Who we are
People who can't sleep. The lights go off, the brain doesn't, and an idea shows up instead. So the idea gets vibe coded until our eyelids finally give up.
Later, in daylight or close to it, we pick it back up and build on it as a hobby. Some of it grows. Some of it stays a weird little experiment. Both are fine.
What's been built so far
Two projects so far, and they don't have a lot in common except the hour they were dreamed up. One is about keeping AI agents on a leash, the other is about money made from electricity. That's where the 3 a.m. thoughts went, not a declared focus.
-
two-key
Most agent guardrails ask an AI to police an AI. This one makes the AI's say-so not enough on its own.
A small, open source take on AI agent security and authorization: two independent keys have to turn before an agent can act. One key is a policy engine with hard rules, the other is one or more LLM judges, and a single-use capability token only gets minted when both say yes. Every call lands in an encrypted audit ledger, and anything that goes wrong counts as a no. An MCP proxy puts the whole thing in front of an existing tool server, it can call the antivirus or DLP scanner you already run, and it can copy every decision to your SIEM. Judges see a summary of recent decisions, and two small windows let you browse the ledger and edit the constitution. It's on PyPI now (0.8.0). Think of it as a guardrail that sits between an agent and its tools, handy against prompt injection and agents that get a little too creative. It started life as two-key-concept and has moved into this repo, history and all. It\'s a beta, Apache-2.0, maintainer-reviewed but not independently audited, and it doesn\'t scan payloads itself.
agent authorization agent security agentic AI AI agents AI governance AI safety AI security audit log authorization capability tokens guardrails LLM LLM as a judge LLM security policy as code policy engine prompt injection Python
More about two-key → -
enerchain
Mining spends electricity to make a coin. This one flips it: the coin is a record of the electricity you delivered.
A research prototype for an electricity currency. A site gets two sealed meters, one at the solar array or generator and one where it connects to the grid. Each meter counts energy both ways and signs a record for every kilowatt-hour of net export, using post-quantum ML-DSA signatures. A battery that buys at night and sells at noon mints nothing. The repo has a Python devnet with wallet and ledger, chip RTL that simulates end to end, signer firmware, and a board design. It's all simulation and paperwork so far: nothing has been built or taped out. Apache-2.0 for the software and docs, CERN-OHL-S-2.0 for the hardware.
The counting isn't left to a program. In the design, a small dedicated chip counts the meter's pulses and builds each record in fixed logic, and nothing outside it can write to its counters. A separate secure chip holds the key and signs only what that counter chip hands it, running a small published firmware image. So no app, inverter, or server gets to pick the number.
And one meter isn't enough. Every site has two of them, each sealed, each with its own key: one at the generator says the power was made, and one at the grid connection says it left the site. Nothing gets credited unless both have signed, and then only up to the smaller of the two counts. A meter that's been fooled or tampered with can't mint more than its partner saw.
cryptocurrency Dilithium distributed ledger electricity energy energy trading ML-DSA open hardware post-quantum cryptography proof of generation prosumer Python renewable energy smart grid smart meter solar Verilog whitepaper
More about enerchain →
Still awake?
Each project has its own page with more of the story: what makes it a bit different, where it could go, and some of the usual questions. No particular order, start wherever you like.
Disclaimer
Everything here, including the code, documentation, and this page, is provided "as is," without warranty of any kind, express or implied, including fitness for a particular purpose, accuracy, or non-infringement. Insomniac-VibeLabs accepts no liability for any damages, losses, or other consequences arising from use of, or reliance on, any of it.
These are hobby projects and prototypes. They haven't had independent review, so don't count on them to protect anything that matters. See each repository for its own license terms.