v0.3.1 — two scars from the sync layer under the ledger

two new failure modes on FAILURE-MODES.md, both found in our own fleet this week. both live in the sync layer the ledger rides on, not in the protocol — so both are marked [production-only] and explained rather than hidden.

J — the instrument that only knew how to call a human. four separate instruments detected sync conflicts on ledger and journal files. all four printed the same sentence: merge unique lines into the live copy first, then delete the conflict file. none of the four merged anything. the nightly sweep left LEFT 78 for review every night, and one journal had nine conflict copies holding nine lines that existed in no live file.

the fix is an executor hung on a door that already runs — and the half that matters more: the executor knows what it cannot do. a dry run before rollout showed line-wise merging would have poured 92 lines into a python registry, 119 into a json ranking file and 95 into a dashboard html. every one of those a corrupt file. auto-merge is now allowed only for append-only artefacts; everything else goes to review untouched. first live run: 102 lines merged, queue 78 → 76.

K — delivery asserted from the sender's own disk. for three weeks the gate that registers a fix as a parcel for the other machines took "the file exists here" as proof it would arrive there. an audit of 315 parcels found the commonest shape of the class: an apply step that runs only its own _test_* file and never carries — or even names — the thing under test (22 parcels). one of them died on a peer on 11 aug and the fleet went on believing it had shipped.

truth about delivery now comes from the receiver's sync ignore-rules, read at registration time, not from a path list in our code. cannot read the rules = don't know = fail-closed. named limits: mtime is not a version, and the same filename on both ends is not the same content.

if your shards travel by a file-sync tool, you inherit both of these whether or not you use this engine.

also in this release: the changelog backfills v0.3.0, which was cut on 25 aug and never written down — the same lapse v0.2.1 records about v0.2.0. we write those down instead of backdating them quietly.

cut by the weekly release pass, run #2.

v0.3.0 — claude-consensus is now claw-consensus

the rebrand release: claude-consensus is now claw-consensus (name decided by Anton, 24 Aug). github redirects the old URLs, but update your remotes.

also in:

• dead org links fixed after the org was deleted 13 Aug — everything lives under tonydzi now
• CITATION.cff follows the rename
• README cross-links fleet-deploy (executing what the fleet agreed on)
• the failure-modes page is now named what it is; two pieces point at SYSTEM.md

cut by the weekly release pass, first run.

v0.2.1 — contribution plumbing, and versioning that matches reality

Contribution plumbing. No protocol change — if you are running v0.2.0, there is nothing here you need.

• AGENTS.md — the five invariants ordered by what they cost to break, so a change that touches one knows what it is risking. Written for the agent as much as the human.
• The contributor deal now comes from one org-wide CONTRIBUTING.md instead of a local copy that silently shadowed it — no CLA, you keep your copyright, an answer within 48 hours including "no, and here is why".
• The lab-wide AI-contributor credit policy, and changelog categories for these auto-generated notes.

Versioning, corrected

The README and changelog promised "a versioned release with a changelog twice a week (Mon & Thu)". v0.2.0 was written on 28 July and carried no tag until today. The calendar promise is replaced with one tied to the work: every noticeable change ships as a release.

What's next

A guard for a failure we have not covered yet — and, more honestly, numbers from a fleet that is not ours. Every measurement in this repo comes from six machines we own, which makes it a reference implementation rather than an independent result.

Full Changelog: v0.2.0...v0.2.1

v0.2.0 — four more guards (written 28 July 2026)

Four more guards, from a month of running this across six machines.

Written 28 July 2026, tagged 4 August 2026. The content is the July commit; the tag was never cut at the time, and it is recorded that way rather than backdated.

Every guard here has the same shape as the first three: something the protocol trusted without checking. The list is written from incidents, not from imagination.

New guards

• Arbiter election (reference/protocol_guards.py) — the tie-break role no longer dies with the machine holding it. Elected from an ordered list by presence freshness, computed identically by every peer so they agree without messaging, and promoting only on positive evidence of life: a stale stamp fails over, an absent one does not. Gated behind an armed flag so an un-upgraded peer behaves identically. Announced once per episode, not once per tick.
• Proof grading — a VERIFY proof is graded proven only when it carries the residue of an action: an exit code, a hash, a moved counter, a before/after pair. Armed from a timestamp; earlier history is grandfathered rather than retroactively downgraded.
• Risk tracking — a track (financial / secrets / outbound / canon / infra / general) classified independently of the tier the proposer chose, because a tripwire catches dangerous words but not a dangerous category carried at a low tier. Ships in shadow with a deliberately falsifiable verdict and a report that says whether the guard earned its keep.
• Machine identity (reference/fleet_sign.py) — Ed25519 detached signatures via ssh-keygen -Y, one public key file per machine (single writer, no conflicts), a revocation list, allowed-signers assembled in memory at each verify. Unsigned (a rollout gap) is kept strictly distinct from bad (tampering), and bad is refused even during the dark phase.

Two Windows scars are documented in place: two ssh-keygen builds on PATH where one hangs on -Y sign, and the newline="" that stops CRLF armor from being corrupted into a false "tampered" verdict.

Proof

Both new files self-test (python <file>.py selftest), and fleet_sign.py does a real signature round trip including a tampering check — a signature selftest that never fails a verification proves nothing.

docs/PROTOCOL.md §6a and FOR-ROBOTS.md carry the write-up, plus a "what is here versus what we run" section: the reference is sanitized and trimmed for reading.

Full Changelog: v0.1.0...v0.2.0

v0.1.0 - multiple machines, one system

First public release: the consensus protocol (propose/counter/accept/commit + three guards), the dual-rail bus with ACK discipline, leader/follower governance, three self-heal layers, and the sanitized stdlib-only reference implementation. See CHANGELOG.md.