Add PCTR: see what your agents can cause, route them safely, prove what happened - #49
Merged
Merged
Conversation
Introduce verify_isnad_chain: validates a chain of trust transmission from a rooted authority to a terminal subject. Enforces continuity (muttasil), per-link validity, trust floors, and attenuation along the chain, surfacing the weakest link and effective trust. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Transform the repo into a protocol-standard visual experience: dark, precise, cryptographic, enterprise-grade. - README rebuilt as a visual landing page (hero, protocol loop, trust gap, authority flow, decision matrix, decay curve, receipt, architecture, integrations, roadmap, contributor path) - Branded SVG asset system on the TTP token palette, with real brand fonts (Space Grotesk / Inter / JetBrains Mono) subset + embedded as base64 @font-face so they render on GitHub - 1280x640 social preview PNG + trust-ring motif - Reproducible build: assets/brand/embed-fonts.py + render-png.mjs (npm run assets) - GitHub config: PR template, discussion templates, FUNDING, label system + sync - docs/brand/VISUAL_DESIGN.md: tokens, components, badge/label systems, checklist Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- website/: dark-first VitePress docs site on the TTP design system — brand tokens, custom protocol callouts (AUTHORITY/ATTESTATION/DECAY/ RECEIPT/STEP-UP/DENY), "choose your path" home cards, full nav/sidebar, and pages for concepts, runtime, decay, proofs, receipts, language, examples, integrations, RFCs, contributing, security. Builds clean. - assets/screenshots/: branded cli-demo terminal (from real `ttp check` output) and receipt-preview, rendered with embedded brand fonts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
PCTR is the developer entry point to TTP: see what an agent can cause, route it through a trustworthy path, and prove what happened. - Consequence-first mapping: actions classify by the state change they cause, escalated by scale and amount, with the verb deciding over the namespace (payments.status reads; payments.transfer moves money). - Trust graph with the inverse mapping consequence <- action <- tool <- agent <- delegation <- principal. - Consequence Twin (pctr preview), with read-only probes that measure a consequence instead of declaring it; output labels measured vs declared. - TrustRoute Autopilot (pctr route): unauthorized, untrustworthy, stale, consequence-incompatible and policy-invalid routes are removed before any optimization for latency or cost. Rerouting cannot silently expand authority. - Execution authority bound to principal, delegator, session, action, target, material parameters, constraints, policy, consequence, validity and nonce, signed with Ed25519 and verified at the effect boundary. - pctr serve runs that boundary in its own process, holding persistent replay state and the trusted signer list; an unreachable boundary denies. - Signed, chained receipts verifiable with a public key by someone who cannot mint one; unpinned verification reports itself as unpinned. - Agent Time Machine (pctr replay, pctr explain): 16 canonical events with deterministic why derived from the recorded causal chain, plus fork, simulate and compare. - Adapters normalizing openai-agents, claude-agents, langgraph, crewai, autogen, semantic-kernel, mcp and a2a onto those canonical events. - Discovery parses MCP, LangChain, CrewAI and FastMCP tool and agent declarations out of source; declared manifest entries always win. 115 tests, plus two runnable demos. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adoption work: the tool now installs as a standalone package, produces something worth sharing, and shows what it does in one image. - Vendor the three TTP primitives PCTR uses (canonical hashing, trust decay, route verification) so installing PCTR pulls in nothing else. tests/conformance.test.mjs compares them against the reference implementation on every run, so the copies cannot drift silently. Verified by packing the tarball and running the CLI in a clean project. - pctr scan --share writes a Markdown report card: severity table, the highest-priority consequence with the route that reaches it, what to do about it, and a shields.io badge. It leads with the consequence, not with agent counts. - A composite GitHub Action plus an example workflow: scan on every pull request, post the findings as one comment that updates in place, and optionally fail the build when an agent can reach an irreversible consequence. - init --no-example keeps an empty scan empty, so CI never reports fabricated findings about someone's repository. - assets/pctr-scan.svg is generated from real CLI output by scripts/render-terminal-svg.mjs (npm run assets:pctr), so the picture in the README cannot drift from what the tool prints. - npm metadata for publication: description, keywords, repository, homepage, bugs, license file. Command strings in the docs stay true today: the package is not published yet, so the quickstart is npm link rather than npx. