Self-host NOCTRYS in ~10 minutes.

Quickstart

noctrys serve --policy policy.json   # the governor as an HTTP sidecar on :8787
                                     # (POST /v1/intercept, /events, /metrics)
noctrys serve --policy policy.json --store audit.jsonl
                                     # durable audit: chain verified on boot, spans restarts
npm test          # the full enforcement suite (142 tests)
npm run scenario  # identity → attack barrage → signed audit

Deploy

docker compose up                      # self-host on :8787 (Dockerfile + docker-compose included)
# or the Go binary:
cd go && go build -o noctrys .          # single static binary

Durable audit

--store <file> (or NOCTRYS_STORE_FILE) makes the tamper-evident log durable: every entry is appended to the JSONL file before the HTTP response returns, the whole chain is reloaded and verified on boot, and a store that fails verification refuses to start. Fail-closed, even against the governor’s own history.

Policy

Write a manifest (allowlist, spend caps, egress, approval gates, mandates) and point your agent at NOCTRYS. noctrys serve loads it from --policy, or set NOCTRYS_MANIFESTS_FILE to load it without editing code. Full field reference in the pilot install guide.