Implements OpenPRD 0001 through Phase 0 (specification, schemas, example,
docs surface) and Phase 1 (local engine, CLI, conformance tests).
Schemas (17 contracts, JSON Schema Draft 2020-12, additionalProperties:false)
manifest, namespace, entity-type, property, relationship-type, constraint,
query, action, entity, claim, source, evidence, changeset, review, approval,
event, package — registered in @logicsrc/validators and exported from
@logicsrc/schemas under https://logicsrc.com/schemas/openontology/.
@logicsrc/openontology
- canonical JSON + sha256 package digests; YAML, JSON, NDJSON, and inline
authoring all compile to the same bytes, so digests are authoring-agnostic
- id profile: compact / IRI / urn with one canonicalization rule, prefix
bound by a Namespace object so IRIs reverse unambiguously
- validation: schema, graph (domain/range, datatypes, dangling refs),
provenance (source-or-firstParty, agent runId, derivation inputs), policy
(excerpt limits, licensing, visibility, staleness) and declared
constraints; four severities, stable codes, text/json/yaml/markdown
- portable triple-pattern query AST: multi-hop, 14 operators, asOf and
recordedAsOf, per-status filtering, distinct/order/limit, explanation
mode, and enforced depth/binding/row limits
- append-only store: claims are immutable; dispute/retract/supersede append
status transitions and the effective status is the latest one
- change sets: 9 operations, atomic pre-flight, conflict detection on stale
base revisions, semantic diff with duplicate-identity warnings and
affected-query deltas, per-operation reviewer decisions
- policy: agents propose but can never apply — the denial keys on actor
type, so every scope plus high confidence plus --yolo still cannot apply;
merges need approval, bulk retractions need two, undeclared action side
effects are denied
- JSON-LD 1.1 export/import with PROV-O aliases and lossy-field reporting
- pluggable signature envelope with a jws-ed25519 reference profile and a
fail-closed trust policy
CLI: logicsrc ontology init|validate|lint|build|inspect, entity, claim, query,
changeset, import, export, audit. Reads take --format, writes default to a
proposal, exit codes are stable for CI.
Example: examples/openontology/ethereum-ecosystem — 12 entity types, 17
relationship types, 63 entities, 169 claims, 25 sources, 31 evidence records,
5 saved queries, every claim lifecycle state, and a pending merge proposal.
All data is fictional; the directory is removable without affecting any core
test.
Docs: docs/openontology{,-governance,-interoperability}.md, a real
/openontology route, homepage + nav + sitemap entries, and a root README
section.
Verification: 112 new tests; full monorepo build and every workspace test
pass; conformance bundle (18 valid + 13 invalid fixtures) runs against the
published schemas alone; Node.js 25 and Bun 1.3 produce byte-identical
digests, revisions, event trails, and query results.
Not included (later PRD phases): MCP resources, REST/SSE, Turso adapter, TUI
and PWA surfaces, RDF/SHACL mappings, source adapters, governed actions.
Refs: prd/0001-add-logicsrc-openontology-spec.md
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Starts the repo's numbered OpenPRD collection under prd/ and lands the
first proposal: LogicSRC OpenOntology, a provider-neutral, storage-agnostic
contract for durable, source-backed domain knowledge shared by humans and
agents (entity types, claims, provenance, temporal history, portable
queries, change-set governance, and CLI/SDK/MCP/REST surfaces).
Status is Draft — 8 open questions remain before Accepted, notably the
globally unique ID profile, the package signature envelope, and which
existing web app owns the /openontology route.
Also adds prd/0000-template.md (copy of docs/openprd/0000-template.md, which
the OpenPRD layout expects inside prd/) and prd/README.md as the index.
Verified against the repo's own standard: front-matter validates against
openprd-prd.schema.json via @logicsrc/validators, id matches the filename
prefix, all eight body sections present in order, requirements contiguous
R1-R210.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Adds apps/pwa: an Express + libSQL/Turso app that is now the home of team
credential sharing, with the moshcode-style auth stack ported and reskinned to
match logicsrc.com (light theme, Inter, green accent).
apps/pwa
- auth: email/password (scrypt), passkeys (WebAuthn), CoinPay OAuth, cookie
sessions, and lsk_ API keys for the CLI via a loopback OAuth-PKCE flow
(/cli/authorize + /cli/token). Ported from the moshcode PWA.
