AXIOM

The transactional write gate for coding agents.

Plan → Manifest

An agent submits a Plan; AXIOM compiles it to a canonical, content-addressed Manifest (JCS/RFC 8785, sha256) — no timestamps, no content inline.

Set-level checks

Predicates run over the whole change set, not one file at a time. A fact provider that cannot run yields error, never a silent pass. Fail closed.

Two-phase apply

Pre-image hashes are re-verified at commit, writes are staged then atomically renamed, and a journal makes every apply rollback-able, even after a crash.

On the record

confirmDigest must equal the manifest digest. Optional Ed25519 signing, anti-rollback counters and in-toto attestations make the agent’s edit provable.

Works everywhere

One package, five surfaces: MCP server, CLI, PreToolUse hook, GitHub Action, VS Code. Roots are an explicit allowlist; there is no cwd fallback.

Deterministic

Same Plan, same Manifest, same digest on Linux, macOS and Windows. Golden fixtures pin every digest in CI.

Install

npx @codai/axiom-mcp --help

Nothing to install; the current release is fetched on first run.

npm i -g @codai/axiom-mcp
axiom --version

curl -fsSL https://dragoscv.github.io/axiom/install.sh | sh

Standalone executable, no Node required. Verified against the release SHA256SUMS.

irm https://dragoscv.github.io/axiom/install.ps1 | iex

Installs to %LOCALAPPDATA%\axiom\bin and adds it to your user PATH.

Install the .vsix attached to the latest release, or wire the MCP server in .vscode/mcp.json — see VS Code.

- uses: dragoscv/axiom/action@v2
  with:
    bundle: .axiom/manifests/<hex>.json
    root: .

Fails the PR when the tree does not match the manifest. Details in GitHub Action.

How it flows

flowchart LR
  A[Agent] -->|Plan| P[plan_compile]
  P -->|Manifest + blobs| C[check]
  C -->|verdict| D[apply_dry_run]
  D -->|diff + digest| X[apply]
  X -->|journal| J[(.axiom/)]
  X -->|attestation| S[Sigstore]

Every arrow is a hash boundary. Read the pipeline page for the sequence diagram and the invariants that hold across all of it.

Used by

codaiThe SWE harness routes every write through the gate by default; agent-core tools carry risk classes.

brivioA profile whose guard.external runs brivio's own guard suite, plus the gate profile and Copilot hook.

meturepo.requireCompanion rules transcribed from metu's own skills, with proof runs.

Why it exists

Coding agents write files. Most of the time that is fine; occasionally it is a half-applied refactor, a clobbered concurrent edit, or a change nobody can trace back to a decision. AXIOM makes an agent’s write a transaction: planned, canonicalised, checked as a set, applied atomically against verified pre-images, journaled, and, when you want it, signed. It sits in front of the filesystem as an MCP server or a hook, so the agent does not have to be trusted; the gate does the trusting.