antiflock

AntiFl0ck is an open-source, self-hosted counter-surveillance layer for networks you control. It maps device and network exposure, verifies trusted routes, and holds sensitive actions when the trusted path drops, recording every decision in a signed local audit log. Built with Go and React, it is currently pre-alpha and simulation-first, with a working local demo and dashboard. Key features include a deterministic policy engine that allows, holds, or blocks actions based on operator-defined rules; a signed, hash-chained audit log stored in SQLite; endpoint enrollment with mTLS device identity; Linux route/interface observation; read-only live mesh probes for Tailscale and Headscale; and a Third-Eye dashboard. The project emphasizes evidence labeling (detected, verified, reported, inferred, suspected, unknown) and operator control, with no AI making allow/block decisions. AntiFl0ck is not affiliated with Flock Safety and does not interfere with third-party surveillance infrastructure. It is designed for homelab users and mesh network operators (Tailscale, Headscale, WireGuard) who want a signed audit trail and policy-based gating of sensitive actions. The demo runs via npm or pip (npx antiflock init/dev/lab or pipx install antiflock) or from a clone with make dev/lab. It requires Docker, git, and Node 20+. The local simulation is complete and passes a 10-gate release check, while host-level enforcement and mobile support remain under development. Architecture: Core handles identity, events, policy, and explanations but never sits in the traffic path. Each device keeps a local copy of rules, so protection continues if Core goes offline. The project is Apache-2.0 licensed and welcomes contributions in observers, visualizers, policy builders, researchers, and hardening engineers.