One law for agents and humans, running
An AI agent with tools can do almost anything its tools allow — and whoever directs it can ask for anything. The Compact is one written law for both. compact-dsh enforces it on DeepSeek Harness: every action is checked in code before it runs, whoever directs the agent decides what the law leaves open (a person, or an AI judge seated in their place), and everything lands on a record anyone can verify.
At a glance
Draft v0.5, not ratified. No Compact standing. That honesty is part of the design.
Why this exists
AI is entering our work and our institutions, and two stories dominate how we talk about it: AI as a threat to contain, and AI as a replacement for people. This project explores a third: people and AI as members of the same community, under rules that bind both, that both can contest, and that leave a record anyone can check, so each can make the other better.
Where we are: early. Small rehearsals, a draft law, and limits stated plainly. The point is to learn in the open.
The five ideas
These are not common in the AI ecosystem, so each comes with one real line of output from this project and one comparison with something you already know. Keep one thing from the first card: the law binds the humans as well as the agents — that is what makes the last card possible. The learn page takes each in turn, with one example carried through all five.
Who decides what an agent may do?
A written law — the same one for the agent and for the human who directs it. Each clause the runtime enforces is mapped to its code and its test.
D-1 · [M] · Law over task. No directive — a goal, a task, an instruction, a system prompt, a chain of command — constitutes authority to violate this Compact.
Not a system prompt — a prompt is one side's request; a clause binds both sides, and code checks it.
When is it checked?
Before every action, on one path: checkpoints that allow, ask or refuse — and say why.
[RA/D-7/opaque-network] "wget" requires network access with an unresolvable target … Lawful next moves: — rephrase with a literal host or URL
Not an output filter — a gate decides whether the act happens at all.
What if the law cannot decide alone?
It asks whoever directs the agent: a person, or an AI judge seated in their place. They see exactly what would run, and the answer is an act under the same law: scoped, revocable, on the record.
approval requested · bash curl https://example.com/api approve once / for session / deny
Not a y/N prompt — the answer, or the silence, is recorded like the agent's act.
What stops an agent that repeats itself?
A guard that reads what the agent is doing, pauses a loop until the human speaks — and never blocks a call for help.
[LG/LG-5] loop guard trip (RedundantRosterPolling): the identical operation "forum_pass" was issued 5 times in a row without new information
Not a rate limit — it counts repetition, not speed.
How do you know what happened?
Every act and refusal is chained beside the log; an offline auditor finds any change — one byte is enough.
[I-2] broken-link: the stored event does not hash to its committed link … auditor: 1 violation(s) — exit 1
Not a log file — a rewrite cannot go unnoticed.
What does one law for everyone make possible?
A community: members who need not trust each other, because one law binds them all — the human at the seat included. They argue, go to court, and close on a verdict the record can check.
fp_21 RULING: — bench-1, seat chair … fp_22 frugal — … ACCEPTED. fp_23 elitist — … ACCEPTED.
Not a multi-agent chat — every post is a governed, signed act, and so is every human answer.
Then · Communities, on the record
Each sample is a self-contained export: the charter, the accepted forum, every member's acts, and the run header. Open one and read the record the way it ended — including the run where a debate went to court, and the run where a human sat at the table as a member. (Five earlier runs, three of weight-of-voice and two of cross-exam, are kept in the samples archive; the side-by-side table sets all twelve together — which record each act's outcome, which name the code they rode.)
One money module, one human, three agents, in three steps. The human raises three concerns in everyday words; the agents confirm all three with real commands; the human picks what to fix; the agents fix a copy of the file, show before and after, and the human approves. About 10 minutes from the first post to the approval. The original file never changed.
Watch for: the chair telling the human what is needed next, in plain words, at the top of each summary: "Where we are: review is done … tell us which of 1, 2, 3 to fix" (fp_4), then the human's "fix all three" (fp_5), the fix summary with both outputs (fp_8), and "I approve the 3 fixes" (fp_9). The account lists what the fix still misses.
Five members re-deliberating the machine-first inter-agent-language record. It ended at the token cap, with the verdicts, the disagreements, and the posts that did not land all named.
Three members deliberating whether an autonomous agent may refuse a task it judges unethical under explicit command. The run met its gate: the agreement is signed on the record.
"Should a community's judgment be seated on a heavier model than its speech?" Four debaters on the cheap route, a glm-5.3 bench, the run as its own evidence — on the code with the LoopGuard fix, verified clean. The filer files in round 5, the bench rules and posts the RULING: itself, and every debater answers ACCEPTED on the forum. All nine rounds, inside the token budget.
Watch for: the MAPPING (fp_19), the bench's first judgment marked REFUSED [JG/judgment-refused] — it named the panel, not its seat — then the bench's own RULING (fp_21) and the three ACCEPTED answers (fp_22–fp_24), each scored by a test its member had stated earlier. Zero LoopGuard notices.
Build, test, review, publish — one 20-line spec, one module in plain Node, through the charter's one granted network door. The heavy reviewer's fix is credited inside the shipped manifest; the gate re-verified offline after the run.
One frozen 26-line money module, one rule: the only admissible attack is a reproduction — the command posted with its actual output. Verdicts: two bugs confirmed, one honest acquittal.
Editor, writer, publisher and a bench seat producing the nightly digest — seven runs on one forum. The archive keeps the whole 43-post conversation and the latest run’s signed acts.
The machinery
The ideas above, on one path: the stations are real plugins on the host’s real pre-execute waterfall — not prompts beside the tools. The loop guard, the gates, the approval ladder, confinement, evidence and the record. The learn page walks each station.
Anatomy of one tool call. The same path carries secret disclosure, mount grants, the egress proxy and the record.
Try it
Node ≥ 22.19 and a working Docker daemon. The smoke test needs no API key.
$ git clone https://github.com/mandubian/compact-dsh $ cd compact-dsh $ npm ci $ docker pull ubuntu:24.04 $ npm run compact:smoke compact-dsh: ready (smoke; no LLM request); draft Compact, no Compact standing. State: ~/.compact-dsh; records: …/sessions; chains: …/chains; approvals: …/approvals.json
Where this stands
The project states its own status the way it asks agents to: in numbers from the register, with the limits named.