v5.16.0 - ASI Strict Mode (opt-in)

ASI Strict Mode (opt-in)

ASI_STRICT_MODE adds controls for highly capable agents. Off by default: with it unset, every code path is unchanged (one boolean check).

Setting	Behaviour
unset / false	Off
audit	Every check runs and reports would-deny without blocking
enforce (or any unrecognized value - fails closed)	Violations are blocked

The setting is read once and frozen; at runtime it can only be tightened (tightenAsiConfig).

Controls

• Proof-carrying actions - ProofGate requires proofs bound to the exact tool, canonical arguments, agent, single-use nonce and expiry. Bring-your-own verifiers (zkVM, formal verification); built-in short-lived HMAC/Ed25519 capability tokens (CapabilityIssuer); optional out-of-process co-signer. Wired into AgentRuntime.exec/writeFile and MCP tools marked requires_formal_proof.
• BFT consensus - ConsensusEngine (geometric median, CP-WBFT, 3f+1 quorum, model-family diversity, signed ballots) gates high-stakes GovernedModelGateway turns.
• Auditor receipts - low-trust LockedBlackboard commits need a signed receipt from a designated auditor, bound to the exact change and value.
• Kill switch - HaltCoordinator: shutdown token in the input stream (redacted before any model sees it), OS signal, or authenticated HTTP call halts all registered components; latches until a separate resume key.
• Trust-tiered context and cognitive caps - per-tier context budgets/scopes and effort, thinking, output and sub-agent depth limits.
• Canaries and tamper-evident export - CanaryRegistry, HashChainSink + verifyEventChain.
• In enforce mode AgentRuntime forces sourceProtection and withholds secret-like env vars from child processes.

Limits: strict mode raises the cost of misbehaviour; it is not a containment boundary against an agent that can run arbitrary code on the host. Pair it with OS isolation and an external authority.

Tests

New test-asi.ts (147 checks). Full suite: 3,888 tests across 42 suites; tsc --noEmit clean.

See CHANGELOG.