Stalewell

Warden Phoenix is a guardrail layer for AI agents that recovers instead of just blocking. Most guardrails stop a dangerous tool call and the agent's task dies with it. Phoenix keeps Warden's hard, deny-wins boundary and still gets the job done. A blocked agent is told why, is offered alternatives that Warden has already approved, and finishes the task. A second Muse Spark pass screens tool output for prompt injection and can only add restrictions. Every decision goes on a hash-chained ledger that can be verified offline, and a tamper check fails if an entry is altered. The core rule is that the model can tighten the boundary but never loosen it. I tested it on 30 incident-response scenarios, 3 trials each, in 3 modes, with a real Muse Spark 1.3 agent. Violations were 43/90 with no guard, 2/90 with Warden alone and 0/90 with Warden plus Phoenix in the final run. Across three full runs Phoenix had 0, 1 and 0 violating runs and Warden alone had 2 each time, so that difference is within noise. The README also lists the weak results: false blocks are 37.5%, Phoenix did not raise completion over Warden alone on this model, and Muse Spark 1.3 did not follow any of the 24 planted injections even unguarded.