The safety layer for AI agents that take real action.
An agent proposes, a human approves, the action runs exactly once, and every step is proven, not just logged.
The goal: the trust layer behind the next generation of agents that audit and run real businesses, starting with revenue recovery on Stripe.
A charge that failed with a soft decline, proposed, approved, retried exactly once, and audited - end to end in the terminal, in seconds. No Stripe account, no network, no signup.
git clone https://github.com/Nabzx/ephor.git
cd ephor/stripe-recovery
uv sync
uv run python -m stripe_recovery.demoThat's the whole loop, deterministic and offline, in under two minutes on a fresh clone. See stripe-recovery/README.md for what it's actually doing.
Want the full dashboard - sign-in, an approval queue, the audit trail, ticket journeys - against the reference app this core was extracted from?
make up && make seed # stack + synthetic data
make demo # approval -> execution, exactly once, in your terminalThen open http://localhost:3000. Everything here is deterministic, offline and simulated too: no paid API, no external network, nothing real is ever contacted.
| Approval detail + decision | Hash-chained audit log |
|---|---|
 |
 |
Letting an AI agent act on its own is fast until it's wrong: a refund it shouldn't have issued, a charge it retried twice, a change nobody can explain afterwards. Ephor puts a checkpoint in front of every consequential action, so nothing happens until a human sees exactly what's about to occur and says yes.
Named after the Spartan magistrates whose job was to check the king's power before it acted,
2,500 years before this project's propose → approve → execute loop existed for the same reason.
- Propose: an agent puts forward one concrete action. It never executes on its own.
- Approve: a human sees a frozen, hashed snapshot of exactly what will happen, and decides.
- Execute: once approved, the action runs through a durable outbox, exactly once, proven by a crash-recovery test and a 50,000-trial randomised chaos sweep (ADR-0015, report), not just claimed.
- Audit: every step writes to an append-only, hash-chained log. Tampering breaks the chain detectably; nothing can be quietly edited or deleted. Self-approval, tampering, replay, and a Critic's advisory-only guarantee are each checked by a named, scored security benchmark (ADR-0019) - including the one honest limitation it found: an Adapter that lies about its own idempotency can't be caught, by design.
Early. The core (ephor/) - audit, the approval gate, the outbox/worker, and the Action/Adapter
primitives - is extracted, tested, and wired for real into the reference app
(ADR-0007,
0009,
0010). stripe-recovery/ is a working flagship: it
scans, proposes, approves, executes and audits a real charge retry end to end, against a fake
Stripe client by default, or a real Stripe test-mode account one environment variable away
(ADR-0013). Two more detectors prove the core
generalises: wallet-guard/ revokes dangerous unlimited token approvals, earning exactly-once
through nonce discipline instead of a payments-provider header
(ADR-0016); cloud-waste/ releases
unassociated Elastic IP addresses and stops idle EC2 instances, earning exactly-once from AWS's
own error and state semantics instead of either
(ADR-0020,
0022) - four genuinely different Adapter shapes, one
core, and a real AWS client behind the same interface as the zero-setup fake one
(ADR-0024). Every detector can also ask an LLM for a second
opinion on a proposal before a human sees
it, always advisory, never a decision
(ADR-0021,
0023) - cloud-waste/ is the one place that opinion
can come from a real, paid model; the other two use the same seam with a free, canned one. The
one deliberate exception to "nothing
here touches a paid API": off by default, a free canned response unless you set your own key.
Issues are tracked with a locked-spec workflow: see AGENTS.md for how a decision gets settled before anyone builds it, and CONTRIBUTING.md for the loop itself.
There's no company behind this, just one person building in public. If it's useful, or the idea resonates, a star is the biggest help there is: it's how someone else finds it.