HELM Proof Loop
August 21, 2026 · View on GitHub
HELM is useful only when the action reaches the boundary. The loop is small:
an agent proposes an action, HELM evaluates it before dispatch, the verdict is
ALLOW, DENY, or ESCALATE, and the run leaves evidence that can be checked
later.
agent proposes action
-> HELM evaluates policy, approval state, and effect scope
-> ALLOW: action may dispatch
-> DENY: action is blocked
-> ESCALATE: action is blocked until a scoped approval exists
-> receipt and EvidencePack material can be verified offline
One Local Path
Install the kernel, run the local proof, then verify the bundle:
brew tap mindburn-labs/tap
brew install mindburn-labs/tap/helm-ai-kernel
helm-ai-kernel mcp proof --json --out ~/.helm-ai-kernel/proofs
helm-ai-kernel verify --bundle ~/.helm-ai-kernel/proofs/<run-id>/evidencepacks/<run-id> --profile dev-local --allow-self-attested --json
--allow-self-attested is explicit because this local proof creates its own
signing key. It proves internal consistency, not provenance.
For one workstation receipt:
helm-ai-kernel workstation verify-decision \
--receipt ~/.helm-ai-kernel/receipts/hooks/<decision>.json
Integrity and signer trust are separate verdicts here — trust is checked
against the local --data-dir workstation key by default, with
--trusted-public-key-file as the out-of-band pin for copied receipts
(details);
pre-v0.7.3 derivable-seed receipts remain untrusted.
What Each Surface Owns
| Surface | Public role | Proof output |
|---|---|---|
| Agent gateway | Routes actions before side effects run | verdict and receipt |
| Policy authoring | Defines allowed, denied, and escalated effects | policy ref in receipt |
| Scoped approval | Narrows an ESCALATE path | approval and revocation receipts |
| EvidencePack | Moves proof between machines | offline verifier result |
| Category pages | Explain adjacent tools without superiority claims | cited public evidence |
Boundaries
- HELM only governs effects routed through an adapter, wrapper, hook, proxy, or API route.
ESCALATEis not permission to continue. Obtain a credential-verified durable dispatch admission for the exact scope, then rerun the original action. Localmcp approvedoes not mint that authority.- Receipts prove the evaluated action and verdict. They do not prove every tool outside the boundary was governed.
- EvidencePacks are portable proof bundles, not marketing screenshots.