Project Info

Lighthouse: a safety net for a loved one's digital life

Inspiration

Everyone has someone they worry about. A parent who forwards every "you've won a prize" email. A grandparent who almost wired money to a stranger who said he was from the bank. As memory fades, the instincts that keep us safe online fade with it, and scammers know exactly who to look for. Older adults lose billions of dollars to online fraud every year, and most of it never gets reported because the people it happens to feel ashamed. The usual fixes do not fit. You cannot sit beside your mother's inbox all day. Locking her out of her own accounts takes away her independence and her dignity. We wanted something gentler: a quiet helper that stays in the background, steps in only when it should, and keeps the family in the loop without taking over a person's life.

What it does

Lighthouse is an AI safety net for the digital life of someone who needs a little help, with their family standing behind it. It watches the incoming flow of a person's digital life and decides, case by case, what to do. It runs on one rule: safe and reversible means it acts, risky and irreversible means it asks. Every time. A phishing email is safe to handle, so Lighthouse quarantines it on its own, before it is ever seen. A demand to "pay $200 to unlock your account" is high stakes, so Lighthouse refuses to act alone. It holds the request and asks a family member, in plain language, to approve or deny it. The person being protected sees a calm, reassuring screen. No jargon, no alarms, and no off switch, because only family can change the protection. They can even ask Lighthouse a question out loud and hear a gentle answer back. The family sees a dashboard with three things: what needs a decision, what Lighthouse already handled on its own, and a complete history of everything it has done.

How we built it

Lighthouse is a small team of cooperating agents, each with one job. A Watcher reads an incoming signal and classifies the threat. A Guardian proposes a single response, chosen only from a fixed registry of allowed actions, so it can never invent something dangerous. A deterministic safety gate routes that proposal: act, ask, or just watch. An Escalation agent turns a risky proposal into a plain question for the family and waits for the answer. An Executor carries out approved actions on real web pages the way a person would, by clicking and typing in a live browser. The agents talk to each other over Fetch.ai's uAgents and are reachable through the ASI:One chat protocol, so the whole system can be driven by an ordinary conversation. Claude does the reasoning behind the Watcher and Guardian. The Executor uses Browserbase and Stagehand to operate a real inbox and a real banking page. A FastAPI and Postgres service holds the shared state, the approval bridge between the agents and the dashboard, and an append-only, tamper-evident ledger. The family dashboard, the protected person's screen, and the mock inbox and bank are a React app. We traced and scored the agents' decisions with Arize Phoenix, and used Sentry to catch failures in the parts that touch the real world.

Challenges we ran into

Drawing the line between act and ask so it stays predictable instead of a model's guess. We solved it with a deterministic gate and a frozen list of allowed actions, so the model proposes but the rules decide. Getting four moving parts, the agents, the gate, the backend, and the web app, to behave as one system without a single broken piece taking down the demo. We built every external call with a fallback and a demo mode, so bad wifi or a missing key never stops the story. And keeping the protected person's screen genuinely calm, with no control anywhere that could undo their safety, which took real restraint to design. Multi-agent system on Fetch.ai & ASI:One Lighthouse runs as a team of cooperating Fetch.ai uAgents, published on Agentverse and reachable through the ASI:One Chat Protocol. You can talk to the coordinator in plain language and watch the pipeline (classify, propose, gate, act) play out. Live ASI:One chat session: https://asi1.ai/shared-chat/6f328aeb-7e9c-4f34-9f62-f7ecc7e117b3 Agent profiles on Agentverse: lighthouse-ai (coordinator) lighthouse-watcher lighthouse-guardian lighthouse-executor Sponsors & integrations Claude (Anthropic) - reasoning behind the Watcher (threat classification) and Guardian (action choice). Fetch.ai / ASI:One - multi-agent orchestration over the Chat Protocol; agents published on Agentverse. ASI:One chat: https://asi1.ai/shared-chat/6f328aeb-7e9c-4f34-9f62-f7ecc7e117b3 Agents: coordinator · watcher · guardian · executor ASI:One chat: https://asi1.ai/shared-chat/6f328aeb-7e9c-4f34-9f62-f7ecc7e117b3 Agents: coordinator · watcher · guardian · executor Arize Phoenix - tracing + an LLM-as-judge evaluator. The Watcher improved from 86.7% to 93.3% on our hard adversarial email set after acting on the eval's explanations. Browserbase + Stagehand - the Executor operates the inbox and bank in a real browser. Deepgram - voice helper on Margaret's screen (speech to text + text to speech). Sentry - error capture on the data service (verified via /sentry-test).

