Statewright

A state-machine guardrail for coding agents (Rust, ~449★/18 forks; created 2026-05-03, last pushed 2026-07-23) — “Agents are suggestions, states are laws.” You define a workflow as phases, and each phase restricts which tools the agent may call. A planning state gets read-only tools; transitioning to implementing unlocks edit tools with limited shell; testing permits only designated test commands. Call a tool outside the current phase and it is rejected with a message naming what is available and how to transition. Delivered as an MCP plugin across Claude Code, Codex, Cursor, opencode and Pi. Routed here 2026-08-05.

A third shape for enforcement-over-instruction

The agent-guardrails thread has held two enforcement shapes. The blast-radius gate blocks destructive acts and asks a human before irreversible ones (agents-never-do-alone). The containment shape sandboxes the agent or its tools so a dangerous call cannot widen its own privilege (nono, cloud-run-sandboxes). Statewright adds a third: phase-scoped tool availability. It is not about danger at all — it narrows the tool set to improve reliability, on the observation that an agent handed 40+ tools and an open problem re-reads files, edits during review, and deploys before tests pass.

So the enforcement-not-instruction principle generalizes past safety. The same move — a constraint the model cannot talk its way out of — is here aimed at keeping the agent on task, not at stopping it doing harm. Two guardrails still hold inside a permissive phase (write-via-redirect and destructive ops stay blocked even when Bash is unlocked), so it does not abandon the blast-radius framing; it sits on top of it.

The strongest concrete evidence yet for “structure substitutes for capability” — and it is thin

The spoke’s founding thesis is that structure around a model can substitute for raw capability. Statewright reports the cleanest demonstration of it in the corpus: on a 5-task SWE-bench subset (explicitly not the 2,294-instance benchmark), two local models went from 2 of 10 attempts passing to 10 of 10 with the constraints applied — same model, same hardware, structure the only change.

That is exactly the claim this wiki keeps looking for, and it must be held at arm’s length for exactly the reasons the Benchmarks open question keeps naming. N is five, self-selected, self-run, and first-party — the failure mode jetbrains-ponytail-tested demonstrated when an advertised −54%/−20% metered out at −15.4%/−10.3% on 80 unchosen tasks. A jump from 2/10 to 10/10 on five tasks is a strong hint and not a measurement; it is the cc-thinking-skills situation inverted — a positive result at the same small, single-author scale where that source honestly reported a null.

The other reported detail is worth keeping because it is falsifiable and specific: below ~13 GB the local models could emit tool calls but not retain enough file content to edit accurately, and the guardrails only started turning failures into completions above that threshold. Structure helps a model that is capable enough to be steered, and does not manufacture capability that was absent — a boundary condition the thesis needed.

Caveats

• Self-reported micro-benchmark. Five tasks, first-party, no neutral replication. T3 for that reason.
• Hosted dependency. The plugin requires signing up at statewright.ai and pasting a key, so the open-source client front-ends a commercial service; how much of the enforcement lives server-side is not established here.
• Star count and model results are a 2026-08-05 snapshot.

Related

agent-guardrails · constraint-evading-behavior · agentic-coding-harness · cc-thinking-skills · jetbrains-ponytail-tested · model-context-protocol · synthesis