PACT Agent — Permission, Action, Cost, Trust
PACT Agent is a local command-line coding agent built around trust rather than autonomy. Before taking any action it states a permission contract, executes inside a sandbox, writes every effect to a journal, and runs an independent verifier that can refuse the result. Built by Suman Debnath.
Permission · Action · Cost · Trust
A local coding agent that shows you a permission contract before it touches anything, executes only what you approve in a sandbox, journals every effect, then runs an independent verifier that is allowed to say no.
Get running in 30 seconds
$ git clone https://github.com/Sumandebnath943/pact-agent$ cd pact-agent && pipx install .$ pact init$ pact run "create hello.txt with a greeting"- Sandbox
- D:\project\agent
- Planner
- openrouter / anthropic/claude-haiku-4-5
- Escalates to
- openrouter / anthropic/claude-sonnet-4-6
- Verifier
- openrouter / anthropic/claude-haiku-4-5
- Budget
- $0.0000 today / $2.0000 daily
Interactive session. Type a task, or /help for commands. Ctrl+D to exit.
pact>
// the stance
Most AI agents are optimistic narrators — they declare success whether or not it happened.
PACT is built on the opposite stance: earned trust, not assumed trust. Nothing runs without an explicit, itemized contract you approve. A separate model re-checks the result against recorded evidence — and is designed to push back when reality diverges.
why it’s different
No silent edits
Every action is approved per-step before it runs — y / n / a.
A verifier that can say no
Judges the actual evidence, not the plan's optimism.
Honest cost
Unknown cost shows as unknown — never a misleading $0.00.
Local & private
Runs on your machine; keys read from your environment only.
The core loop
Every task — typed at the prompt or passed to pact run — flows through one engine. There is exactly one implementation; both entry points share it.
PLAN
planner model
CONTRACT
permission table
APPROVE
y · n · a
EXECUTE
sandboxed only
JOURNAL
before / after
VERIFY
independent verdict
plan
Concrete file / shell actions to perform.
answer
A pure question — no filesystem change, skips the contract entirely.
read
Needs the actual file contents first, then re-plans (reads stay in the sandbox).
delegate
Splits into independent subagents, each run through the full pipeline.
Mode exclusivity is enforced in PACT’s own code — never by trusting the model’s self-declared mode. An "answer" carrying hidden steps is rejected, so an unapproved action can never slip through.
The contract & the verdict
Using 3 memory entries (view with /memory)
Planned by anthropic/claude-haiku-4-5
Estimated model cost: $0.0008
Approve file_write on hello.txt? [y/n/a] (n):
Confidence: 95%
Evidence
hello.txt after-content is exactly "hello world"; exit_code 0. Matched the requested end state.
The verifier receives only the recorded journal evidence — file before/after snapshots, command output, exit codes — and returns a verdict with a confidence percentage. It is intentionally single-model and untiered: you don’t cheapen the check that catches the planner’s mistakes.
The real interface
The actual REPL masthead — block-glyph wordmark, wax-seal emblem, two-column info block, live status, and the eight registered actions across the file, shell, and browser families.
Built on trust
Permission first
Every action is itemized in a permission contract. You approve y / n / a — nothing runs without your consent.
Sandboxed execution
All operations resolve inside your project sandbox. Paths stay in bounds; the shell can't reach the network.
Complete journal
Every change is recorded with before / after snapshots, output, and exit codes — which also powers undo.
Independent verification
A separate verifier model checks the actual evidence and can return CONFIRMED, CONTRADICTED, or INCONCLUSIVE.
Transparent cost
Real-time token and cost tracking. Unpriced models surface as "unrecorded" — never a misleading $0.00.
Local & private
Runs on your machine, in your project. API keys come from your environment only — never stored, never committed.
What it can do
Shell runs as an argv array only — never a raw shell string. Network-capable programs and URL-bearing arguments are blocked. Browser navigation needs a host you’ve explicitly allow-listed; sensitive actions always re-prompt.
Dangerous patterns (rm -rf, sudo, chmod 777, curl | bash) escalate to HIGH risk.
The Governor
A daily USD budget cap, enforced before each call, with live price refresh from OpenRouter.
Cost-aware routing
Cheap planner first; escalates to a stronger model only on a real signal — and always discloses the switch.
Project memory
Durable facts and conventions in local SQLite, injected into the planner — pinnable to always apply.
Scope-locked skills
Save an approved task as a skill. Re-runs re-plan and must match the approved scope, or fail closed — zero actions.
Delegation
A task fans out into independent subagents (bounded concurrency); subagents can't further delegate.
Undo + doctor
Reverse any journaled file action from its snapshot. A doctor command health-checks the install.
Optional surfaces: voice input (transcribe an audio file into a task), desktop notifications on unattended skill outcomes, and a copy-pasteable scheduling command — PACT runs no daemon of its own.
Use it
Clone & install
Grab the repo and install the pact command with pipx.
git clone …/pact-agent · pipx install .
Initialize
Set up .pact/ inside the project you want PACT to work in.
cd your-project · pact init
Run a task
Describe a task; approve the contract; read the verdict.
pact run "…"
Bring your own model
Point any role at OpenRouter or a local Ollama endpoint.
cp .env.example .env
# .env is git-ignored and never committed$ cp .env.example .env# then set OPENROUTER_API_KEY=… (or point any role at a local OpenAI-compatible endpoint)CLI commands
- pactenter the interactive REPL
- pact run "<task>"one-shot: plan → contract → verify
- pact undo <id>reverse a journaled file action
- pact log [--last N]recent journal entries
- pact skill …save / run / compose / export skills
- pact memory …list / forget / pin project memory
- pact budget [set]view or set the daily cap
- pact status · digestactivity + review flags
- pact doctorinstall / config health check
In-session slash commands
- /delegate <task>split into independent subagents
- /voice <path>transcribe audio into a task
- /remember <fact>record a durable fact
- /memoryshow / pin project memory
- /skilllist / save / run / schedule skills
- /status · /logrecent activity & journal
- /undo <id>reverse a file action
- /budget · /configspend vs. cap · current config
- /help · /exithelp · leave (also Ctrl+D)
Optional extras: pact-cli[voice] (Whisper transcription), pact-cli[notifications] (Windows toasts), and browser support via Playwright.
open source · House of Namus
Plan it. Contract it. Approve it. Verify it.
Clone the repository, install with pipx, and run your first contracted task in under a minute. Bring your own model — OpenRouter or a fully local endpoint.
github.com/Sumandebnath943/pact-agent↗
v0.1.0 · pact-cli · MIT · Built by House of Namus
