# AIRLOCK

> Provenance-gated signing for AI agent wallets on NEAR: a policy contract builds each transaction and asks the MPC signer for a signature when the owner's limits allow it or the owner approves the exact stored request.

This site is a static copy with no server: the overview, a playground where the verdict crate of the NEAR contract, compiled to WebAssembly, decides on a scam email in the browser, a replay of recorded NEAR testnet runs, the bench results and the proofs. Every page is prerendered, so its text is in the HTML.

## Pages

- [AIRLOCK: a payment gate for AI agents that checks where every value came from](https://airlock-ere.pages.dev/): AIRLOCK is provenance-gated signing for AI agent wallets on NEAR. A policy contract checks where the payee and the amount of every payment came from (the owner, the address book, or outside text such as an email) and holds what outside text decided.
- [Try to trick it](https://airlock-ere.pages.dev/try): Pick a scam email, or an attack on an agent you hired for a job, or write your own. A stand-in agent builds the payment, and the airlock-verdict code the NEAR contract runs, compiled to WebAssembly, decides in your browser whether the money moves.
- [The recorded testnet run](https://airlock-ere.pages.dev/replay): A replay of recorded NEAR testnet runs: an invoice paid, a correction from an email held for the owner, and a tampered approval refused by the contract, each with its transaction.
- [Bench results](https://airlock-ere.pages.dev/bench): The attack and benign bench of AIRLOCK: 250 attack runs and 140 benign runs per design, the unguarded agent, rebuilt caps and blocklist guards, strict mode A1 and default mode A2.
- [What is proven](https://airlock-ere.pages.dev/proven): What Kani and Lean prove about the AIRLOCK verdict, the bound of each proof, what each one does not cover, and the one command that rechecks them.
- [Steal this agent](https://airlock-ere.pages.dev/challenge): The Steal this agent challenge needs its service running, so this hosted copy lists the commands that run it on your machine.
- [Live demo](https://airlock-ere.pages.dev/live): A live run needs a runtime server, a model key and funded NEAR testnet accounts. This page lists the commands that run it from the repository.
- [Try it with an agent you hired](https://airlock-ere.pages.dev/try?s=hired): the Swarm-for-Hire scenario: the job budget is the task bound, the job's payees are the book, and the job post and every other agent's message are outside text

## Raw data

- [Full digest](https://airlock-ere.pages.dev/llms-full.txt): one plain-text file with the README summary, the bench numbers, the Try page's scenarios (your bills, an agent you hired) and their verdicts, the recorded acts and every testnet transaction link
- [bench.json](https://airlock-ere.pages.dev/bench.json): every bench table the Bench page shows, written by the same function that writes docs/BENCH.md
- [Recorded acts](https://airlock-ere.pages.dev/data/replay/acts.json): the three acts of the recorded testnet run with their transaction links
- [Trace of Act 1 Invoice paid](https://airlock-ere.pages.dev/data/runs/00000000000000000000000000000001.txt): the recorded event stream of that run, as the replay server sent it
- [Trace of Act 2 Correction held](https://airlock-ere.pages.dev/data/runs/00000000000000000000000000000002.txt): the recorded event stream of that run, as the replay server sent it
- [Tampered approval](https://airlock-ere.pages.dev/data/replay/tamper.json): the refused approval transaction and the contract's error
- [verdict.wasm](https://airlock-ere.pages.dev/verdict.wasm): the airlock-verdict crate built for wasm32-unknown-unknown; the repository's tests check it equals a fresh build and agrees with the Rust crate
- [Sitemap](https://airlock-ere.pages.dev/sitemap.xml)