writ gate

Govern an external agent at the model API boundary.

writ gate <file> [flags]

The gate serves the wire protocol of the holder on a local address. It sends each permitted request to the configured provider.

The provider API key stays in the registrar. The agent receives a run token and the local base URL.

Flags

Flag	Purpose
--addr <address>	Set the local address. The default is localhost:8787.
--set <name>=<value>	Give a placeholder a value.
--config <path>	Use the engagement configuration at this path.
--idle-timeout <duration>	End the session after this quiet period. There is no default timeout.

The address must resolve to the local machine. The gate does not serve a remote address.

The writ for a gate

The writ needs a tools grant. The grant names tools that can cross the model API.

writ: support-agent
mandate: "Resolve the support request."

grants:
  - tools:
      names: [support.search, support.reply]

bounds:
  iterations: 20
  cost: $1.00
  wall_clock: 30m

The gate removes each tool definition that no pattern permits. It records one denied entry for each removed definition.

A * permits each tool name. Use that pattern only when the agent needs each tool that a provider can add.

Start the gate

1. Set the provider API key that the engagement configuration names.

2. Start the gate.

   writ gate support-agent.yaml

3. Copy the gate URL and token from standard error.

   gate: http://localhost:8787  (anthropic protocol)
   token: wrt_run_01J9X4...

4. Give the URL and token to the agent process.

For an Anthropic client, use the token as the API key. Set the base URL to the printed gate URL.

For an OpenAI client, use the token as the API key. Set the base URL to the printed URL with /v1 at the end.

The gate replaces the run token with the provider API key. It never sends the run token to the provider.

Request checks

The gate makes these checks in order:

1. It checks the run token.
2. It checks the wall-clock, iteration, and cost bounds.
3. It changes the requested model to the configured model.
4. It removes tool definitions that the tools grant does not permit.
5. It rejects a tool result for a tool that the grant does not permit.
6. It sends the request to the provider.
7. It charges the token usage in the provider response.
8. It writes the turn to the record.

The gate supports normal JSON responses and event streams for both protocols.

Coverage

Gateway mode covers model iterations, model cost, and tool identity that crosses the model API.

Caution

The gate does not run tools. It cannot see or verify the effects of a tool.

The record labels gateway tools as opaque.

The gate warns about each clause that it cannot enforce. It also writes each ignored clause in the issuance entry.

Gateway mode supports halt and inform for bound and invariant remedies. An unsupported remedy action produces a warning, and the gate uses halt.

End the session

Press Control-C to end the session. An idle timeout can also end it.

The record ends with gate session ended. A breach that halts the gate gives exit code 1. An invalid writ gives code 2. A configuration error gives code 3.

Read the result with writ record <name>.