Writ KYA Reproduce it
Launch · live sandbox

See it work. Then break it.

Writ is live in production. Below is the exact acceptance run, and the real commands to reproduce it — starting with one curl that needs nothing installed. Every command here was executed against the deployed services before it was written down.

Writ acceptance test run against production: principal onboards, mandate issued, $500 refill ALLOW with resolved chain and signed receipt, replay blocked, $2,000 DENY per_tx_cap, weekly cap DENY, mandate revoked DENY, anonymous 403 KYA required — 11 of 11 checks passed.
npm run demo against passport-production & northbank-production onboard → mandate → allow → replay-block → cap-deny → revoke → 403 · 11/11
Reproduce it yourself

Three steps. The first needs nothing installed.

The signed allow/deny path needs the agent SDK to sign Ed25519 assertions, so steps 2–3 use the repo. Step 1 works from any terminal, right now.

01

Poke the gate — zero install

The demo brokerage gates its refill endpoint on Writ. No passport on the request → the middleware fails closed and returns a structured 403 with an onboarding link. This is the block that turns rejected traffic into a lead.

terminalno install
curl -i -X POST https://northbank-production.up.railway.app/api/refill \
  -d '{"amount_minor":50000}'

# → HTTP/2 403
# {"error":"KYA required","reason":"missing_passport",
#  "onboarding_url":"https://passport-production-f136.up.railway.app/onboarding"}

Also live & GET-able: /v1/health · /v1/issuer/jwks (verify receipts against this key) · /api/account

02

Run the full loop against production

One command runs the entire storyline headlessly against the deployed services — it's the acceptance test, and it exits non-zero if anything fails.

terminalagainst prod
git clone https://github.com/Zilula/writ # repo publishing — see note
cd writ && npm install

PASSPORT_URL=https://passport-production-f136.up.railway.app \
NORTHBANK_URL=https://northbank-production.up.railway.app \
npm run demo
# → Result: 11 passed of 11

Self-contained: it creates its own principal, agent and mandate each run.

03

Drive it by hand, locally

Boot both services and step through the chain — onboard a principal, issue a $2,500/week mandate, present signed refills, watch allow → cap-deny → revoke. Full walkthrough in the quickstart.

terminallocal
npm run dev                         # passport :3000 + Northbank :3100
export PASSPORT_AGENT_HOME="$PWD/.passport-agent"
npm run seed                        # principal + agent + mandate
npm run cli -w @passport/agent -- refill --amount 500    # ALLOW
npm run cli -w @passport/agent -- refill --amount 2000   # DENY per_tx_cap

Full quickstart → · then load the decision log at /platform with key plt_sk_northbank_dev.

Note: the public repository at github.com/Zilula/writ is being published; if the clone isn't live yet, step 1 still works with nothing installed. The one-command npx demo returns once the @writ package is on npm.

What's live

Four surfaces you can hit right now.

Demo brokerage
Northbank Sandbox — /api/refill gated by requireKYA
northbank-production.up.railway.app
 Passport · verify API
Health, issuer JWKS, verify + countersign
passport-production-f136.up.railway.app
 Decision log
Immutable, co-signed records + audit export
…/platform · key plt_sk_northbank_dev
 Onboarding
The 403 block-page → get a passport
…/onboarding
Records, not rails

What Writ is not.

The category has a hard boundary, and it's the point. Writ attests who is behind an action — it never touches the value.

Not a payment rail

It doesn't move money. It sits alongside x402 / AP2 / agentic checkout — the identity layer any rail can call.

Not custody

No wallet, no funds held or routed. No money transmission. KYC runs through licensed vendors behind a pluggable interface.

Not a token

Nothing to buy, mint, or hold. Writ sells decisions and audit-grade records — the evidence, not the value.

Design partners

Break the model, or run it on your platform.

Two weeks old, solo-built, pre-revenue — and looking for a few design partners: usage-billed platforms whose customers' agents already try to spend and get treated as fraud. Poke the sandbox, read the source, and tell me where it breaks first.

Read the source Run the quickstart