Accomplishments we're proud of

It works end to end. Both demo scenarios run start to finish over a real agent chat protocol with real Claude reasoning: a phishing email gets quarantined automatically, and a payment scam is held until a family member denies it. Safety is built in, not bolted on. A deterministic gate, a frozen action registry, reversible actions with undo, and a human in the loop for anything high stakes mean the system cannot quietly do harm. Every decision is accountable. Each action, request, and decision is written to a tamper-evident ledger the family can audit. Independence and protection coexist. The person keeps a calm, dignified screen with no way to disable their own safety, and the family keeps control without taking over. A real, integrated stack. Fetch.ai agents, Claude, Browserbase, Arize, and Sentry all working together, with a demo mode so nothing on stage depends on perfect conditions.

What we learned

The hard part of an agent that touches the real world is not making it capable. It is making it know when to stop. Constraints, reversibility, and a human in the loop are not limits on the product. They are the product. Trust is the feature people actually need.

What's next

Real email and bank connections, more kinds of signals like texts and phone calls, a fully voice-first experience for the protected person, which we have already prototyped with Deepgram, and a shareable trust report so the whole family stays informed. Lighthouse is not about replacing a person's judgment. It is about giving a worried family a way to protect someone they love without taking away that person's independence. Smart enough to act, safe enough to ask.

Lighthouse

A multi-agent system that quietly protects the digital life of someone whose memory is declining — acting on safe, reversible things on its own, and asking the family before anything risky or irreversible. Built for the UC Berkeley AI Hackathon 2026.

One-line architecture: signals in → agents reason → a deterministic gate decides act-alone vs ask-a-human → real actions on real interfaces → an immutable ledger watches all of it.

See docs/1-MASTER-PLAN.md for the build plan and docs/2-architecture-reference.md for the design.

Repo layout — one owner per folder

Folder	Owner	What's in it
`pipeline/`	Chaitanya	the AI agents (Watcher / Guardian / Escalation), the deterministic safety gate, the Browserbase + Stagehand executor, Arize
`data/`	Keya	Postgres schema, the append-only ledger, the mock email feed, the approval bridge, Sentry
`web/`	Sonakshi	the family dashboard, the protected-person screen, the mock inbox & bank, the pitch
`lighthouse_common/`	shared	the frozen contract: `schemas.py`, `action_registry.yaml`, `demo_ids.py`

Only edit your own folder. lighthouse_common/schemas.py and lighthouse_common/action_registry.yaml are FROZEN — they're the shared contract; changing one breaks everyone. Ask the team first.

Quick start

cp .env.example .env          # then paste your sponsor credit codes into .env
docker compose up -d          # start Postgres (pgvector/pgvector:pg16)
pip install -r requirements.txt

The web/ track uses its own Node toolchain (cd web && npm install && npm run dev).

Analysis

Compare with all teams

View

Metric

Figures cover GitHub contributors during the hackathon window. A co-authored commit counts in full for each author, so per-member totals add up to more than the whole-team figures.

Technology

Found in codeClaimed only

AnthropicIn code
CSSIn code
FastAPIIn code
HTMLIn code
JavaScriptIn code
PythonIn code
ReactIn code
SQLIn code
Tailwind CSSIn code
DockerClaimed
PostgreSQLClaimed

9 of 11 appear in the indexed code. 2 claimed on Devpost could not be matched to code, which may simply mean the tool leaves no trace in the repository.

