How narendrakumarnutalapati/licitra-execution-gateway works
LICITRA is an execution gateway that mediates AI-agent actions: it scans intent, evaluates policy, issues a signed ticket, verifies the attempted action, and records the decision with tamper-evident audit evidence. The React dashboard exposes audit, integrity, OWASP metrics, proof verification, evidence, and attack demos. The README documents the complete workflow; sampled source confirms key package behavior and API routes, but omitted API sections limit certainty about some internal call wiring.
Main entry points: main.py Gateway API · pages Dashboard pages · intent.py Intent scan · verifier.py Action verification
Components 16
Execution gateway
- Gateway API
apps/api/main.py
Authorization controls
- Intent scan
packages/intent/intent.py - Injection patterns
packages/intent/patterns.py - Policy evaluation
packages/policy/policy.py - Signed tickets
packages/tickets/tickets.py - Action verification
packages/verifier/verifier.py
Audit and evidence
- Audit chain
packages/audit_chain/audit_chain.py - MMR ledger
packages/mmr/mmr.py - Evidence records
packages/evidence/evidence.py
Persistent state
- PostgreSQL
apps/api/models.py - DB sessions
apps/api/database.py
Operator dashboard
- Dashboard pages
apps/web/src/pages - Web API client
apps/web/src/api.js - Attack demos
apps/demo-agent
Other components
- AI agent
- Operator
Connections 18
- AI agent → Gateway API: submits action
- Gateway API → Intent scan: creates scanned intent
- Intent scan → Injection patterns: checks patterns
- Gateway API → Policy evaluation: evaluates policy
- Gateway API → Signed tickets: issues ticket
- Gateway API → Action verification: verifies attempt
- Action verification → Signed tickets: checks signature and binding
- Gateway API → Audit chain: records decision
- Audit chain → MMR ledger: appends event
- Gateway API → Evidence records: generates evidence
- Gateway API → DB sessions: uses sessions
- DB sessions → PostgreSQL: reads and writes
- MMR ledger → PostgreSQL: stores leaves and peaks
- Operator → Dashboard pages: reviews controls
- Dashboard pages → Web API client: requests data
- Web API client → Gateway API: calls endpoints
- Dashboard pages → Gateway API: runs browser demos
- Attack demos → Gateway API: exercises attacks