┌─Trust-first local CLI coding agent─┐

PACT Agent — Permission, Action, Cost, TrustPACT AGENT

Permission · Action · Cost · Trust

A local coding agent that shows you a permission contract before it touches anything, executes only what you approve in a sandbox, journals every effect, then runs an independent verifier that is allowed to say no.

View on GitHub↗See how to use it ↓

Get running in 30 seconds

Quickstart
$ git clone https://github.com/Sumandebnath943/pact-agent
$ cd pact-agent && pipx install .
$ pact init
$ pact run "create hello.txt with a greeting"
pact — interactive session
PACT
Sandbox
D:\project\agent
Planner
openrouter / anthropic/claude-haiku-4-5
Escalates to
openrouter / anthropic/claude-sonnet-4-6
Verifier
openrouter / anthropic/claude-haiku-4-5
Budget
$0.0000 today / $2.0000 daily

Interactive session. Type a task, or /help for commands. Ctrl+D to exit.

pact> 

PACT|time 00:00|cost $0.0000|tokens 0|bgt $2.00|risk —
Permission◆Action◆Cost◆Trust◆Trust-first◆Independent verification◆Honest cost◆Local & private◆Fails closed◆Bring your own model◆Permission◆Action◆Cost◆Trust◆Trust-first◆Independent verification◆Honest cost◆Local & private◆Fails closed◆Bring your own model◆

// the stance

Most AI agents are optimistic narrators — they declare success whether or not it happened.

PACT is built on the opposite stance: earned trust, not assumed trust. Nothing runs without an explicit, itemized contract you approve. A separate model re-checks the result against recorded evidence — and is designed to push back when reality diverges.

why it’s different

  • No silent edits

    Every action is approved per-step before it runs — y / n / a.

  • A verifier that can say no

    Judges the actual evidence, not the plan's optimism.

  • Honest cost

    Unknown cost shows as unknown — never a misleading $0.00.

  • Local & private

    Runs on your machine; keys read from your environment only.

[ 01 ]// one shared pipeline

The core loop

Every task — typed at the prompt or passed to pact run — flows through one engine. There is exactly one implementation; both entry points share it.

01

PLAN

planner model

02

CONTRACT

permission table

03

APPROVE

y · n · a

04

EXECUTE

sandboxed only

05

JOURNAL

before / after

06

VERIFY

independent verdict

plan

Concrete file / shell actions to perform.

answer

A pure question — no filesystem change, skips the contract entirely.

read

Needs the actual file contents first, then re-plans (reads stay in the sandbox).

delegate

Splits into independent subagents, each run through the full pipeline.

Mode exclusivity is enforced in PACT’s own code — never by trusting the model’s self-declared mode. An "answer" carrying hidden steps is rejected, so an unapproved action can never slip through.

[ 02 ]// the two signature panels

The contract & the verdict

Permission Contract — Awaiting Approval
RISK  ACTIONTARGET · RATIONALE
LOWfile_writehello.txt · create hello.txt with greeting
--- hello.txt
+++ hello.txt
+hello world

Using 3 memory entries (view with /memory)

Planned by anthropic/claude-haiku-4-5

Estimated model cost: $0.0008

Approve file_write on hello.txt? [y/n/a] (n):

Independent Verification
CONFIRMED

Confidence: 95%

Evidence

hello.txt after-content is exactly "hello world"; exit_code 0. Matched the requested end state.

CONFIRMEDCONTRADICTEDINCONCLUSIVE

The verifier receives only the recorded journal evidence — file before/after snapshots, command output, exit codes — and returns a verdict with a confidence percentage. It is intentionally single-model and untiered: you don’t cheapen the check that catches the planner’s mistakes.

[ 03 ]// no mockups

The real interface

The PACT REPL: the PACT AGENT wordmark, status panel, available actions, and the Permission · Action · Cost · Trust pillars.

The actual REPL masthead — block-glyph wordmark, wax-seal emblem, two-column info block, live status, and the eight registered actions across the file, shell, and browser families.