AI coding agents

Claude CodeConfig · Commits

Detected from committed agent config files and commit authorship. Absence of a signal is not proof an agent was unused.

Codebase size

Source size

314 KB

Source files

Counts recognized source files only; vendored directories, binaries and lockfiles are excluded, so this is smaller than the repository on disk.

Feature verification

13 Verified4 Code-supported1 Blocked

Append-only, tamper-evident ledgerVerified
An append-only, tamper-evident ledger records every decision
Claimed on Devposthigh confidence
- data/ledger_append_only.sql:20 — REVOKE UPDATE/DELETE plus BEFORE UPDATE/DELETE/TRUNCATE triggers that RAISE EXCEPTION enforce true append-only semantics even for the owner role
- data/ledger.py:28 — add_event() only supports INSERT into ledger_events, no update/delete path exposed
Demo mode / fallback so external calls never block the demoVerified
We built every external call with a fallback and a demo mode, so bad wifi or a missing key never stops the story
Claimed on Devposthigh confidence
- pipeline/executor.py:13 — DEMO_MODE env flag bypasses the live Browserbase call with a realistic canned result
- pipeline/phoenix_tracing.py:44 — tracing is skipped gracefully when PHOENIX_API_KEY or deps are missing rather than failing
- data/sentry_setup.py:22 — Sentry init is skipped gracefully when SENTRY_DSN is unset
Deterministic safety gate (act vs ask vs watch)Verified
A deterministic safety gate routes that proposal: act, ask, or just watch; safe and reversible means it acts, risky and irreversible means it asks
Claimed on Devposthigh confidence
- pipeline/classifier.py:39 — route_action() deterministically maps reversible+low_stakes to autonomous, else human_gate, with a confidence floor to watch_only, no LLM involved
Escalation agent asks family for approvalVerified
An Escalation agent turns a risky proposal into a plain question for the family and waits for the answer
Claimed on Devposthigh confidence
- pipeline/escalation.py:1 — uses Claude to write a plain-language message, POSTs to the approvals bridge, and polls for the family's decision
FastAPI + Postgres backend with approval bridgeVerified
A FastAPI and Postgres service holds the shared state, the approval bridge between the agents and the dashboard
Claimed on Devposthigh confidence
- data/main.py:66 — FastAPI app defines /approvals, /approvals/{id}/decide, /ledger, /signals/next endpoints backed by Postgres via db.py
Guardian proposes actions from a fixed action registryVerified
A Guardian proposes a single response, chosen only from a fixed registry of allowed actions, so it can never invent something dangerous
Claimed on Devposthigh confidence
- pipeline/guardian.py:105 — propose_action() restricts Claude's choice to _ACTION_TYPES loaded from the registry
- lighthouse_common/action_registry.yaml:16 — frozen registry defines the finite action vocabulary with reversible/stakes metadata
Mock inbox and bank pagesVerified
the mock inbox and bank are a React app
Claimed on readmehigh confidence
- web/src/pages/Inbox.jsx:1 — dedicated Inbox page exists in the web app
- web/src/pages/Bank.jsx:1 — dedicated Bank page exists in the web app
Multi-agent system on Fetch.ai uAgents, ASI:One chat protocolVerified
Lighthouse runs as a team of cooperating Fetch.ai uAgents, published on Agentverse and reachable through the ASI:One Chat Protocol
Claimed on readmehigh confidence
- pipeline/asi_agent.py:36 — uses uagents.Agent/Protocol and uagents_core chat_protocol_spec, wiring the full Watcher->Guardian->gate->executor pipeline into a Chat Protocol handler
- pipeline/watcher.py:31 — Watcher, Guardian, Escalation, Executor are each implemented as separate uAgents
React family dashboard with 3 sections (decisions, handled, history)Verified
The family sees a dashboard with three things: what needs a decision, what Lighthouse already handled on its own, and a complete history
