Open Source · AI Tooling

Proof Kitchen

An operating system for Claude Code agents that refuses to call work done without evidence. Eight agents, six hooks and an MIT license.

6 Hooks that enforce, outside the model's control

1 Time it locked out its own author

2026

A chef in whites plating a salad at the pass, with the words Proof Kitchen and My AI agent got stuck in the walk-in cooler over the photo

The problem

AI coding agents say “done” the way a tired contractor does. Often, and without showing you. I was running Claude Code on real projects and I kept catching the same failure. The agent would report a feature finished. The file wouldn’t exist, or the test the agent described hadn’t run. Asking the agent to be more careful worked for about an hour. Prompts are suggestions.

I wanted “done” to actually mean something.

Why I built it

Because this is a workflow problem, not a model problem. The agent isn’t lying. The agent has no station where the plate gets checked. I’d spent years designing tools for people whose work has consequences. The fix in those tools is never “be more careful.” The fix is structure. A step that can’t be skipped, a second pair of eyes and a record of what happened.

The restaurant kitchen is the model. The pass is where the expeditor inspects every plate before the plate leaves. Checking is a station, not a vibe.

What it is

Eight agents with one job each. Six hooks that run at the Claude Code level, where the model can’t negotiate with them. The cook is the only agent that builds. The expeditor verifies every result with fresh evidence. A critic looks for the ways the build will break.

The six hooks.

a budget governor that counts tool calls and tokens against a ceiling
a risk guard that blocks destructive commands and data leaving the repo
an evidence logger that writes one line per action
a delivery gate that blocks the session from stopping when a task is open and there’s no proof of work
a handoff writer that snapshots state before context is compacted
a model audit at session start

The verify step is always a different agent from the build step. The cook never inspects their own plate.

The idea

Let smaller, cheaper models do trustworthy work. The guarantees come from the structure, not from how smart the model is.

The lockout

During the system’s own test, a task went over budget and the governor did its job. The governor blocked every tool call in the session, including the ones needed to reset the budget. The system locked out the session that built it. I had to hand-edit one JSON file to free the session.

The fix followed the system’s own rule, fix the system and not the plate. The governor now keeps read-only tools and the budget file available when it halts. A halted session can record a decision instead of freezing. An enforcement layer you can’t negotiate with will eventually enforce against you. Design the halt state, not just the halt.

Outcome

Public on GitHub under MIT since July 2026. I keep developing the kit privately. The current version runs on every project I work on, including this site.

What I took from it

Don’t ask an agent to be careful. Give the agent a station where carelessness can’t pass. And you only learn to write the halt state before the halt by getting locked out once.