Shipped: CUSTOS-CORE

Deterministic, fail-closed execution gate for AI agents. Every proposed action is evaluated against explicit per-tenant policy before it runs (deny by default, tool allowlists per tenant). Every decision, allow or deny, goes into a hash-chained, tamper-evident audit record. The gate is not a model, so an agent can't reason or prompt its way past it. AGPL open core.

Proof: 528 CI tests, plus red-proof CI where a deliberate one-line sabotage of the gate must turn the suite red. An independent researcher reconstructed the evaluation records, re-hashed every artifact, and published his verification: github.com/factnotebook/public-reconstructions