Custodian sits outside the model, not inside its prompt — so the same policy, the same fail-closed adapters, and the same hash-chained receipts cover any agent you point it at. Codex Guard and Talaria (for Hermes) are live today. Claude, Gemini, and opencode integrations follow the same pattern.
Each integration is a thin, agent-specific adapter over the same kernel primitives — bands, caps, guard adapters, kill switch, hash-chained receipts. Nothing agent-specific lives inside the kernel itself.
A capability firewall for coding agents. Codex can inspect, test, and edit freely inside an approved workspace — but credential use, network calls, destructive commands, production changes, money movement, and governance edits stop at a human-approval boundary the model cannot grant itself.
guard_action, verify_receipts)The integration surface between a local Hermes Agent and everything the Custodian kernel enforces — secrets, files, tools, prompt-injection, and spend anomalies, all checked mechanically below the model, not asked of it. One command installs a kill switch and a tamper-evident audit trail.
custodian setup --profile hermes — installs and wires every hook~/.ssh, ~/.aws, ~/.gnupg, *.env, *.pemEach new integration is the same shape: a thin adapter that translates one agent's tool-call surface into the kernel's action schema. No agent gets special-cased inside the kernel.
Bands, spend caps, the kill switch, and the guard adapter catalog are defined once. Swap Codex for Claude or Hermes for Gemini and the policy stays put — only the thin adapter translating that agent's tool calls into kernel actions changes.
Codex Guard's decisions are hash-chained, tamper-evident, and readable live from the Live Console today. Talaria keeps its own separate audit trail for now — unifying both into the one ledger every agent writes to is active, not-yet-shipped work, not a retrofit we're claiming already happened.
The kernel was built to sit outside any single model or vendor. If you're integrating an agent that isn't listed above, the adapter pattern is documented and the kernel doesn't need to change.