Prove What Your AI Agents
Actually Did
KNIRVCLI supervises Claude, Codex, Hermes, and OpenCode as they work on your machine — enforcing policy in real time, recording every permission decision as evidence, and committing a signed, verifiable proof of the session to KNIRVSERVER.
The supervision layer between you
and every AI agent you run
Eight capabilities that turn an unaccountable AI coding session into a governed, evidence-backed, verifiable one.
DVE Evidence Supervision
Every supervised command, file, network, and credential decision is bound to policy, identity, time, and input/output hashes in an append-only, hash-chained event log.
- Local supervised sessions per workspace
- Visible session binding in the shell header
- Workspace-local BuntDB stores, never OS app-data
Native Proof Commits
knirv git commit is the only sanctioned way to turn supervised work into a git commit — Git commits first, then the proof binds the exact resulting commit object.
- Durable, resumable transactions under .knirv/
- Finality-gated push blocks uncertified commits
- Encrypted (XChaCha20-Poly1305), Ed25519-signed
Anti-Fabrication & Redaction
Artifacts referencing prior decisions are validated against existing session evidence at submission — fabricated references are rejected, not silently dropped.
- Fail-closed secret scanning (AWS keys, JWTs, PATs)
- Pattern matching + entropy scoring
- Unredactable secrets abort the commit entirely
Supervisor Agent Loop
A data-driven phase graph drives coding-agent sessions through plan, review, development, and commit — advanced only by evidence, never agent self-report.
- Per-phase agent fallback chains with backoff
- Idle/stall watchdog with recovery circuit breaker
- Checkpoint & resume across SIGINT/SIGTERM
Multi-Agent Supervision
Supervises third-party coding agents — Claude, Codex, Hermes, and OpenCode — as they run on your host, intercepting prompts before they reach the tool.
- Static exec deny-list (sudo, docker, git push, …)
- Inline approval overlay for confirmation prompts
- Per-agent adapters, bounded retries
Portable DVE Pods
knirv git commit deterministically packs a signed WASM pod per commit, binding its hash to the durable proof transaction — no per-DVE agent copy.
- Embedded Chroma-style event database
- TEE attestation with P-256 self-attestation
- Export as a self-contained HTML bundle
Neon Shell TUI
A three-panel multiplexed terminal — command REPL, a real PTY pane, and the supervisor — with inline bitmap rendering for sub-agent output.
- Golden rule: no prompt bypasses the supervisor
- Kitty/WezTerm/Ghostty inline graphics support
- Copy mode toggle for native text selection
Line-Level Attribution
knirv blame and knirv why join git blame --line-porcelain to KNIRV-Project/KNIRV-Session trailers for per-line agent, model, and session tagging.
- Live proof certification status per line
- Enriched attribution on authenticated repos
- No fabricated trailers — Git-native, verifiable
Seven phases. Never agent self-report.
A declarative phase graph advances only on submitted evidence — plans, artifacts, and reviews — with per-phase agent fallback chains and bounded retries.
Built for anyone who runs an AI agent and needs to trust it
Teams Adopting AI Coding Agents
Supervise Claude, Codex, and other agents working on your codebase with a real-time policy layer and a permanent record of every decision made.
Regulated & Audited Environments
Produce cryptographically signed, server-verifiable evidence bundles proving what an agent did, what it was denied, and why — ready for compliance review.
Multi-Agent Engineering Workflows
Run Claude, Codex, Hermes, and OpenCode under one supervisor with a shared phase graph, fallback chains, and a single evidence trail across all of them.
Individual Developers
Get git-native proof of what you built, line-level attribution for agent-assisted work, and a signed commit trail without changing how you use git.
The golden rule:
no prompt bypasses the supervisor.
Every confirmation prompt from a supervised agent is intercepted and enforced by the Bubble Tea Update loop before it ever reaches you or an auto-confirm flag. A static exec deny-list blocks dangerous commands locally, before the network policy call even fires.
- Inline approval overlay pauses the PTY feed on confirmation prompts
- Static deny-list blocks sudo, su, docker, git commit/push before policy eval
- Fabricated artifact/decision references are rejected at submission time
- Idle/stall watchdog with a recovery-cycle circuit breaker
Every agent session.
Supervised. Signed. Provable.
Install KNIRVCLI in one command, or grab a pre-built binary for your platform. Either way, your first supervised session and signed evidence bundle are minutes away.
- Detects OS/architecture automatically
- Installs the matching native binary
- Exposes knirv globally via npm
- Pre-built binaries for every platform
- Works with KNIRVSERVER cloud or self-hosted
- Build from source with go build
Need the sovereign backend? KNIRVCLI talks to KNIRVSERVER — self-hosted or managed cloud. Questions? Read the documentation or contact us.