Claimed on Devposthigh confidence
- web/src/pages/Dashboard.jsx:13 — SectionHead comment and rendered sections literally implement 'needs you' (terracotta), 'What I've handled' (sage), and 'History' (amber)
Reversible actions with undoVerified
reversible actions with undo
Claimed on Devposthigh confidence
- lighthouse_common/schemas.py:70 — ActionResult carries an undo_token field
- pipeline/executor.py:119 — quarantine (reversible) actions return an undo_token; irreversible ones return None
- web/src/pages/Dashboard.jsx:78 — dashboard exposes an 'Undo' action that restores a handled item
Sentry error capture on data serviceVerified
Sentry error capture on the data service (verified via /sentry-test)
Claimed on Devposthigh confidence
- data/sentry_setup.py:21 — init_sentry() wires sentry_sdk.init with FastAPI auto-instrumentation
- data/main.py:105 — a dedicated /sentry-test route exists exactly as claimed
Voice helper (speech to text, text to speech) via DeepgramVerified
They can even ask Lighthouse a question out loud and hear a gentle answer back; Deepgram voice helper on Margaret's screen
Claimed on Devposthigh confidence
- web/src/lib/voice.js:6 — implements Deepgram STT/TTS with fallback tiers (Web Speech API, typed input) and a canned reassuring answerFor() responder
Watcher agent classifies threats using ClaudeVerified
A Watcher reads an incoming signal and classifies the threat; Claude does the reasoning behind the Watcher
Claimed on Devposthigh confidence
- pipeline/watcher.py:111 — classify_signal() calls the Anthropic client with a detailed classification system prompt and returns a ThreatAssessment
Agents published on Agentverse with individual profilesCode-supported
Agent profiles on Agentverse: lighthouse-ai (coordinator), lighthouse-watcher, lighthouse-guardian, lighthouse-executor
Claimed on readmelow confidence
- docs/agentverse-profiles.md:1 — documents agent addresses and profile copy for four named agents, but actual publication to the live Agentverse platform cannot be confirmed from a static repo clone
Arize Phoenix tracing and LLM-as-judge evaluationCode-supported
We traced and scored the agents' decisions with Arize Phoenix; Watcher improved from 86.7% to 93.3% on the hard adversarial set
Claimed on Devpostmedium confidence
- pipeline/phoenix_tracing.py:33 — init_tracing() registers a Phoenix OTel tracer and instruments Anthropic calls
- pipeline/phoenix_eval.py:1 — runs the Watcher over eval sets and logs a Claude-judge ClassificationEvaluator's pass/fail with explanations as Phoenix annotations, but the specific 86.7%->93.3% figures are not present in any file, only generic accuracy computation
Calm, alarm-free protected-person screen with no off switchCode-supported
The person being protected sees a calm, reassuring screen. No jargon, no alarms, and no off switch
Claimed on Devpostmedium confidence
- web/src/pages/Me.jsx:1 — Me.jsx renders a calm greeting/voice-helper page; absence of any disable/off control supports 'no off switch' but is a negative claim that's hard to fully confirm
Executor acts on real web pages via Browserbase + StagehandCode-supported
The Executor carries out approved actions on real web pages the way a person would, by clicking and typing in a live browser; uses Browserbase and Stagehand
Claimed on Devpostmedium confidence
- pipeline/executor.py:85 — _run_browserbase() imports the Stagehand SDK and drives a Browserbase cloud browser, but a DEMO_MODE path bypasses it, so live end-to-end execution can't be confirmed offline
Live ASI:One shared chat sessionBlocked
Live ASI:One chat session demo link provided
Claimed on Devpostlow confidence

An AI agent derived these features from the project’s Devpost page and readme, then searched the code for each one. Verified features are backed by cited code; claimed-only features had no supporting code, which is not by itself proof a feature is missing.