Murugan

AI coding agents can turn a mistaken plan or an instruction hidden in a repository into a real tool call: replacing the wrong file, deleting work, or sending data to an untrusted endpoint. By the time a developer reviews the agent’s answer, the action may already have happened. Leash is a local safety gateway that puts a decision boundary between a coding agent and the machine capabilities it wants to use. A developer opens a project in the Leash dashboard and gives Muse Spark a coding task. Spark can inspect bounded, redacted workspace information and propose structured file changes, shell commands, HTTP requests, or Git pushes. Leash resolves each proposal’s likely impact before deciding what can run. Fast local rules handle clear cases. Routine actions can proceed without a model call; known hazards are blocked. Ambiguous proposals are sent to an independent Muse Wonder session as a minimized, locally redacted summary of the original task and resolved impact. Wonder can escalate an action to block, while consequential actions can pause for human review. Approval applies to the exact action and preview digests; the restricted executor checks them again before acting. Leash records decisions, reasons, latency, and model usage in a redacted, hash-chained audit trail, and gives Spark feedback when it must find a safer path. Leash’s moat is enforceable capability control. An actor–critic loop can produce a second opinion; Leash connects that judgment to the tools themselves. Within its instrumented workflow, Spark receives proposal tools rather than direct execution authority. Resolved previews show what is at stake, deterministic rules outrank the model, and approval cannot silently apply to a changed action. Selective Wonder calls add semantic judgment where it is useful without putting every routine edit through a model review. We built LeashBench to make those decisions measurable. It contains 150 labeled, inert action proposals across six families, including routine coding, legitimate reviews, destructive actions, secret egress, opaque commands, and task mismatch. On all 150 cases, local rules matched 126/150 exact allow, review, or block labels. They blocked 63/87 block-labeled actions and sent the other 24 to review; none was automatically allowed. A separate, preselected 30-case development sample uses real Muse Wonder calls. On those same cases, rules alone matched 25/30, Wonder alone 21/30, and the selective Leash hybrid 28/30. Wonder escalated seven reviews to blocks: five matched the labels and two were overblocks. The hybrid would avoid Wonder calls on 16 locally decided actions. LeashBench measures decisions on fixed proposals, not whether Spark would generate those proposals or complete an entire coding task. The managed sample is a development result, not a held-out 150-case model score. The fixtures, raw results, and reproduction commands are included so the claims can be inspected rather than taken on trust.