What is h5i?
h5i (pronounced high-five) is an open-source auditable workspace layer for AI coding agents. It runs Claude Code, Codex, and other agents in isolated Git workspaces and records the prompt, model, agent, reasoning, commands, logs, sandbox policy, reviews, and verifier results behind every change, then lets teams merge one evidence-backed result. Technically, h5i stores this evidence as Git-native sidecar refs under refs/h5i/*, so it travels with your repo with no hosted control plane.
How does h5i run an agent team?
h5i team runs several agents on the same task, each in its own isolated h5i env, through a phased protocol: create a roster of personas (runtime, model, role) → dispatch the task to all → each agent works sealed and independently → freeze immutable submissions → permissioned review → a neutral sandboxed verify → apply one winner. Run state is an append-only event log in refs/h5i/team that travels with the repo. It's a thin coordination layer, not a group chat, not a daemon.
How is the winning patch chosen?
By a neutral verifier, not by the agents. h5i team verify replays each frozen candidate at the shared base in a fresh, sandboxed worktree and runs the declared command itself, so finalization never trusts an agent's own captures. Hard gates (tests pass, applies cleanly) come only from that run; smallest-diff breaks ties only among gate-passers, so nothing wins by deleting tests or stubbing features. The verdict is explainable, apply is gated, and if nothing clears the gates it records no_verdict instead of merging a loser.
Does h5i work with Claude Code and Codex?
Yes. h5i is built for teams where AI agents write code alongside humans. Claude Code integrates via hooks and MCP; Codex uses explicit prelude, sync, and finish commands. Both agents restore the same shared context when a session starts and check their work back in when it ends.
How is h5i different from plain Git?
Git versions code. h5i versions the workspace around it, the sandboxed worktree the agent ran in, the prompt and model behind each commit, the compressed command logs, the cross-agent handoffs, and the audit signals, stored in dedicated refs/h5i/* refs that travel with the repo without touching your commit history.
Who is h5i for?
The first adopters are platform, security, and DevEx leads at engineering orgs rolling out Claude Code and Codex: the people who have to keep PR review and audit defensible while agents write a growing share of production diffs. h5i is the audit trail for AI coding sessions: every change carries who/which-model authored it, how well it was prompted, what commands ran, whether tests passed, and what risks were flagged, all versioned in your own Git repo, shareable with push/pull, no SaaS. It makes agent work reproducible, reviewable, and accountable without adding a new system of record.
Can h5i reduce AI token costs?
Yes. h5i keeps raw tool output out of the agent's context with content-addressed capture and snapshots agent memory, so the next session skips re-grounding. In a reproducible benchmark, capture cut tool-output tokens by ~95% with full task fidelity.
Is h5i free and open source?
Yes. h5i is free and open source under the Apache 2.0 license, with no lock-in. It is written in Rust and runs on Linux, macOS, and Windows.
Can h5i detect prompt injection in AI-generated code?
h5i audit scan applies deterministic regex rules to every OBSERVE/THINK/ACT entry in an agent's reasoning trace to flag prompt-injection signals, with no model in the audit path, and can rank which commits most need human review.
Can h5i sandbox an AI agent's commands?
Yes. h5i env gives an agent a disposable, confined environment, a git worktree plus a policy that limits what code can read, write, and reach over the network. It picks the strongest isolation the host can enforce (Landlock + seccomp + namespaces, up to a rootless network egress allowlist), records every command and blocked access, and nothing reaches your branch until you apply. No root and no VM required.
