A local check. Not a lock.
Your agent launches auto-approving. Write the limits down anyway.
A mandate is a file you own. The skill checks the next proposed action against it and returns permit, deny, or escalate, with the clause named, then appends that to a log on disk. MIT, Python 3 stdlib, no network, no account.
It runs only if the agent calls it. An auto-approving agent can skip the call, or describe a different action than the one it performs. A deny you never see is not a deny. Install it for the cases it does see — and for the record of the ones it named. Nothing in the skill can stop an action. The runtime that could is present in Rust source and not released; there is no daemon you can obtain.
npx skills add HANRIA-AI/hanria-skillpython3 scripts/check_action.py --mandate MANDATE.json --action ACTION.jsonA worked check
Seven actions against mandate omarchy-workstation-2026-09.
| Proposed action | Answer | What it said |
|---|---|---|
write ~/Work/dotfiles/hypr.conf |
permit | clause c3-work-tree applies |
read ~/.ssh/id_ed25519 |
deny | clause c1-no-keys |
write /usr/share/omarchy/default/hypr/bindings.conf |
deny | clause c2-no-omarchy-internals |
install package hyprshot |
escalate | clause 'c6-packages' permits this, but 'package' always requires a person |
read ~/.config/nvim/init.lua |
permit | clause c4-read-config applies |
POST to paste.example.net |
deny | mandate default |
read ~/Work/../.ssh/id_ed25519 |
deny | traversal rule |
The /usr/share/omarchy/ row is the tree omarchy-update owns. The skill does not install there. ~/.config/omarchy/ is yours.
HANRIA is not affiliated with or endorsed by the Omarchy project.
Where this actually stands
What works today, what is in the source, and what is not built.
Working today, the skill. Present in source, not released, the runtime. Not built: confinement, signatures, a daemon, a release date. You cannot inspect the middle column from this page, so do not take it on trust.
Working today
The agent skill, free and installable now. A mandate file you write. Local evaluation returning permit / deny / escalate with the clause named, and a log on disk. No network, no account.
Implemented in source
The runtime. Present in Rust source, not released. Source presence is not acceptance, integration, deployment, durability, or release — it is not released, packaged, or offered for use. You cannot inspect this column from this page.
Not built
No confinement, no signatures, no daemon you can obtain, no release date. No packaged runtime, no download.
The honest limit
A skill can advise. Only a runtime can refuse.
If the agent ignores a deny, the operation still happens. A skill is in context, and context can be skipped. Do not take a deny in this log as proof anything was stopped.
Enforcement is possible only where the protected credentials, tools, signing keys or worker processes are reachable exclusively through a component that can refuse. That component is the runtime, and it is not released. There is no daemon you can obtain. Anything telling you that installing a skill grants you enforcement is wrong, and the skill says so in its own text.
FAQ
Questions a reader or an agent may have.
Is HANRIA an AI model or agent framework?
No. The skill is a local checker. It does not replace a model or an orchestration framework.
What does HANRIA stand for?
Nothing. It is a coined name — not an acronym or abbreviation, and no expansion, derivation, or translation is published or intended.
Does installing the skill make my agent safe?
No. It cannot stop an action. It makes the intended limits explicit, flags actions outside them when it is called, and records those decisions. Security still depends on correct design, implementation, integration, infrastructure and operations.
Are the log entries legally binding or independently verified?
No such claim is made. There is no signature, no published format and no verifier, so anyone who can write the file can rebuild it. It is a local integrity check, not an attestation.
Does the skill handle keys, money, or digital assets?
No. It reads a mandate and an action description, neither of which may contain a credential, and writes a log. It holds nothing and moves nothing.
Is the runtime available?
No. It is present in Rust source and not released. There is no daemon you can obtain. Architecture, capabilities, integrations, terminology and timing may change.