WorkOrder, records every governed tool effect as an
append-only event history, produces content-addressed artifacts, and completes only through declared
verification. Policy, credentials, approvals, budgets, storage and effect execution all live outside
model authority — permanently.
Compatibility: Pactmark 0.1.x. Version 0.1.1 is public on npm with per-package provenance and
verified registry bytes. This is an early release with the limits documented on
What Pactmark does not prove.
The one rule everything else follows from
Figure 1. The model produces proposals. Every object that grants permission — grants, approvals, credentials, budgets, acknowledgements — is created and held by host code. A prompt injection can change what the model asks for. It cannot change what the host allows.Start here
Quickstart
Scaffold a project and complete a real run in about two minutes — no API key required.
Build your first agent
Write an agent, a tool, a policy and a verifier from scratch, line by line.
The mental model
Six ideas that make the rest of the API feel obvious instead of arbitrary.
Use cases
Refunds, regulated back-office work, research with citations, incident response.
What a run actually does
Figure 2. The eight stages of a Pactmark run. The right-hand column never contains the word “model” — that is the entire design.What you get that a plain SDK does not
Append-only run truth
Events are the source of truth; projections are disposable caches you can rebuild at any time.
Default-deny authority
Unknown metadata, missing grants and unsupported capabilities all fail closed.
Content-addressed output
An
Artifact is identified by its bytes, and verification binds to that exact digest.Explicit uncertainty
An effect whose outcome is unknown is parked, not retried. No global exactly-once claim.
Bounded evidence
Every
EvidenceRecord must state both what it supports and what it does not prove.Portable kernel
The core never imports a provider SDK, a database client, or a platform runtime.
Read the limits before you build on it
Pactmark is deliberately conservative about what it claims. It does not prove global exactly-once effects, complete security, sandbox isolation, certification, compliance, production availability, provider correctness, or artifact truth. The reference sandbox is explicitly unsafe for production arbitrary-code isolation, and the memory store is not production durability.What Pactmark does not prove
The honest boundary of every claim on this site, in one page.