ULTRON runs on your machine, not someone else's cloud. It reads, plans, and proposes — but every trade, deploy, file write, and API call waits for a single human keystroke: Y or N.
Two tiers. One gate. An immutable hash-chained audit log behind every decision.
The planner turns your natural-language goal into a DAG of tool calls. Nothing runs yet.
Filesystem reads, web search, code-index queries, market quotes, Drive search — all run in-process with no approval.
Every write, trade, deploy, or mutating API call pauses and emits a typed Proposal — intent, exact command, rollback plan, risk 1–5.
Approve from CLI, HUD, or API. The gate re-checks the kill switch, runs the tool, and hashes the result into the audit chain.
This is the real HUD, running in demo mode with three queued proposals across risk levels. Click APPROVE or DENY to see the gate in action.
Demo mode seeds fake proposals — no real tools fire. For the live daemon, install the repo and run python3 -m core.api.
ULTRON will never do any of these without an explicit APPROVE. Breaking one requires breaking the gate and the hash-chained audit log at the same time, and the kill switch still refuses to clear without its signed token.
file_write and git push passes through the gate with a rollback plan.ConsentScope. Out-of-scope reads are refused at the memory layer.Local-first means the engine itself is free forever. Paid plans add hosted integrations, team collaboration, and managed cloud fallbacks.
Drop your email. We'll send a signed trial token for the hosted Pro daemon. No card until day 14.
Stored locally until a hosted form is wired. No data leaves your browser in this preview.