<hero nonce=ac586618 sha256=50482245…>sealedThe models are excellent. The harnesses are not — they leak context, over-trust tool output, and ship nothing you didn’t hack into a skills.mdyourself. Signet builds those things in: sealed delimiters, a security classifier, fail-closed posture gates, a prompt library, a repo map, and role/mode determinism. Free and open, Apache-2.0.
<sealed nonce=56207b00 sha256=9f59c686…>sealedEvery block of context carries a random nonce and a SHA-256 integrity hash of its enclosed content. On the way out, any block with a missing nonce, an unknown nonce, or a failing hash is stripped before it reaches transport.
The real claim, stated plainly: a model cannot widen its own advertised tool surface by writing a forged <tools> block. The markup is verified, not trusted.
This page is built out of the same device. Each section is framed as a harness block whose header hash is computed at build time from that section’s own sealed payload. Scroll one into view and its integrity badge runs a verify tick — nothing here is trusted on sight.
<beliefs nonce=a264c816 sha256=afa55bb9…>sealedPress f3 and the guardrail switch throws to off: one gold chip, zero classifier calls. Off means not called-and-ignored, simply not called. Flipping back restores the full fail-closed surface everywhere — session, inline commands, file admission, background agents, the CLI.
Modes are sticky. An explicit choice is never silently re-classified by the next turn, and -detect-mode tells you what the Role Manager would do without acting on it. A plan session stays a plan session.
A fixed-argv native catalogue of ~25 read-only utilities — Cat, Head, Git, JQ, Find, Diff — each backed by a specific binary and a fixed argument shape, never a shell. Instead of a growing Bash(jq *) allowlist, the verbs themselves are tools.
Apache-2.0, zero telemetry, zero logging. Two local providers ship in the box, and the Vulnetix scanners and AI Firewall are free for everyone — not just enterprises.
<labs nonce=6d2be0c9 sha256=0b21f91f…>sealedClaude Code, Codex, Cursor, Gemini CLI. The big labs build excellent models and put them behind harnesses that leak, over-trust tool output, and ship nothing you did not hack into a skills.md yourself. The models are the good part — this page is not a verdict on them.
The table is scoped strictly to feature presence. Every row is a checkable fact, never a quality judgement. Signet’s column traces to a file in this repository; a — means there is no public, checkable source at time of writing.
| feature | signet | claude code | codex | cursor | gemini cli | trace |
|---|---|---|---|---|---|---|
| sealed delimiters (nonce + SHA-256, stripped at egress) | ✓ | ✗ | ✗ | ✗ | ✗ | internal/rolemanager · e2e |
| security classifier on every untrusted tool result | ✓ | ✗ | ✗ | ✗ | ✗ | internal/rolemanager |
| classifier on a separate/local model | ✓ | ✗ | ✗ | ✗ | ✗ | internal/rolemanager · local providers |
| posture gates with provenance | ✓ | ✗ | ✗ | ✗ | ✗ | internal/posture |
| plan mode with Bash absent, not restricted | ✓ | ✗ | ✗ | ✗ | ✗ | internal/tui/view.go · e2e |
| structured persisted plan documents | ✓ | ✓ | — | — | — | internal/plans |
| goal loop stopped by a stall, not a counter | ✓ | ✗ | ✗ | ✗ | ✗ | internal/agent/passloop.go |
| native fixed-argv tool catalogue (~25 utilities) | ✓ | ✗ | ✗ | ✗ | ✗ | internal/tools/catalog.go |
| harness-computed repo map | ✓ | ✓ | — | — | — | internal/repoindex |
| prompt library as files | ✓ | ✗ | ✗ | ✗ | ✗ | internal/prompt |
| credential import | ✓ | ✓ | ✓ | ✓ | ✓ | internal/credentials |
| terminal-escape sanitising | ✓ | ✗ | ✗ | ✗ | ✗ | internal/tools |
| CI-enforced docs | ✓ | — | — | — | — | .github/workflows/ci.yml · docs/ |
<trust nonce=1e32ee20 sha256=1d01acf2…>sealedEvery untrusted result goes through sanitize → classify → decide, fail closed.Bash, WebFetch, WebSearch, Read, and third-party repository text all classify, unconditionally. Shaped results whose shape the harness knows — Grep, Glob, Write, Edit — take a sanitize-only lane and skip the round trip.
