You can't trust a black box to govern your black box. Deadlatch is three open primitives you can read, run, and verify yourself. Adopt one on its own, or run all three around every action an agent takes.
The stack
| Package | Install | What it does |
|---|
| enforce | Purse | npm i @olurabian/purse | Checks each spend or tool call against live policy at the moment it fires. A hijacked agent still can't move money outside the rules. |
| prove | blackbox | npm i @olurabian/blackbox | Writes every decision to a hash-chained log. Edit one record and the chain breaks. verify() names the record that was touched. |
| watch | Tripwire | npm i @olurabian/tripwire | Read-only scan that runs an agent against your rules and adversarial inputs, then flags every action that completed but broke one. |
Every package is zero-dependency, typed, and MIT licensed. The audit chain checks out with plain SHA-256, on your machine, without Deadlatch in the loop.
This repo
The site behind deadlatch.dev. Next.js (App Router), deployed on Vercel. The homepage runs a live in-browser demo backed by a real policy engine and a genuine SHA-256 hash chain, no mockups.
npm install
npm run dev
Watch
The hosted side of the Deadlatch monitor lives under /app. See docs/watch.md for what it holds, what the API accepts, and the six environment variables it needs. The public pages need none of them.
Links
