ActraDeck

ActraDeck is a local-first audit cockpit for AI coding agents. It sits beside Claude Code and Codex and gives you one place to watch what they do, redact detected secrets before anything is stored, gate high-risk approvals, and replay a cross-vendor audit trail. A sidecar runs on your machine, normalizes each agent's events into one model, and serves a web cockpit you control — no Docker, embedded Postgres.

Why it exists: vendors build great dashboards for their own agent. ActraDeck owns the slice a model vendor won't build — neutral governance across competing agents. Secrets are redacted before they hit disk (an invariant, not a flag), approvals are gated by a structural risk classifier, and every session is replayable, with reports that carry a SHA-256 integrity manifest and optional Ed25519 signing for tamper-evidence.

How it came together: ActraDeck was built with Claude Code as the primary implementation and audit engine, under human review. High-risk changes are reviewed by independent subagents that don't implement them — separate security, test/QA, and tech-debt passes — and every merge is gated on their findings. One recent focus was making "done" mean "verified against the current code": ActraDeck folds an agent's own task and plan events and checks them against a tree fingerprint, so a self-reported "passed" auto-degrades to stale when the code moves under it. Apache-2.0, TypeScript throughout — a Next.js/React cockpit, a sidecar with an append-only SQLite log, and embedded Postgres (PGlite).