Long documents are classified in bounded chunks with overlap, and the verdict is the strictest across all chunks — not the first, not the average.
streaming turn · collapsed Bash preview
<modes nonce=8b5ba125 sha256=acace66e…>sealedPlan mode advertises and enforces a fail-closed surface with Bash absent — not present-but-gated, absent. A model cannot call what is not advertised. A read-onlyBash returns only under an explicit permission allow rule.
The goal loop stops on a stall — no new evidence, no re-plan after an attempt — and reports the stall with the evidence gathered. It does not fire a counter that runs past the answer.
Modes are sticky: an explicit choice is never silently re-classified, and-detect-mode tells you what it would do.
plan review pane
<tools nonce=7bf725a7 sha256=dee76c04…>sealedA fixed-argv native catalogue of read-only utilities — Cat, Head,Git, JQ, Find, Diff and ~19 more. Each is backed by a specific binary and a fixed argument shape passed straight to exec.Command — never through a shell. Arbitrary command strings are rejected.
Cd is confined: the working directory moves inside the session root, and the root does not widen. Path traversal to ../../../etc is blocked, not warned about.
<permissions nonce=74c7b13e sha256=927d0533…>sealedThe effective permission set is a union of policy, session, tool kind and role — with provenance kept per grant, so every effective grant remembers which source added it. An explicit deny still wins; merging never silently widens a surface.
The guardrails switch reaches every surface: agent session, inline !cmd,@file admission, background agents, the CLI. A gated path checks the levelbefore calling the classifier — never after.
approval prompt · diff-in-the-prompt
<agents nonce=c5376b1d sha256=ccef11ce…>sealedThe f8 roster splits a question into concurrent read-only probes — each branch sees only the surface it is allowed to touch, and the orchestrator merges the verdicts. A branch that cannot mutate cannot be talked into mutating.
f8 roster · runs panel
<sessions nonce=80e6c133 sha256=25d92152…>sealed/compact runs against a validated contract, not a vibes-based summary. Sessions auto-name from the work they did, mid-turn steering lands on the running turn, and the exit card always carries the resume command back to the finished session.
exit card · resume command
<providers nonce=dc01b021 sha256=49913f34…>sealedCredentials resolve across five layers — command line, environment, config file, agent profile, built-in defaults — and every resolved value carries its provenance: who set it, where, and when.
Two local providers ship in the box. /local-model assesses a candidate against the classifier probe before you trust it with a session.
/model picker
<vulnetix nonce=b1184335 sha256=570c3393…>sealedThe AI Firewall routes traffic when you opt in, and the status footer reports availability honestly — a quiet probe at startup, not a claim that survives an unreachable gateway./vulnetix review, firewall and status are built in.
The Vulnetix scanners and the AI Firewall are free for everyone, not just enterprises — the baseline platforms eventually copy is already public.
<qol nonce=4de9adda sha256=3a279280…>sealedThe grid of things you used to hack into a skills.md yourself. Each one is a file or a passing test in this repository, not a paste-in afterthought.
/settings · provenance per value
<gaps nonce=d60bc4e8 sha256=4979bcca…>sealedNo MCP. No image attachments yet. Stated plainly, because it is the cheapest credibility on the page and consistent with the product’s posture: fail closed, and say what is not there.
When they land, they land the same way as everything else — behind the classifier, inside the posture gates, and documented in a file with a test.
<install nonce=6a96edcd sha256=f7f7ba82…>sealedSix platforms — linux, darwin and windows, each amd64 and arm64. Every release is built by the same workflow that publishes the Homebrew formula and the Scoop manifest, and the installer verifies the binary against the release checksums before it writes anything.
Homebrew
brew install vulnetix/tap/signetScoop
scoop bucket add vulnetix https://github.com/Vulnetix/scoop-bucket && scoop install signetinstall.sh (checksum-verified)
curl -fsSL https://raw.githubusercontent.com/vulnetix/signet/main/install.sh | shgo install
go install github.com/vulnetix/signet/cmd/signet@latestsource
git clone https://github.com/vulnetix/signet && cd signet && go build ./cmd/signet