Skip to content

v0.1.98

Choose a tag to compare

View all tags
@coo1white coo1white released this 03 Jul 03:12
· 615 commits to main since this release
v0.1.98
dfba5e6

Two agents scoped to separate repos that share no filesystem can now hand each other a change proposal or review verdict as digest-sealed JSON and verify/apply/list it fail-closed via cw ledger on both the CLI and MCP.

  • Capability: A new cw ledger verb lets two agents scoped to two separate repos — running as two separate sessions that share no filesystem — hand each other a change proposal or a review verdict as verifiable data, not chat. cw ledger propose / review print a self-contained JSON entry sealed with a sha256 content digest; cw ledger verify and cw ledger list --dir <d> check them fail-closed (a tampered, malformed, or unreadable entry exits non-zero), so cw ledger verify <file> && open-pr can never proceed on a lie. The exchange rides on any shared git host — GitHub or a self-hosted Gitea — because the kernel holds no git logic: writing is cw ledger propose > ledger/<id>.json plus your own git add/commit/push. --dir is repeatable, so cw ledger list --dir a --dir b … union-verifies several mirror directories (e.g. a GitHub clone plus Gitea mirrors in other regions) into ONE fail-closed inbox for redundancy/reachability. Every verb is on both the CLI and MCP (cw_ledger_propose|review|verify|list), so an agent can mint and check entries in-process.
  • Implementation: New zero-dependency kernel module src/ledger.ts (only node:crypto): buildLedgerProposal/buildLedgerReview seal an entry with a digest over the key-sorted canonical JSON of every field except id/digest; the id is content-addressed (ldg- + the first 16 hex of the digest) and bound to the content — verifyLedgerEntry requires id === deriveId(digest) and fails closed with ledger-id-mismatch otherwise, so a spoofed or absent id cannot slip a forgery through the union's id-keyed de-duplication. unionLedgerEntries(dirs) de-dupes verified entries by that content-addressed id and sets allOk:false if any entry in any mirror fails. CLI handler src/cli/handlers/ledger.ts dispatches propose|review|verify|list (verify reads --file/stdin; a single --dir keeps byte-identical single-directory output, 2+ take the union shape — POLA); MCP routes the four cw_ledger_* tools through the same core (mcp/tool-call.ts + tool-definitions.ts), registered payloadIdentical:false (the entries are non-deterministic mints / directory reads). git stays entirely in userland. Man pages docs/cross-agent-ledger.7.md + operator runbook docs/handoff-setup.md (GitHub-vs-Gitea trade-off), design note docs/designs/handoff-ledger.md.
  • Tests: New ledger-verify-smoke proves the propose/review round-trip; that a content-tampered entry, non-JSON bytes, a truncated entry, a forged-id and an id-less entry each exit 1 with the matching fail-closed code; --file + stdin transports; the git-transport inbox; the multi-mirror union (dedup across mirrors, single---dir POLA shape, a tampered mirror failing the whole batch, and a spoofed-id forgery unable to mask a legit entry). The two id-binding defects were found by an adversarial review of the union and fixed before merge. Verified end-to-end against a real private GitHub handoff repo (propose → push → list → allOk:true). build, check, parity:check, index:check, gen:manifests --check, dist:check, parity-doc-sync-smoke, mcp-tool-call-coverage-smoke all green.
  • Risk: Low. cw ledger is a brand-new opt-in verb; no existing output, flag, exit code, or file layout changed (a single --dir is byte-identical to a plain single-directory listing, and cw handoff — an unrelated run/task ownership-transfer primitive — is untouched). Zero new runtime dependencies. The id-binding check is a fail-closed hardening. The cw:result / --json machine surfaces, signing, and the multi-agent red line are unchanged.

Provenance & audit

Released through the gated flow: deterministic gate → independent release-reviewer (verdict above) → provenance-attested npm publish.

Assets 2
Loading