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- LICENSE was a paraphrase of Apache 2.0, only 85.1% similar to the canonical text across ~26 divergences: the warranty disclaimer dropped "warranties or conditions of TITLE", section 4 was replaced with MIT-style language granting rights to sell copies of the Work (the canonical grant covers Your modifications and keeps a compliance proviso), "consequential" became "exemplary" damages, and the Contribution/Contributor definitions were rewritten. GitHub could not match it, so the repository reported NOASSERTION and enterprise license scanners would flag it for legal review. Restored verbatim Apache 2.0 (now 100% match) and moved the BlockSiFr-specific statements to NOTICE, where they belong. - Removed twelve directories whose entire contents were a one-line README: seven packages, five apps, plus infra's three README shells. A visitor who opens one of those sees scaffolding, not a project. - Removed the byte-identical duplicate of ttp-language.md and the duplicate governed_execution.yml, which shared a display name with governed-execution.yml and ran a second time on every pull request. - Moved PATENT_NOTICE, COMMERCIAL_BOUNDARY, TRADEMARKS, DOCTRINE, GOVERNANCE, MVP and ASSESSMENT into docs/, leaving README, LICENSE, NOTICE, SECURITY, CONTRIBUTING, CHANGELOG, ROADMAP and the spec at root. Links updated; no broken relative links remain. - README leads with the tool: real CI and test badges replace seven static ones, navigation points at the 60-second path before the spec, and the protocol framing now follows the quickstart instead of preceding it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
GHSA advisory: missing buffer bounds check in uuid v3/v5/v6 when a pre-allocated buffer is passed. Both packages use only the named v4 import, whose signature is unchanged across v9 -> v11, and both already declare node >= 18, which satisfies v11's engine requirement. Also drops @types/uuid, a deprecated stub since uuid v10 — the package ships its own types now, and keeping a v9 stub alongside v11 invites a type mismatch. Both projects build clean with tsc, and npm audit reports 0 vulnerabilities in each tree. Lockfiles committed to match the repo's existing convention. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PCTR — Protected Consequence Trust Routing — is the developer entry point to TTP.
npm link ./packages/pctr pctr init && pctr scanWhat it does
pctr preview <action>pctr route <action>pctr protect <action>payments.statusreads,payments.transfermoves money.pctr preview), with read-only probes that measure a consequence instead of declaring it. Output labels every number measured or declared.pctr route). Unauthorized, untrustworthy, stale-evidence, consequence-incompatible and policy-invalid routes are removed before any optimization for latency or cost. A test pins that the faster route loses when its evidence is stale. Rerouting cannot silently expand authority.PARAMETER_MISMATCH; spent nonces failREPLAYED_AUTHORITY.pctr serve) runs in its own process with persistent replay state and a trusted-signer list. An unreachable boundary denies; it never fails open.pctr replay,pctr explain): 16 canonical events, deterministic "why" derived from the recorded causal chain, plus fork, simulate and compare.pctr scan --sharewrites a Markdown report card, and a GitHub Action posts it on every PR.Zero dependencies, zero network, no account. 123 tests. Two runnable demos:
npm run demo:pctr,npm run demo:pctr-fabric.Also in this branch
NOASSERTIONas a result. BlockSiFr-specific statements moved toNOTICE.ttp-language.mdand a duplicate workflow that ran a second time on every PR.docs/; README now leads with the tool, real CI and test badges replacing seven static ones.Known limits are written into
packages/pctr/README.mdrather than implied away: blast-radius weighting is a heuristic, trust scores come from the manifest, keys sit on disk rather than a KMS, andpctr serveis plain HTTP.🤖 Generated with Claude Code