Deadlatch

You can't trust a black box to govern your black box. Deadlatch is three open primitives you can read, run, and verify yourself. Adopt one on its own, or run all three around every action an agent takes.

The stack

	Package	Install	What it does
enforce	Purse	npm i @olurabian/purse	Checks each spend or tool call against live policy at the moment it fires. A hijacked agent still can't move money outside the rules.
prove	blackbox	npm i @olurabian/blackbox	Writes every decision to a hash-chained log. Edit one record and the chain breaks. verify() names the record that was touched.
watch	Tripwire	npm i @olurabian/tripwire	Read-only scan that runs an agent against your rules and adversarial inputs, then flags every action that completed but broke one.

Every package is zero-dependency, typed, and MIT licensed. The audit chain checks out with plain SHA-256, on your machine, without Deadlatch in the loop.

This repo

The site behind deadlatch.dev. Next.js (App Router), deployed on Vercel. The homepage runs a live in-browser demo backed by a real policy engine and a genuine SHA-256 hash chain, no mockups.

npm install
npm run dev

Watch

The hosted side of the Deadlatch monitor lives under /app. See docs/watch.md for what it holds, what the API accepts, and the six environment variables it needs. The public pages need none of them.

Links

• Live site, https://deadlatch.dev
• Purse (enforce), https://github.com/ArabianAnalyst/purse
• blackbox (prove), https://github.com/ArabianAnalyst/blackbox
• Tripwire (watch), https://github.com/ArabianAnalyst/tripwire