One action. One gate. One immutable record.
BondFoundry is a control plane around a Claude-backed agent. Every action flows through the same pure-function gate and lands in the same append-only, hash-chained audit log.
Every governed action takes the same path.
┌─────────────────────────────────────────────┐
│ Claude-backed agent loop (MCP tool calls) │
└───────────────────────┬─────────────────────┘
│ Action(action, context)
▼
┌─────────────────────────────────────────────┐
│ Policy gate — decide() : pure function │
│ tier T0/T1/T2/T3 · verbatim citation │
└───────┬──────────────────────────┬──────────┘
│ allow / T1 │ T2 / T3
▼ ▼
┌───────────────┐ ┌────────────────────┐
│ Tool executes │ │ HITL envelope │
│ (FIX, pricing)│◀───────│ HMAC-signed, scoped │
└───────┬───────┘ ok └─────────┬──────────┘
│ │
▼ ▼
┌─────────────────────────────────────────────┐
│ Append-only audit chain (Postgres) │
│ sha256 row chain · framework_ref → AIGF │
└─────────────────────────────────────────────┘The bonds engine is isolated from the control plane — fork BondFoundry for loans or derivatives and the governance surface comes with it.
From proposal to proof, step by step.
- 01
The agent proposes an action
A Claude-backed agent drafts pricing, risk, a scenario, or a trade and calls a typed tool — create_trade, price_bond, ingest_curve. Nothing executes yet; the proposal is just an Action.
- 02
The policy gate decides
decide(action, context) → Decision runs as a pure function: no I/O, no state. It routes the action by reversibility (T0–T3) and returns the verdict plus the verbatim rule text and framework_ref.
- 03
HITL for irreversible value
For T2/T3 the agent must obtain an HMAC-signed approval envelope, scoped to the exact ISIN, notional, and side, before any FIX message leaves the boundary. The agent never sees the signing key.
- 04
The decision is written to the chain
Every decision becomes an append-only audit row — sha256-chained, framework_ref NOT NULL, immutable at the Postgres layer — before any I/O the caller performs.
- 05
Coverage is proven in CI
Every PR runs the four-dimension eval harness and the AIGF coverage report. The build fails below 85% coverage or if any AIGF v2.0 risk has zero passing cases.