BLACKTRACE // LAPLACEdeterministic · zero-LLM · air-gapped

Four things a model can't be at once. A system can.

Careful, bold, compliant, terse — turn all four dials up inside one model and they fight. You don't train the tension out. You architect around it: route the task through the right deterministic check. LAPLACE is that check.

GET LAPLACE // $39/mo run the gate free →

per repo · base pack + custom rules + offline license · no sales call, no lock-in

git commit

# the scanner flagged 12 lines. the gate keeps the two that are real.
KILL  src/api.py   CWE-502  pickle.loads deserialises untrusted data
KILL  src/db.py    CWE-89   SQL built from a dynamic string
PASS  src/util.py  # none of the 8 classes -> commit proceeds
PASS  src/io.py    # style noise another scanner screams about -> dropped

receipt 8f197b6c2047a2a6  # same code + ruleset -> same hash, every run

The proof, published

11/11

known-bad killed

0/7

good false-positives

304

real CVEs tested

89.67%

Bandit flags removed

4.14%

false-kill / 20,147 files

CWE classes, AST-precise

Honest scope: PASS means "none of the active rules fired," not "safe." A focused checker, not a scanner. Two pre-registered hypotheses are still marked NOT PROVEN on /kruc.

What each trait actually is

Careful

Catches what fluent-but-wrong code slips past review: injection, deserialization, hardcoded credentials. Eight CWE classes, AST-precise.

Bold

Zero LLM, air-gapped, runs on your own iron. No model in the loop to second-guess. Same input, same verdict.

Compliant

Every run emits a reproducible receipt — the secure-by-design evidence the EU Cyber Resilience Act asks for.

Terse

Same code + ruleset → the same SHA-256. One hash, no essay.

Not an everything-model. A system that sends each task to the check that can actually answer it.

Install — 60 seconds, three ways

pre-commit github action rule builder

# .pre-commit-config.yaml
repos:
  - repo: github.com/blacktrace-hq/laplace
    rev: v1.0.0
    hooks:
      - id: laplace-gate

$ pre-commit install   # real issues block the commit; noise passes

# .github/workflows/laplace.yml
- uses: blacktrace-hq/laplace@v1
  with:
    path: .
    license: ${{ secrets.LAPLACE_LICENSE }}
# red on a real issue, green on clean, receipt as a CI artifact

# author rules with the license unlocked
open blacktrace.co/laplace/build
#  pick primitives -> preview the verdict live -> download
#  .laplace/config.yml -> commit -> your rules run in CI

$39 / mo · per repo base pack free & open · custom rules licensed

Sealed 8-CWE base pack — free, open (MIT), runs with no license.
Buyer-extensible rules — author your own; the license unlocks them in CI.
Offline Ed25519 license — verified locally, no phone-home.
Rule builder — compose, preview the verdict, download your config.
Reproducible receipts — CI-ready CRA evidence, on your own infrastructure.

GET LAPLACE // $39/mo build a rule →