ali-ulu/huqan

**A local trust boundary that separates the agent from the operator.**
Most tools make agents stronger.
With the Approval Authority installed, HUQAN puts an OS boundary between the agent and the power to approve.
Agents can now write code, delete files, spend money, and change memory.
Without a proper trust layer, that power runs as the same user as you.
On Windows, the Approval Authority moves approval into a separate service protected by TOTP and cryptographic decision envelopes.
The decision is held by that service's own account, not by your user: an agent running as you cannot sign an approval, though it may still share your user identity with the operator.
Every decision is recorded as a Trust Receipt.
No model. No cloud. No API key required for the core gate.
Try it in 30 seconds
The write in line 1 **did not happen**. It was held until line 2 approved it. The quickstart uses a throwaway store.
No install needed: the same flow runs in the browser at huqan.com. What to run when: product surfaces.
Connect your agent in one line
**MCP (Claude, Cursor, any MCP client):**
**Gate (pre-execution guard for other agents):**
Profiles: claude-code, codex, openhands, opencode, pi, hermes. The gate enforces only when the client calls it before executing. Details.
Operator tools (huqan.approve, huqan.approvals, huqan.approval_detail, huqan.agent_resume, huqan.emergency_stop) are hidden from the model and require HUQAN_MCP_OPERATOR_TOKEN — an agent cannot approve its own proposal.
Install
Seven binaries: huqan (CLI), huqan-mcp (MCP server), huqan-gate (pre-execution guard), huqan-authority (approval authority, ADR-016), plus the experiment CLIs huqan-cognitive-lab, huqan-causal-lab and huqan-neural-lab.
Run huqan doctor to see what is configured.
How it works
The outcome is one of:
ALLOW / REVIEW / QUARANTINE / DRY-RUN ONLY / BLOCK / REJECT
**Escalation is a decision a person makes, not one the gate returns.** A reviewer can move a pending case to escalated; that needs a second approver, so it is absent in a single-user install. Decision types: approve, reject, expire, cancel, escalate, override — see lib/human-oversight-approval-runtime.js.
A passing verification is a result inside one configured boundary, not a certificate of truth. The receipt names the boundary.
When the Approval Authority is installed, the decision itself moves behind an OS boundary (Windows service + TOTP + cryptographic envelopes). See ADR-016.
Limits (honest)
- HUQAN does **not** eliminate hallucinations. It makes one claim **inspectable and blockable** before it becomes state.
- Only what is wired is governed. An agent that never calls HUQAN is not covered.
- The OS boundary needs the Approval Authority (a Windows service today). Code running as your user can still edit runtime files or the local store; the authority's ledger makes that detectable, not impossible. UAC is not a security boundary (ADR-016 residual risks).