Skip to content

v0.1.0 — capstone defense release

Choose a tag to compare

View all tags
@cosmopig cosmopig released this 06 May 12:18
v0.1.0
65f00d2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First reproducible snapshot. Codex round-5 sign-off after 4 rounds of adversarial review + 5 Padv per-component attack passes.

What you can do with this release

  • Run all 4 demo scenarios on a deterministic mock substrate or any of 6 real LLM substrates (Anthropic / OpenAI / Gemini / Mistral / Ollama / client-inherited via MCP sampling).
  • Stand a vacant up as an MCP server (vacant serve --mcp) and have Claude Desktop / Cursor / any MCP-aware client call it. The client-inherited substrate path means the vacant doesn't need its own API key — it borrows the host client's LLM.
  • Wire two vacants to a registry, see them call each other with signed envelopes, watch reputation diverge, watch same-controller detection fire on a colluding pair.

Install

curl -LsSf https://raw.githubusercontent.com/cosmopig/Vacant/main/install.sh | bash

or without cloning:

uvx --from git+https://github.com/cosmopig/Vacant vacant demo law_firm

Built and verified through

  • 9 component PRs (P0 bootstrap → P7 MVP demo)
  • 5 Padv adversarial review PRs (one per defense surface)
  • 4 codex rounds (3 theory + 1 OSS-readiness audit; the final round signed off after seeing all 5 high-risk blockers fixed: halo TOCTOU, per-actor monotonicity race, envelope replay race, plaintext key storage default, license metadata)
  • Integration tutorial + mkdocs API reference site at https://cosmopig.github.io/Vacant/

Test posture

  • 836 tests, 91.20% line coverage
  • mypy --strict, ruff + format clean
  • ubuntu + macos × py3.12 + py3.13 matrix
  • wheel build smoke install + pip-audit + Bandit + gitleaks

Known limitations (honestly stated)

  • 13 open questions H1–H13 in THEORY_V5.md §6.5
  • macOS CI runs as informational-only (deferred runner-specific debug)
  • PyPI name vacant is taken by an unrelated package; install via the script above or uvx

License

MIT — see THIRD_PARTY_NOTICES.md for the transitive license map.

Note

Vacant is an undergraduate capstone project (2026). Not battle-tested in production. Treat any deployment beyond local demo as experimental research artifact.

Full commit log: https://github.com/cosmopig/Vacant/commits/v0.1.0

Assets 2
Loading