[ 04 ]// designed for control

Built on trust

Built on trust. Designed for control. PACT's six pillars: permission first, sandboxed execution, complete journal, independent verification, transparent cost, local & private.

Permission first

Every action is itemized in a permission contract. You approve y / n / a — nothing runs without your consent.

Sandboxed execution

All operations resolve inside your project sandbox. Paths stay in bounds; the shell can't reach the network.

Complete journal

Every change is recorded with before / after snapshots, output, and exit codes — which also powers undo.

Independent verification

A separate verifier model checks the actual evidence and can return CONFIRMED, CONTRADICTED, or INCONCLUSIVE.

Transparent cost

Real-time token and cost tracking. Unpriced models surface as "unrecorded" — never a misleading $0.00.

Local & private

Runs on your machine, in your project. API keys come from your environment only — never stored, never committed.

[ 05 ]// full inventory

What it can do

Available Actions (8)
file:file_writefile_editfile_deletefile_read
shell:shell_exec
browser:browser_navigatebrowser_clickbrowser_fill

Shell runs as an argv array only — never a raw shell string. Network-capable programs and URL-bearing arguments are blocked. Browser navigation needs a host you’ve explicitly allow-listed; sensitive actions always re-prompt.

Dangerous patterns (rm -rf, sudo, chmod 777, curl | bash) escalate to HIGH risk.

The Governor

A daily USD budget cap, enforced before each call, with live price refresh from OpenRouter.

Cost-aware routing

Cheap planner first; escalates to a stronger model only on a real signal — and always discloses the switch.

Project memory

Durable facts and conventions in local SQLite, injected into the planner — pinnable to always apply.

Scope-locked skills

Save an approved task as a skill. Re-runs re-plan and must match the approved scope, or fail closed — zero actions.

Delegation

A task fans out into independent subagents (bounded concurrency); subagents can't further delegate.

Undo + doctor

Reverse any journaled file action from its snapshot. A doctor command health-checks the install.

Optional surfaces: voice input (transcribe an audio file into a task), desktop notifications on unattended skill outcomes, and a copy-pasteable scheduling command — PACT runs no daemon of its own.

[ 06 ]// python ≥ 3.11 · cross-platform

Use it

pact — live run
REC
01

Clone & install

Grab the repo and install the pact command with pipx.

git clone …/pact-agent · pipx install .

02

Initialize

Set up .pact/ inside the project you want PACT to work in.

cd your-project · pact init

03

Run a task

Describe a task; approve the contract; read the verdict.

pact run "…"

04

Bring your own model

Point any role at OpenRouter or a local Ollama endpoint.

cp .env.example .env

Bring your own model (OpenRouter or local Ollama)
# .env is git-ignored and never committed
$ cp .env.example .env
# then set OPENROUTER_API_KEY=…  (or point any role at a local OpenAI-compatible endpoint)

CLI commands

  • pactenter the interactive REPL
  • pact run "<task>"one-shot: plan → contract → verify
  • pact undo <id>reverse a journaled file action
  • pact log [--last N]recent journal entries
  • pact skill …save / run / compose / export skills
  • pact memory …list / forget / pin project memory
  • pact budget [set]view or set the daily cap
  • pact status · digestactivity + review flags
  • pact doctorinstall / config health check

In-session slash commands

  • /delegate <task>split into independent subagents
  • /voice <path>transcribe audio into a task
  • /remember <fact>record a durable fact
  • /memoryshow / pin project memory
  • /skilllist / save / run / schedule skills
  • /status · /logrecent activity & journal
  • /undo <id>reverse a file action
  • /budget · /configspend vs. cap · current config
  • /help · /exithelp · leave (also Ctrl+D)

Optional extras: pact-cli[voice] (Whisper transcription), pact-cli[notifications] (Windows toasts), and browser support via Playwright.

open source · House of Namus

Plan it. Contract it. Approve it. Verify it.

Clone the repository, install with pipx, and run your first contracted task in under a minute. Bring your own model — OpenRouter or a fully local endpoint.

github.com/Sumandebnath943/pact-agent↗

v0.1.0 · pact-cli · MIT · Built by House of Namus