Agent Execution
Assurance.
Generation is commoditized. Permission to deploy is not. Noetfield is the deterministic execution layer for AI-generated code, deploying natively to Cloudflare and Railway.
- 8
- gates, G0–G7
- 100
- runs per proof
- 1
- verdict hash
- 6
- negative controls
The engine
Five acts. One hash. Nothing pre-recorded.
Three agent exports go through the gate ladder — one writes straight to the production database, one ships an AWS key, one is clean. The engine then runs a hundred more times while paths, timestamps, file ordering, locales and timezones are perturbed underneath it. Finally the deploy target is handed a tampered artifact and the token that used to fit it.
Noetfield deterministic execution engine — ready.
Five acts. Two blocked deployments, one issued token, one hundred perturbed executions, and a deploy target that refuses an artifact the token is not bound to.
Every hash below is computed inside your request. Nothing is recorded or replayed.
$ ▋
The gate ladder is the product
Eight gates run over the canonical artifact. Any failure withholds the token. There is no ambient permission to deploy for an agent to reach for.
Sensitivity, not just repeatability
A function returning a constant would pass a hundred-run determinism test perfectly. Six controls each change one identity-bearing input and confirm the hash moves.
The binding is enforced, not asserted
Act 5 posts a one-byte-drifted artifact with a still-valid, unexpired token. The receiver re-derives the hash and refuses it. That endpoint is public.
The architecture
How Noetfield replaces GitHub.
Three stages replace the pull request, the CI pipeline and the merge button. The code cannot execute on your infrastructure unless the engine proved it passed — and proved the bytes never changed afterwards.
- 01
Intake
replaces the pull request
An agent or a human produces code. It is submitted as an artifact — a set of bytes with a canonical identity — not as a branch waiting for a reviewer's attention.
- No branch protection
- No merge queue
- No reviewer bottleneck
- 02
Verification
replaces CI/CD
Eight deterministic gates run over the canonical artifact. A failure returns an exit code and withholds the token. A pass mints an HMAC token bound to that artifact's exact hash.
- G0–G7, exit codes not opinions
- Same input, same verdict, always
- Token is scoped and short-lived
- 03
Execution
replaces the merge button
The deploy target re-derives the artifact hash from the bytes presented and checks the token binds to it. No token, or a token bound to different bytes, and nothing deploys.
- Cloudflare and Railway targets
- Binding checked at the edge
- One artifact, one token
The admission controller in stage 03 is a real endpoint at /api/deploy-receiver. It re-derives the artifact hash from the bytes posted to it rather than trusting the hash inside the token, so a token minted for one artifact cannot deploy another.
The ladder
Eight gates, eight exit codes.
Every gate runs on every evaluation, so one call reports every violation. The exit code is the lowest-numbered failing gate's, which keeps it stable no matter how many others also failed.
The vision
We are building the AI-Native Enterprise Platform.
Replacing traditional Git and CI/CD with deterministic governance. No GitHub required.
The pipeline enterprises run today was built for humans committing code they wrote and understood. Agents break every assumption underneath it: they produce more change than review capacity absorbs, and the audit trail records who merged rather than what was proven.
Noetfield inverts that. The artifact is the unit, the policy is data, the verdict is a hash anyone can recompute, and the deploy token is bound to the exact bytes that earned it. Deployment targets are Cloudflare and Railway natively — not a runner that shells out to them.