- credshare API (/api/credshare/*): teams, members, invites, vaults, sealed
grants, ciphertext secrets, audit — authed by session OR Bearer lsk_ key.
Zero-knowledge: only ciphertext + sealed vault keys + public keys stored.
- teams dashboard, accept-invite, and settings (API keys) pages, server-rendered
in the LogicSRC brand (lib/html.mjs).
- migrations (libSQL) 001_auth + 002_credshare, migrate-on-boot; Turso via
TURSO_DATABASE_URL / TURSO_AUTH_TOKEN, or a local file db for dev.
- trimmed moshcode-specific approvals/credits/push/deliver.
CLI
- `logicsrc login` now does browser loopback OAuth-PKCE against the app and
stores an lsk_ token (email-OTP removed); --token for CI. Client repointed.
Distribution
- install.sh (served at logicsrc.com/install.sh) installs the CLI from the
GitHub repo: tarball -> npm install -> `npm run build:cli` -> logicsrc wrapper.
- root build:cli builds only the CLI's workspace chain (skips web/api/next).
Cleanup
- removed the commandboard-api credshare backend (superseded by the PWA) and its
Supabase/Turso stores + libsql dep; commandboard-api tests green (40).
- removed the Next.js /teams page (the PWA is the web UI now).
Verified end-to-end: two accounts register on the PWA, mint lsk_ keys, CLI login
uploads identity keys, owner pushes an encrypted .env, teammate invited ->
accepted -> granted -> pulls the exact file. Server stores ciphertext only.
Full workspace build + tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds a `team` credential provider + team/member management so teammates can
share secrets by email instead of passing .env files over chat. Fully E2E:
the server only ever stores ciphertext, per-member sealed vault keys, and
public keys — it never sees a plaintext value or the vault DEK.
Plugin (@logicsrc/plugin-credential-sharing)
- crypto.ts: X25519 identity keys, per-vault DEK (secretbox), DEK sealed to
each member's pubkey (crypto_box_seal), value encrypt/decrypt (libsodium)
- identity.ts: local ~/.logicsrc/identity.json (0600) holding the device key
+ API token; never uploads the secret key
- client.ts: typed /api/credshare client
- providers/team.ts: `team:<slug>/<vault>` CredentialProvider (inspect,
readValues=decrypt, write=encrypt, rollback); fingerprints match env so
env<->team diffs line up
- fixes latent libsodium-wrappers ESM load bug (createRequire) here + in
github-secrets
Server (commandboard-api /api/credshare)
- zero-knowledge router: email-code auth, keys, teams, members, invites,
vaults, sealed grants, ciphertext secrets, audit; membership authz in app
- CredShareStore abstraction: in-memory (dev/tests) + Supabase (prod)
- Resend email transport for login codes + invites (no-op -> echoes locally)
- supabase migration: credshare_* tables, deny-by-default RLS
CLI
- real `logicsrc login` (email code -> token + key upload)
- `logicsrc teams create/list/invite/accept/members/vaults/grant/push/pull`
Web (logicsrc.com/teams + /teams/accept)
- management surface only (browser holds no private key, never decrypts):
login, view teams/members/vaults, invite, accept
Tests: crypto round-trip, server contract (invite->accept->push->grant->pull
+ authz boundaries), and a real HTTP+client+crypto E2E asserting the server
never holds plaintext. Full workspace build + tests green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up to #96. The template and tool-generated PRDs (moshcode /prd) ship
optional keys blank; YAML reads them as null. Accept null on owner/repo/created/
updated/discussion/implementation/tags/supersedes/superseded-by/authors so
template-derived files validate against the schema.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Reshape OpenPRD from a private single-file (prd/<slug>/prd.md, gitignored) into a
published, numbered proposal collection like BIP/EIP/DIP: prd/NNNN-slug.md +
0000-template.md + a README index, committed to the repo, with a lifecycle
(Draft → Review → Accepted → Final; Rejected/Withdrawn/Superseded).
