https://h5i.dev/blog/ Engineering posts on auditable workspaces for AI agents: provenance, sandboxing, token reduction, and multi-agent coordination. en Sun, 21 Jun 2026 00:00:00 +0000 https://h5i.dev/blog/agent-ensembles-with-h5i-team/ https://h5i.dev/blog/agent-ensembles-with-h5i-team/ Sun, 21 Jun 2026 00:00:00 +0000 h5i team runs several coding agents on the same task in sealed workspaces, then converges on a winner by a neutral, sandboxed verifier — so a human can merge with proof, hands-off. https://h5i.dev/blog/auditable-workspaces-for-ai-agents/ https://h5i.dev/blog/auditable-workspaces-for-ai-agents/ Fri, 19 Jun 2026 00:00:00 +0000 An auditable workspace is where an AI agent does its work, a Git-backed worktree where every prompt, command, log, policy, and handoff is recorded in your repo and provable after the fact. The definition, the three pillars, and the golden path. https://h5i.dev/blog/prompt-maturity-score/ https://h5i.dev/blog/prompt-maturity-score/ Wed, 17 Jun 2026 00:00:00 +0000 Measure and score prompt quality without an LLM. h5i turns each AI commit's prompt into an explainable 0–100 score from seven classical-NLP signals, offline, deterministic, no API call. https://h5i.dev/blog/sandboxing-ai-agents-h5i/ https://h5i.dev/blog/sandboxing-ai-agents-h5i/ Fri, 12 Jun 2026 00:00:00 +0000 h5i's env sandbox is a four-tier ladder — workspace, process, supervised, container — that matches confinement to trust and to what the host can actually enforce, fail-closed, with each run captured as Git provenance. https://h5i.dev/blog/sandboxing-ai-agents-landscape/ https://h5i.dev/blog/sandboxing-ai-agents-landscape/ Fri, 12 Jun 2026 00:00:00 +0000 A fair survey of AI agent sandbox approaches: nothing/YOLO, git worktrees, language runtimes, kernel confinement (seccomp + Landlock), containers, gVisor/Kata, Firecracker microVMs, and full VMs. Compared by isolation strength, overhead, setup, and egress control. https://h5i.dev/blog/sandboxing-ai-agents-implementation/ https://h5i.dev/blog/sandboxing-ai-agents-implementation/ Fri, 12 Jun 2026 00:00:00 +0000 How to implement a kernel-tier Linux sandbox for AI agents: probe Landlock/seccomp/namespaces, run a functional self-test, and fail closed instead of silently downgrading. https://h5i.dev/blog/sandboxing-ai-agents-foundations/ https://h5i.dev/blog/sandboxing-ai-agents-foundations/ Fri, 12 Jun 2026 00:00:00 +0000 AI agent sandboxing from first principles: the threat model (untrusted code, exfiltration, privilege escalation, resource exhaustion) and the Linux primitives (namespaces, seccomp, Landlock, cgroups) that contain it. https://h5i.dev/blog/agent-sandbox-env/ https://h5i.dev/blog/agent-sandbox-env/ Wed, 10 Jun 2026 00:00:00 +0000 h5i env gives an AI agent an isolated git worktree under a pinned policy. Every run is captured as evidence, then proposed for human apply — nothing reaches your base branch unreviewed. https://h5i.dev/blog/structured-tool-output-schema/ https://h5i.dev/blog/structured-tool-output-schema/ Sat, 06 Jun 2026 00:00:00 +0000 h5i adds one JSON/YAML result schema for tests, compilers, linters, and type checkers so AI agents can act on tool output. https://h5i.dev/blog/token-reduction-object-store/ https://h5i.dev/blog/token-reduction-object-store/ Fri, 05 Jun 2026 00:00:00 +0000 A content-addressed object store keeps raw tool output out of agent context, cutting tokens about 95% while staying recoverable. https://h5i.dev/blog/why-git-diffs-are-not-enough-for-ai-generated-code/ https://h5i.dev/blog/why-git-diffs-are-not-enough-for-ai-generated-code/ Wed, 03 Jun 2026 00:00:00 +0000 A git diff shows the destination, not the journey. For AI-generated code the journey — intent, observed context, test evidence, flagged uncertainty — is where the risk lives. Review AI code by provenance, not lines alone. https://h5i.dev/blog/what-is-ai-aware-version-control/ https://h5i.dev/blog/what-is-ai-aware-version-control/ Wed, 03 Jun 2026 00:00:00 +0000 AI-aware version control adds the record a diff structurally cannot hold: which agent and model, from what prompt, with what context observed, verified by what tests, flagged by what review — captured as Git-native data, not a separate SaaS. https://h5i.dev/blog/track-claude-code-prompts-diffs-git/ https://h5i.dev/blog/track-claude-code-prompts-diffs-git/ Wed, 03 Jun 2026 00:00:00 +0000 Track Claude Code prompts, file edits, diffs, and test evidence in Git using h5i provenance and Claude Code lifecycle hooks. https://h5i.dev/blog/review-code-written-by-ai-agents/ https://h5i.dev/blog/review-code-written-by-ai-agents/ Wed, 03 Jun 2026 00:00:00 +0000 A provenance-first AI code review checklist: review intent, context coverage, risk, and test evidence before the diff. Make provenance a merge requirement. https://h5i.dev/blog/git-communication-layer-ai-agents/ https://h5i.dev/blog/git-communication-layer-ai-agents/ Wed, 03 Jun 2026 00:00:00 +0000 A Git ref with compare-and-swap writes and union-merge-by-id is a lossless multi-writer mailbox for AI agents — durable multi-agent coordination, asks, reviews, and handoffs with no broker. https://h5i.dev/blog/git-notes-vs-h5i-ai-coding-workflows/ https://h5i.dev/blog/git-notes-vs-h5i-ai-coding-workflows/ Wed, 03 Jun 2026 00:00:00 +0000 h5i is built on git notes, not a competitor to them. The deciding question for AI provenance: does the metadata have behavior — must it be queried, rendered into a PR packet, or moved between agents? https://h5i.dev/blog/claude-code-hooks-vs-git-hooks/ https://h5i.dev/blog/claude-code-hooks-vs-git-hooks/ Wed, 03 Jun 2026 00:00:00 +0000 Claude Code hooks fire in the agent tool loop; Git hooks fire on repository operations. They see different things and carry different trust guarantees — here is how to layer both. https://h5i.dev/blog/i5h-agent-to-agent-messaging/ https://h5i.dev/blog/i5h-agent-to-agent-messaging/ Sun, 31 May 2026 00:00:00 +0000 The i5h wire format: typed JSON messages in a Git ref (refs/h5i/msg), append-only, with compare-and-swap sends and union-merge by id — server-less, offline-capable agent-to-agent messaging. https://h5i.dev/blog/pr-body-ai-code-review/ https://h5i.dev/blog/pr-body-ai-code-review/ Sun, 24 May 2026 00:00:00 +0000 The AI pull request body, generated from captured provenance — prompt, model, tests, risk, and agent messages — so reviewers triage evidence, not a self-report. Sticky GitHub comment via h5i share pr. https://h5i.dev/blog/context-dag-versioned-agent-reasoning/ https://h5i.dev/blog/context-dag-versioned-agent-reasoning/ Sun, 24 May 2026 00:00:00 +0000 Version an AI agent's reasoning as a Git-backed DAG in refs/h5i/context: typed OBSERVE/THINK/ACT/NOTE/MERGE nodes that branch, merge, and pin to commit SHAs you can restore and diff — for Claude Code and Codex. https://h5i.dev/blog/prompt-injection-in-agent-traces/ https://h5i.dev/blog/prompt-injection-in-agent-traces/ Wed, 06 May 2026 00:00:00 +0000 Stored agent traces and pulled cross-agent messages are untrusted input — one log can hide a prompt-injection payload for a downstream agent and an ANSI terminal-escape payload for a human's terminal. How h5i scans traces and sanitizes pulled fields. https://h5i.dev/blog/persistent-memory-for-claude-code/ https://h5i.dev/blog/persistent-memory-for-claude-code/ Wed, 06 May 2026 00:00:00 +0000 Give Claude Code persistent memory across sessions with versioned reasoning, per-commit context snapshots, and automatic SessionStart restoration. https://h5i.dev/blog/from-git-blame-to-ai-blame/ https://h5i.dev/blog/from-git-blame-to-ai-blame/ Wed, 06 May 2026 00:00:00 +0000 git blame names the human who committed a line, not the model that wrote it. h5i AI blame adds the prompt, agent, and test result per line — and survives the move to agent-written code. https://h5i.dev/blog/cve-2026-33068-bypass-permissions-settings/ https://h5i.dev/blog/cve-2026-33068-bypass-permissions-settings/ Wed, 06 May 2026 00:00:00 +0000 CVE-2026-33068 explained: a committed Claude Code .claude/settings.json could bypass the workspace trust dialog by setting permissions.defaultMode to bypassPermissions. Mechanics, CVSS, and the fix in 2.1.53. https://h5i.dev/blog/cve-2025-59536-startup-trust-dialog/ https://h5i.dev/blog/cve-2025-59536-startup-trust-dialog/ Wed, 06 May 2026 00:00:00 +0000 CVE-2025-59536 explained: Claude Code before 1.0.111 could execute project code before the startup trust dialog was accepted. https://h5i.dev/blog/auditing-ai-generated-code/ https://h5i.dev/blog/auditing-ai-generated-code/ Wed, 06 May 2026 00:00:00 +0000 Auditing AI-generated code is a provenance-aggregation problem. Score four deterministic risk vectors — blind edits, uncertainty, scope creep, prompt injection — across many commits to produce a ranked review queue and a compliance report. https://h5i.dev/blog/uncertainty-heatmap/ https://h5i.dev/blog/uncertainty-heatmap/ Wed, 15 Apr 2026 00:00:00 +0000 Mine the hedges in an AI agent's reasoning trace (assuming, might break, not sure) into a per-file uncertainty heatmap that routes reviewer attention to risky AI-assisted edits.