v0.0.3

Invincible Gateway and the Autobot Agent, one install.

New

• Audit log (spec/audit.md). Every request the node answered is logged with:

  • its signed receipt;
  • when it was answered;
  • who asked: local, or a paired device by name.

  Each entry carries the hash of the one before it, so a removed or edited entry breaks the chain.

  • invincible audit shows the log; --summary adds totals per model and per host reached; --verify checks the chain and every signature.
  • Paired devices read it with GET /v1/audit.
  • No telemetry: nothing about your requests leaves the node unless you send it.

• Agent action log. Every command, file write, outside read and cloud send the agent asked for is logged, with whether it ran and who decided: the rules, an earlier "always", or you on the CLI, the app or Telegram.

  • autobot actions shows it, and the app reads it through GET /v1/agent/actions.

• Memory and skills.

  • The agent keeps short facts with remember, and every later conversation starts with them. autobot memory lists them; --forget removes one.
  • Skills are Markdown how-to notes in ~/.autobot/skills/, which the agent reads when one fits. autobot skills lists them.
  • The app sees and manages both.

• Recipes from the phone. An Autobot recipe can run on your node: always on, no 8-minute limit, offered only its tool groups.

  • The phone sends it in UTC (CRON_TZ=UTC is new in schedules), starts it with POST …/run, and collects each run's whole answer and receipt ids with GET …/runs?after=.
  • Receipts older than the in-memory 4096 are found in the audit log.

• Evals (spec/evals.md): invincible eval runs a task file against models the gateway serves, local or cloud, and checks every answer by rule. Thinking models answer directly unless you pass --thinking.

Security fixes

These came from an internal adversarial review of remote access and the agent. It is not yet the independent review.

• invincible tunnel needs the machine's token and a loopback Host. Before, a web page open on the paired machine could reach the node through the tunnel as that device (cross-site requests, DNS rebinding). Update both machines and pass the token (invincible token) to whatever uses the tunnel.
• write_file never writes through a symbolic link or to a hard-linked file. A dangling link in the working directory could otherwise point the write outside it.
• Writes under dot names (.git/config, .envrc) always ask. They never run unattended.
• Connection limits:
  • at most 64 handshakes in flight;
  • at most 32 sessions per device;
  • 30 seconds to send headers.
• Pairing codes are used up atomically, so two handshakes cannot both pair with one code.
• A revoked device stops receiving at once, even on a stream it is only reading.
• The agent API:
  • takes only JSON POSTs;
  • the gateway passes on plain /v1/agent paths only;
  • a device's schedules must name their tools and cannot replace schedules made elsewhere;
  • every N is capped at a year.
• spec/audit.md now states plainly what the unkeyed audit chain proves and what it does not.

Evals on real code

evals/projects.jsonl has 50 tasks built from the code of Autobot, Omnie and Nightfall. Qwen3.5 4B passes 30/50 and Qwen3 0.6B passes 8/50.

Install

curl -fsSL https://raw.githubusercontent.com/wckdboy/invincible/main/install.sh | sh

The installer checks SHA256SUMS against the release key pinned in install.sh (and the build attestation when gh is signed in). The Linux binaries are static and reproducible.