fak: A Go-Based Agent Kernel That Wraps Codex with Default-Deny Tool Policy

What fak Actually Solves

fak addresses a specific pain: agents like Codex run with broad tool access and implicit model choices, which makes them hard to constrain or audit. The project wraps an existing agent session, applies a capability allow-list, and records every tool call verdict. The README frames it as an agent kernel that manages context, models, tools, policy, and receipts. The target user is someone who already uses Codex or Claude Code and wants a policy layer between the agent and the system, not someone looking for a new agent from scratch. The default-deny floor means tools outside the configured boundary are blocked, not merely warned about. That is a concrete security posture, not a vague promise.

The Default-Deny Mechanism and the Offline Proof

The core mechanism is a guard command that wraps your existing session. The README shows `fak guard -- codex` as the entry point. That command forwards your existing subscription credential and applies the capability allow-list. The offline proof is more revealing: `./fak agent --offline` runs with no key, model, or GPU, and the expected result is `task completed (booked)` while a poisoned result and a destructive operation are blocked. That suggests fak ships with a built-in test scenario that verifies the allow-list actually blocks bad tool calls. The README does not detail how the verdict is recorded, but it mentions receipts and a capability map in docs/CAPABILITIES.md. The design is clearly about auditability: every tool admission goes through the floor and the verdict is logged.

Model Routing Without Silent Fallback

fak routes each task to a configured provider or its own native engine, and the README is explicit that it never silently falls back to llama.cpp. That is a deliberate boundary: llama.cpp remains a benchmark and diagnostic reference, not a runtime fallback. The native engine is described as the product and performance path. The routing guarantees that if you configure a provider, fak will not quietly switch to a local model when the provider fails. This is a meaningful difference from many agent tools that default to a local model when API calls fail. The trade-off is that you must configure routing carefully; a misconfigured task may fail rather than degrade gracefully. The README points to docs/native-inference-goal.md for the full contract, but the repo does not expose the exact routing logic in the provided material.

Installation and Configuration Commands

Installation is straightforward. The README gives a curl pipe to sh for macOS and Linux, or `go install github.com/anthony-chaudhary/fak/cmd/fak@latest` if you have Go 1.26 or later. After install, `fak agent profiles` lists the shipped profiles. The configuration uses two named profiles: Ponytail controls how strongly the agent resists avoidable machinery, and Caveman controls how compactly it reports. The example command is `fak manage --output-profile caveman:medium --work-profile ponytail:high -- codex "Remove the duplicate cache without adding a dependency."` The balanced defaults are both at medium. This is a real configuration surface, not just a flag dump. The profiles let you tune verbosity and restraint per session, which is useful for teams that want consistent output style.

Hardware Performance Evidence and Its Boundaries

The README includes a hardware results table with explicit caveats. On Mac, Qwen3.8-27B Q4_K_M on an M3 Pro showed 2.3 to 2.9 decode tok/s and 3.2 to 8.4 full-prefill tok/s, but the row is marked historical because its review window ended without a comparable replacement. On AMD, an RX 7600 microbench reached 1.15 to 1.24 decode tok/s versus 0.99 for llama.cpp Vulkan, but that is a narrow microbench, not a full-model parity claim. On NVIDIA, native CUDA produced 5/5 exact outputs at 11.8 to 12.1 decode tok/s, but confirmed cache hits produced 0/5 exact at about 0.2 tok/s, and that failure excludes any parity claim. The project is unusually honest about its evidence boundaries. The takeaway: performance claims are heavily scoped, and you cannot assume your hardware will match. The README directs you to docs/benchmarks/README.md for the full history.

Limitations and When It Is the Wrong Tool

The most obvious limitation is the NVIDIA cache-hit failure, which the project itself holds as a failed quality gate. If you rely on caching for speed, fak may not deliver correct outputs in that mode. Another limitation is that fak is not a standalone agent UI; it wraps existing sessions. If you want a fresh agent with its own interface, this is not it. The README also does not describe how to handle multi-agent orchestration or complex workflows beyond a single wrapped session. The default-deny policy could be a problem if your workflow uses many tools that are not in the allow-list; you will have to configure each one. The project does not mention any auto-discovery of tools, so expect manual configuration. For a quick prototype where you just want an agent to run with minimal setup, fak adds a layer of friction.

Alternative Approaches and the Difference

A direct alternative is running Codex or Claude Code without a wrapper, using their built-in permission prompts. The difference is that those tools typically ask the user for permission per tool call, which is interactive and can be fatiguing, and they may allow silent model fallback depending on configuration. fak replaces that interactive prompt with a preconfigured allow-list and a recorded verdict. Another alternative is using a local inference server like llama.cpp directly, but that gives you no tool policy layer at all. fak's approach is to separate the policy from the model, so you can keep your existing provider subscription and still enforce a boundary. The README explicitly positions llama.cpp as a reference, not a fallback, so if you want a pure local runtime without a policy wrapper, llama.cpp is the simpler path.

Maintenance, Licensing, and Upgrade Considerations

The project is under Apache-2.0, which permits commercial use and modification with attribution, though this is not legal advice. The repository is active, with a recent release v0.44.0 in August 2026 and a last push the same day. The release notes mention easier adoption, safer long-running agents, and stronger proof. There are also harness control study packets, which suggest the project is actively researching agent behavior. Maintenance cost is a real factor: the README includes a freshness audit script and a doc appeal scorecard, indicating a process for keeping documentation current. However, the hardware evidence is already marked historical in some cases, so you must check the benchmark index before relying on any single result. Upgrading from one version to another may change profile defaults or the guard behavior, so read the release notes for v0.44.0 before adopting.

Editorial conclusion

Adopt fak if you run Codex or Claude Code sessions and need a hard capability boundary, explicit model routing without silent fallback, and a verifiable offline proof of enforcement. Skip it if you need a full agent framework with built-in UI or if you rely on llama.cpp as a fallback, since fak treats it only as a reference. Before adopting, verify the current performance receipts for your hardware, especially the NVIDIA cache-hit failure, and confirm that your provider subscription works with the guard command. Check the feature matrix in docs/supported/features.md to see if your required tools and models are supported.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes