v2.2.1

A packaging fix. No behaviour changes, no flag changes, no output changes.

The v2 module is importable

The module has been tagged v2.0.0, v2.1.0 and v2.2.0 while go.mod still declared module github.com/surya-koritala/sigbound. Go's semantic import versioning requires a major version of 2 or higher to carry the suffix in the module path, so every one of those tags was invisible to the module system:

$ go get github.com/surya-koritala/sigbound@v2.2.0
invalid version: module contains a go.mod file, so module path must match
major version ("github.com/surya-koritala/sigbound/v2")

The +incompatible escape hatch does not apply either — that form is only for modules with no go.mod at all.

The practical effect was worse than an error. @latest resolved to v1.1.0 and succeeded, so a dependency on this engine silently pinned a year-old version rather than failing with a reason anyone could act on.

Import it as

import "github.com/surya-koritala/sigbound/v2/pkg/attest"

go get github.com/surya-koritala/sigbound/v2@v2.2.1

Compatibility

Users on v1 are unaffected — v1 remains resolvable at the old path, which is exactly what the suffix rule exists for. Nobody could have been on v2, since v2 was never resolvable.

go.sum is still empty: the engine has no dependencies.

v2.2.0

Changelog

• e9b1374 docs: changelog for 2.2.0 (#187)

v2.1.0

Changelog

• bac8752 docs: changelog for 2.1.0 (#172)
• ddf6985 docs: correct the README's test, fuzz, and coverage figures (#151)
• f0f1b34 feat(presets): govulncheck/gitleaks/codeql verify presets that fail loud when the tool is absent

v2.0.0

Changelog

v1.1.0

Changelog

• d76468c docs: publish extended-scale numbers to 4096 agents; add nightly scale smoke
• 95e12a5 docs: refresh benchmark table and charts with clean v1.0 numbers

v1.0.0

Changelog

• cbfd3b7 docs: correct /ui auth prose to match the SPA-shell pattern
• 5cbcf58 fix: close bare '' fail-open in -env- allowlists (issue #56)
• b41f5a5 fix: don't count -verify-cache hits toward verify.invocations/wallMs
• e6043c2 fix: resolve singleton group heads to OIDs in IntegrateOCC
• b894a53 fix: serve /ui unauthenticated so the token field is reachable

v0.3.0

Run AI coding agents in parallel on one git repo and auto-merge their verified work — nothing lands unless it builds and passes your tests.

Highlights in 0.3.0

• -verify-bisect — when the combined tree fails verify, land the verified green subset instead of losing everything
• -verify-cache — skip re-verifying trees already proven green (keyed by tree OID)
• Run manifest + sig replay — every landing is reproducible provenance
• -resume — pick up an interrupted run without re-running finished agents
• -publish — push the landed commit and open a PR/MR with your own tooling
• This GitHub Action — install a released sig, run it from typed inputs, gate your job on the outcome

Use it

- uses: surya-koritala/sigbound@v0.3.0
  with:
    agent: 'claude -p --permission-mode acceptEdits "$SIGBOUND_TASK"'
    goal: "Add CSV export, due dates, and a summary command"
    verify: "go build ./... && go test ./..."

v0.2.0

Changelog

• 42a2cb2 fix: gate WorktreeAddReset on this-run creation, not attempt>=2
• 65b74d0 fix: never let a -logdir write failure fail the command it logs
• 76a7688 fix: scope worktree branch reset to same-run retries; fix keep-failed gating

Sigbound v0.1.0

Run multiple AI coding agents on one repository in parallel, and merge their
work automatically — landing only changes that build and pass your tests.

This is the first public release. It runs on top of plain git, works with any
host, and uses whatever model and harness you already have.

Highlights

• Parallel merge — non-conflicting changes from many agents are combined in
  one pass, not one merge at a time.
• AI conflict resolution, fail-safe — a model resolves overlaps; anything it
  is unsure about is flagged for review rather than guessed.
• Verified merges — nothing lands unless the combined result passes your
  -verify build and test command.
• Self-repair — a merge that breaks the build is routed back to an agent to
  fix, then re-checked.
• File lanes — each task declares the files it may touch; an agent that
  strays is rejected.
• Bring your own model — planner, agent, resolver, and repair are each a
  command you supply.
• Plan from a goal — give a goal and a planner command and Sigbound fans it
  out into parallel tasks.

Benchmark

Merging agents' branches into one repository on a single laptop, correctness
verified on every run: 512 agents integrate in ~1.8 s versus ~26 s for a
sequential git merge — about 15× faster, and the gap widens as agents are
added. Reproduce with go run ./cmd/sigbench -sweep.

Install

git clone https://github.com/surya-koritala/sigbound && cd sigbound && go build -o sig ./cmd/sig

Requires Go 1.25+ and the git binary. See the README for a
full sig run example.

Early release — not yet

This is an early release focused on the merge engine and CLI, verified on real
repositories. It does not yet include multi-machine execution, a UI, or a
hosted service. Sigbound builds on top of git and does not aim to become a git
host. Feedback and issues are welcome.