Quickstart

From clone to gated in a few minutes

Install the daemon, wire it into your harness, and start in shadow mode. Flip to enforce when the log looks right.

Prerequisites

▸Python 3.12, uv, and curl
▸A harness that supports hooks — Kiro verified; Claude Code and Codex built
▸For the audit store: an AWS account with credentials (us-east-1 default)

Install

Clone the repo, create a virtual environment, and run the test suite to confirm everything works.

setup

git clone https://github.com/interlockd/interlock.git && cd interlock/daemon
uv venv --python 3.12 && uv pip install -e ".[dev]" --python .venv/bin/python
.venv/bin/pytest                                   # ~10 s, 310 tests

Install the hook for your harness:

install hooks

# Kiro
.venv/bin/interlock install --kiro --workspace-root /path/to/folder

# Claude Code
.venv/bin/interlock install --claude-code --project /path/to/repo

# Codex
.venv/bin/interlock install --codex --project /path/to/repo

Start the daemon and watch decisions stream in:

run

.venv/bin/interlock serve
.venv/bin/interlock health
.venv/bin/interlock log -n 20 --follow

CLI Reference

interlock serve [--mode shadow|enforce]Run the daemon.

interlock install --kiro|--claude-code|--codexInstall harness hooks.

interlock log [-n N] [-f]Tail decisions.

interlock healthPing the daemon.

interlock tokenPrint the token path.

interlock testRun the policy against the corpus.

Configuration

A minimal config points Interlock at your workspace and your audit table.

interlock.config.json

json

{
  "workspace_roots": ["/path/to/project"],
  "dynamodb_table": "interlock-audit",
  "aws_region": "us-east-1",
  "aws_profile": "your-profile"
}

Policy

Policy is layered YAML (defaults → user → workspace), validated and hashed onto every verdict. Start in shadow mode.

policy.yaml

yaml

version: 1
mode: shadow
trust:
  workspace_roots: ["/path/to/project"]
  allowed_git_remotes: ["github.com/my-org/*"]
  protected_branches: ["main", "master", "release/*"]
packs:
  enabled: [shell, git, egress, persistence, secrets, packages]
mandate:
  mode: log_only
  cedar: mandate.cedar

Mandate (Cedar)

The mandate is an authorization envelope in Cedar — the same language as Amazon Bedrock AgentCore Policy. Permit what's in scope, forbid what never is.

mandate.cedar

cedar

permit (principal, action == Interlock::Action::"git.push", resource)
when { context.input.remote like "github.com/my-org/*" };

forbid (principal, action == Interlock::Action::"git.push", resource)
when { context.input.force == true && context.input.branch == "main" };

forbid (principal, action == Interlock::Action::"sys.privilege", resource);

Looking for the deeper model — the 13-step decision pipeline, the latency budget, and the threat model? Read How It Decides →