I build black boxes for systems nobody can fully trust — right now, that means AI agents.
The exploit lives in the gap between what your AI reads and what it's allowed to do. The cover-up lives in the gap between what it did and what its logs say. I build for the second gap.
Two products. Both do one thing. Both ship receipts.
An agent does something it shouldn't. Three weeks later, someone asks "what exactly did it do?" — and the only witness is a log written by the suspect. NoireBox is a hash-chained, Ed25519-signed journal of agent decisions, anchored by third-party RFC 3161 timestamps — one TSA seal covers a whole fleet. Exports are attestations anyone can verify: tamper with the journal and verification explodes. On purpose. MCP server, plugins, API and dashboard included.
The honesty bit: tamper-evidence is not truth-at-write. NoireBox proves records weren't altered — it can't vouch that a record was accurate when sealed. That boundary is written down in the threat model, on purpose. |
Your agent needs a browser. Playwright ships 218 MB of Chromium; Navette is one 626 KB Rust binary driving the WebView your OS already ships — no Chromium, no download, no RAM bonfire. 18 MCP tools: navigate, read, click, type, screenshot — with native input on all three engines and session isolation CI-enforced.
Measured, not vibed: BENCHMARKS.md — faster than Playwright + Chromium on every metric measured, reproducible with one command. The walled-web Tollbooth bench (200 URLs × 5 categories) ships in bench/, dataset CC BY 4.0. |
- tinyjsapp-studio — desktop companion for tinyjs: create tinyjs apps and wrap any website into a real ~6 MB native desktop app — no terminal, menu-bar apps included. Built with tinyjs itself, so
src/doubles as the tutorial. v0.1.1 is out, installers for all three platforms · site. - zerojour — security-advisories agent built for the DEV × Sanity Challenge: head-to-head model duels on structured content, scored eval runs. Every demo frame is a real capture.
- pluginforge — quality-first factory for e-commerce payment plugins: one spec, one conformance suite, AI-agent generation under strict gates.
- mineral-starter-kit — batteries-included starter for the Mineral Dart framework.
Python · Rust · TypeScript · JavaScript · Dart · a long PHP past (Laravel, Symfony — I don't flinch at legacy anymore). Solo, from the Vosges mountains 🇫🇷.
slabb.dev · DEV · X · ☕ buymeacoffee.com/samlabbe
Every claim on this page ships with receipts.