waybroker

The client SDK is open source under Apache-2.0. The broker core is source-available under BUSL-1.1 and becomes Apache-2.0 on 2030-08-30. The whole repository is therefore not open source before that date.

A governed LLM access broker for your machine. One daemon owns every LLM call: which process may talk to which provider, under what token budget, with API keys the calling apps never see, and a tamper-evident audit chain proving what happened.

Lineage. waybroker is extracted from the userland of an unreleased, from-scratch operating system where AI access is a governed system service — brokered, policy-gated, metered, and audit-chained at the OS level. This is that broker, matured and ported to Linux and Windows. The OS ships later; this runs today.

Why

Every tool on a modern dev machine wants an LLM. Today each one holds its own API key, talks to whatever endpoint it likes, and leaves no trace. waybroker inverts that:

• One choke point. Apps talk to a local socket/pipe; the broker talks to providers. Keys live in one sealed ring, not in a dozen dotfiles and env vars.
• Policy, not hope. Default-deny rules keyed on OS-attested process identity (executable path + uid): which apps, which providers, what per-request cap, what daily budget.
• Egress default-deny. A provider config with no allowed_hosts cannot open a connection. Redirects are disabled so 3xx can't re-aim traffic.
• Receipts. Every invoke, denial, and admin action lands in a SHA-256 hash-chained audit log. waybroker audit verify walks the chain offline and pinpoints the first edited or deleted record. Records carry content fingerprints, never content.
• Vendor-neutral by construction. The daemon contains zero vendor names. A provider is a small config file: endpoint, request template, JSON response path. Anthropic, OpenAI-compatible servers, and local Ollama examples ship in configs/.

Quick start (Linux)

make && make test          # needs gcc, make, libcurl-dev, libssl-dev

# 1. run the daemon (per-user mode)
./build/posix/waybrokerd &

# 2. allow yourself something (default is deny-everything)
mkdir -p ~/.config/waybroker/policy.d
cat > ~/.config/waybroker/policy.d/50-me.conf <<EOF
exe = /usr/bin/x*
uid = $(id -u)
providers = ollama
daily_tokens = 500000
EOF

# 3. add a provider + reload
cp configs/providers.d/ollama.conf.example \
   ~/.config/waybroker/providers.d/ollama.conf
./build/posix/waybroker reload

# 4. go
./build/posix/waybroker invoke "why is the sky blue?"
./build/posix/waybroker audit verify

Worked example: docs/USECASE.md — an ai-commit tool that drafts commit messages from staged diffs while the broker guarantees it holds no key, reaches only the local model, stays inside a daily budget, and leaves a verifiable audit trail (executed for real; re-runnable via test/usecase_ai_commit.sh).

Hosted APIs are one config + one key away:

cp configs/providers.d/anthropic.conf.example \
   ~/.config/waybroker/providers.d/anthropic.conf
./build/posix/waybroker key set anthropic     # paste key; sealed at rest
./build/posix/waybroker reload
./build/posix/waybroker invoke -p anthropic "hello"

Windows: make WIN=1 cross-compiles waybrokerd.exe / by waybroker.exe (mingw-w64); the endpoint is \\.\pipe\waybroker, keys seal via DPAPI. Same configs, same CLI, \-style exe globs in policy rules.

Status — what works, what doesn't

Works today, covered by four test layers (98 unit checks, a 37-step offline integration suite, and two real end-to-end suites that run the broker against live inference servers with real models — Ollama on Windows, an OpenAI-compatible llama-server on Linux, with real token counters and real egress/policy denials). See docs/TESTING.md for how to run each layer and what it proves.

• daemon + CLI on Linux (sockets/SO_PEERCRED) and Windows (named pipes/client-PID attestation)
• config-driven HTTP+JSON providers with egress allow-lists, usage extraction, cost accounting
• policy engine, daily budgets, sealed keyring, hash-chained audit log with offline verification

Not yet (deliberately, v0.1):

• no streaming responses (one frame per invoke)
• no prompt inspection/redaction stage
• no embeddings verb
• macOS: expected to build with the POSIX layer, untested
• no external security audit — see docs/SECURITY.md, including the honest limits of a userland audit chain

Layout

include/waybroker/             public protocol + C client headers
src/common/                    sha256, json extractor, ini, audit chain, framing
src/daemon/                    broker core, policy, quota, keyring, providers
src/platform/posix, win/       sockets/pipes, curl/WinHTTP, GCM/DPAPI
src/cli, src/client/           CLI + Apache-only reference client library
configs/                       provider + policy examples, systemd unit
test/                          unit, integration, and real-model suites
docs/                          PROTOCOL.md, SECURITY.md, TESTING.md

License

This is a mixed-license repository. Embedded SPDX identifiers and REUSE.toml define the exact boundary; the complete explanation is in LICENSING.md.

• Core (daemon, CLI, policy/quota/keyring/audit, platform): Business Source License 1.1. Non-production use and the limited production uses in LICENSE are free. Other production use needs a separate commercial license until the fixed Change Date, 2030-08-30.
• SDK and integration surface (public headers, frame codec, client transports, portable utility/JSON helpers, protocol spec, and examples): Apache-2.0. make sdk produces an Apache-only library; applications using only that SDK receive no BUSL code.

BUSL permits redistribution and restricts production use; it does not promise payment for every form of resale or support. The Apache SDK may be used commercially under Apache-2.0. See COMMERCIAL-LICENSING.md for the commercial-production route.

External code contributions are currently accepted only for the Apache-2.0 surface and require DCO 1.1 sign-off. The BUSL core does not accept outside code, and no CLA is currently required. See CONTRIBUTING.md and DCO. Binary-linked dependencies are inventoried in THIRD-PARTY-NOTICES.md.