewer fleet matched to the change, an 11-lens tribunal when it matters, and user-attributed architecture decision records. Overrides and auto-decisions all land in a durable audit trail.
Enforcement is local-only Python stdlib: instant, free, no model calls. Reviews spend tokens only when you invoke them. Checked-in .codearbiter/ state survives switching hosts.
Intent in. Gate-verified PR out. The same gates, moved into the editor’s tool-dispatch layer. Built on Eclipse Theia.
arbiteride.com ↗Install
/plugin marketplace add arbiterForge/codeArbiter
/plugin install ca@codearbiter
$ codex plugin marketplace add arbiterForge/codeArbiterWhat it writes
Hook scripts (Python stdlib, local-only) and a .codearbiter/ directory in your repo. Dormant until a repo opts in. No network calls, no telemetry.
License
AGPLv3 covers codeArbiter itself, never your code. Commercial licensing available.
How we work
You decide. The gates enforce.
Ask for the outcome. Keep the proof. The record outlives the session, the branch, and the host that produced it.
Read the essay: Why hard gates →