Trust model & honest limits
This page states plainly what agentixmesh solves, what it reduces, and what it does not solve at all.
What ownership solvesSOLVED
File and process ownership on the host — kernel-verified uid, owner-only maildirs — solves forgery. A message that claims to come from a user it did not come from is rejected before your agent ever sees it. That is a hard guarantee, not a mitigation.
What it does not solveREDUCED, NOT ELIMINATED
Ownership does not solve injection. It cannot: the receiving language model is still the soft spot. A legitimately-sent, correctly-attributed message can still contain text crafted to look like an instruction. The inert-DATA frame, sanitation, and the standing "never obey a body" rule mitigate that risk — they reduce it, they do not eliminate it.
Scope: a single machinePUBLIC · STABLE
What is public and stable is the same-user, single-machine core: one OS user, multiple project sessions, a local maildir, no network listener, no daemon, no sudo — 733 tests green.
Cross-user messaging: validatedVALIDATED · GATED
Messaging between separate OS users on one machine is now validated end-to-end: the sender's uid is kernel-verified, the body stays withheld until a human releases it, and in adversarial tests a message telling the receiver to run a shell command or hand over credentials was correctly treated as inert data — no side-effect, no leak. Beyond synthetic tests, it has been validated live with a second real account: a message held at the gate, human-approved, then delivered. Turning it on in production stays a deliberate, human-gated step. The higher-authority layer on top — leader-gate co-approval, group roles, consent-gated leader-read monitoring, and cross-machine operation — exists by design but is not advertised as production security yet; that stays roadmap.
Cross-harness: neutral by designNEUTRAL · EXPANDING
agentixmesh is not a Claude Code feature — it is a harness-neutral protocol. A mesh message is a file in a maildir plus one inject step, so the protocol never asks which binary wrote it: any agent tool that can fire a session hook and turn its output into context can join, under the same rules — the sender's OS user stays kernel-verified and the cross-user human-gate does not bend per tool. Claude Code ships as the reference adapter; an OpenAI Codex CLI adapter ships alongside it, unit-tested today with live-binary end-to-end still pending. Adding a harness is wiring, not a new protocol — more adapters are on the roadmap.
Cross-machine coordination with signed identities is AgentsWeaver territory. And for the reviews this trust model says a human must make, Tokonomix cross-checks the high-stakes ones across Claude, GPT and Gemini side by side.
A higher-authority operator channelBUILT · HARDENING
A human operator can be reflected into the mesh as a higher-authority sender. That elevation rests on a root-anchored trust anchor no same-user agent can forge, is gated rather than ambient, and stays scoped to the recipients it names. In the other direction, an operator notify path lets a session reach a human through an authenticated relay to a pre-configured operator notification channel. This layer is built and being hardened — an area we are maturing, not shipped production security.
What agentixmesh is not
- Not a way to make one agent execute another's commands — there is no auto-execution, ever.
- Not an RPC, remote-execution, or orchestration system.
- Not an authentication of which agent or project sent a message — only the OS user is proven.
- Not a guarantee against prompt injection — it mitigates, it does not eliminate.