How it works

1. Normalise. The pending tool call (Bash, Write, Edit, Read, MCP) becomes one canonical action with a SHA-256.
2. Parse. The command is tokenised like a POSIX shell, split at ; && || | &, here-document bodies are separated from the command, braces are expanded for destructive commands, and wrappers (sudo env nohup timeout xargs) are unwrapped.
3. Look inside. $(...), backticks, sh -c, eval, interpreter one-liners (python -c, node -e, perl -e...) and commands embedded in other programs' options are checked as commands themselves, up to 4 levels deep. Deeper nesting is asked about, never allowed silently.
4. Check. Hundreds of rules: deletes of root, home or system folders, disk writes, secret reads combined with the network, download-and-run, reverse shells, persistence (cron, shell start-up files, systemd, sudoers), cloud and database destruction, git history rewrites, the agent editing its own permission settings, and more.
5. Fail closed. A program CODEGUARD does not know, a command it cannot parse, or SQL it does not recognise is asked about, never allowed.
6. Decide. Any CRITICAL finding: DENY. Any HIGH: REQUIRE_APPROVAL (a person decides). Otherwise ALLOW.
7. Sign. Each answer carries an Ed25519 receipt over the action hash, the findings hash and the decision.

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.