autofusion freezes the work, sends it to model reviewers that cannot see each other, runs the checks the repository already trusts, and keeps every unresolved disagreement in the record. It makes important AI-assisted work easier to challenge and verify before people rely on it.
Version 0.6.0, September 2026. Python 3.11 and later, a Claude Code plugin, MIT.
Researchers, engineers, and heavy agent users who work intensely with AI. If a model drafts your migrations, your analyses, your manuscripts or your release notes, you already know the failure mode: the draft is fluent, the review is you, and you are tired.
Fusion is an escalation, not a default. Keep one model for routine work. Run fusion on the decisions that matter, where a missed issue would be costly or difficult to reverse: a schema migration, a security-relevant change, a claim that will be cited, a release that cannot be rolled back quietly.
The recommendation for people who work intensely with AI is simple. Do not add reviewers to everything. Pick the decisions where being wrong is expensive, and put those through independent review with executed checks.
The active Claude Code session, called self, produces the artifact: a diff, a plan, an answer, a release, a section of a manuscript.
The runtime takes an immutable snapshot and compiles one hash-addressed packet. Credential-shaped text is redacted, or blocks dispatch, before anything leaves the machine.
Every participant passes the same role, model, provider, callable, compound and context-fit checks. The packet must fit the smallest participant, with prompt overhead and reserved output counted. Rejected cases invoke no provider.
External reviewers examine the same packet with no channel between them. A compound provider whose hidden workers cannot be observed counts as one vote, however many workers it claims.
Checkable findings run through verification commands the repository declared and you approved before review. Reviewer text is never executed. A finding an executed check confirms outranks one two models merely agree on.
self reconciles findings against evidence. An unresolved blocker or major finding may receive one challenge and one rebuttal; debate is bounded and never becomes a topology of its own.
A metadata-only receipt links packet, calls, grounding, analysis and decision through hashes. A ship receipt is valid only when the linked analysis has no blocker or major finding left.
self is a sentinel, not a transport. No Python path invokes the active session, and the session's own model may never appear as a reviewer, judge or delegate. The rule is enforced at configuration load, at admission and at the HTTP boundary, and each enforcement has a test that fails when it is removed.
Every capability claim below says which of four things it is: implemented and unit-tested, measured live on a date, supported but not verified here, or planned. Dated transport measurements are published separately from any claim about decision quality, and no accuracy percentage or model ranking appears on this page because none was measured.
| Claim | Status | Where the evidence lives |
|---|---|---|
self is non-callable; Fable 5.1 is admitted only as self | unit-tested | tests/test_identity_migration.py, mutation note in CHANGELOG |
| Uniform admission for panel, advisor and direct calls | unit-tested | tests/test_admission.py |
| Routing minimums checked against the actual panel, not its label | unit-tested | tests/test_routing_aliases.py |
| Guardrails tighten by local configuration, never relax | unit-tested | tests/test_config_policy.py |
| One execution deadline across dispatch, queue and grounding | unit-tested | tests/test_request_deadlines.py |
| Context fit against the smallest participant | unit-tested | tests/test_context_fit.py |
| Coverage gaps and abstention survive into the receipt | unit-tested | tests/test_analysis_coverage.py |
| Proof capsules bind to the reviewed revision and survive retries | unit-tested | tests/test_proof_binding.py |
| Complete credential structures never reach a provider | unit-tested | tests/test_dlp_structures.py |
Codex CLI route, gpt-5.6-sol at xhigh and ultra | live, July 2026 | docs/provider-verification.md |
Codex CLI route, gpt-6-astra at ultra | live, 8 Sep 2026 | configured-route identity only; docs/provider-astra-smoke-20260908.json |
Claude CLI route, claude-opus-5 | unit-tested | July 2026 live measurement was Opus 4.8; the current contract has no live smoke yet |
Antigravity agy headless transport | ships disabled | live smoke returned no terminal identity; tests/test_agy.py |
| ACP transport for Grok | ships disabled | live smoke did not finish initialization; tests/test_acp.py |
| Session delegates and a Workflow topology inside Claude Code | planned | docs/roadmap.md, 0.6.x |
| Cross-model review beats same-model self-review on real decisions | not measured | requires the comparative evaluation program in the roadmap |
A test the author wrote and then passed proves less than it looks. So each repair in the repository carries a mutation note: the repair was reverted once with the test kept, the whole suite was run, and the test that failed is named in the changelog. A repair whose reversal fails nothing is not counted as measured.
Synthetic example. The shape below is what a real run produces; the finding texts are illustrative and the hashes are invented. Real receipts carry hashes and metadata only, never prompts or model output.
The retry path re-sends tool results that were already delivered after a context compaction, so the upstream rejects the request.
verify:pytest, approved argv, executed on headA says the byte-based token estimate overstates input and will reject valid packets. B says the estimate is conservative by design and the rejection is correct behaviour.
A helper name no longer describes what the function does after the change.
{
"kind": "revise",
"fused": false,
"packet_hash": "sha256:7c1e…b9a4",
"participants": [
{"handle": "astra-ultra", "configured_model": "gpt-6-astra",
"observed_model": null, "identity_evidence": "configured-route"},
{"handle": "claude-opus", "configured_model": "claude-opus-5",
"observed_model": "claude-opus-5", "identity_evidence": "usage"}
],
"findings": {"confirmed": 1, "unresolved": 1, "advisory": 1},
"grounding": [{"id": "verify:pytest", "outcome": "failed", "trust": "repository"}]
}/plugin marketplace add OnourImpram/autofusion
/plugin install autofusion@autofusion
/autofusion:fusion diff --preset balanced
/autofusion:fusion plan --topology adversarial-review --reviewers astra-ultra,claude-opus
/autofusion:fusion release --pack release --preset adaptiveThe plugin is skill-first. Installing it grants no credentials and no live route; a fusion succeeds only when the helper CLI and your configured transports pass autofusion doctor. When the helper is missing, the skills say the run is manual and claim nothing about transports, grounding or receipts.
git clone https://github.com/OnourImpram/autofusion.git
cd autofusion
python -m pip install -e ".[dev]"
autofusion doctor
autofusion config-validate --config .fusion.example.jsonOr install the versioned wheel from the GitHub release page after checking its published SHA-256.
Start from .fusion.example.json. Declare the verification commands you trust as argv arrays; those are the only commands grounding may run. Repository and invocation layers can lower a cost cap or strengthen redaction, and cannot do the reverse.