Tools (e.g. moshcode /prd) consume this to publish PRDs into whatever repo the
user is working in.
- docs/openprd.md — rewritten: numbering, lifecycle, directory layout, conformance.
- docs/openprd/0000-template.md — the canonical template.
- packages/schemas/schemas/openprd-prd.schema.json — 4-digit id, status enum,
authors, discussion/implementation, supersedes/superseded-by.
- fixture updated to 0.2.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
validate() was creating a new AJV instance and recompiling the schema on every
invocation. Schema compilation is expensive (JSON Schema parsing, format setup).
Cache the compiled validator per SchemaKind so compilation happens once.
OpenPRD is a lightweight, single-file PRD standard (prd/<slug>/prd.md) for
humans and AI agents — the low-ceremony counterpart to OpenSpec's multi-file
change bundles. PRD documents are private by convention; only the standard is
published here.
- docs/openprd.md — the standard: file layout, front-matter, the 8 required
body sections, privacy, and the optional bridge to LogicSRC tasks.
- packages/schemas/schemas/openprd-prd.schema.json — front-matter manifest schema.
- packages/schemas/fixtures/openprd-prd.yaml — a valid manifest fixture.
- packages/validators — register the openprd-prd schema.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Reusable AdUnit component (div[data-cp-ad] + ad.js via next/script) placed
in-content on the blog index and post pages, scoped to /blog/* only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
fromHex validated only that the string was even-length, then used
parseInt(pair, 16) per byte. parseInt returns NaN for a non-hex pair, and a
Uint8Array stores NaN as 0 — so fromHex('zzzz') silently returned [0, 0]
instead of failing. Add a hex-charset check (allowing empty input) so bad
input throws. Add bytes.test.ts covering valid decode, round-trip, odd-length
and non-hex cases.
PR #86 added imapflow, nodemailer, mailparser (+types) to commandboard-api
but did not refresh package-lock.json, so Railway's `npm ci` failed with
EUSAGE (lockfile out of sync). Regenerate the lockfile; no package.json change.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mount @logicsrc/plugin-agentmail in the CommandBoard API so members can
list/read/search/send mail over the existing agentbbs Mailu server.
- src/agentmail.ts: inject imapflow + nodemailer + mailparser drivers into
the plugin's Mailu transport (kept out of the plugin by design); env-driven
builder (AGENTMAIL_BACKEND=mailu → bbs Mailu, else in-memory singleton for
dev/test). Handles STARTTLS cert-vs-loopback via AGENTMAIL_SMTP_TLS_SERVERNAME.
- index.ts: register agentMailPlugin + 7 routes under /api/plugins/agentmail/*
(mailboxes, list, read, search, send, PATCH flags, delete). Acting member
from x-agentmail-member header (else AGENTMAIL_MEMBER), paid-gated;
MailAccessError->402, DraftError->422.
- 6 route tests (in-memory backend) + contract test plugin-id list updated.
commandboard-api 20/20, builds clean.
Note: run `npm install` to refresh the lockfile for the 3 new deps.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The page band flipped from coming-soon to available, replacing the old
`logicsrc credentials plan --from env --to railway` example. Point the e2e
check at the stable `logicsrc credentials providers` line instead.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New @logicsrc/plugin-credential-sharing: a provider-neutral secret-sync engine
with env/.env, Doppler, Railway, and GitHub Secrets adapters behind one
CredentialProvider contract.
- engine: inspect -> diff -> plan -> approve -> sync -> rollback -> audit/export
- dry-run is the default for sync; --approve writes; destructive changes gated
- fingerprint-based diffs (salted SHA-256); raw values never printed or stored in
plans/runs/audit; rollback pre-image kept in a 0600 .logicsrc vault (gitignored)
- github-secrets is write-only for values (sealed-box via libsodium), so it cannot
be a sync source or value-restoring rollback target
- CLI: real `logicsrc credentials <providers|inspect|diff|plan|approve|sync|
rollback|audit|export>` (replaces the prior stub)
- 4 JSON schemas registered in @logicsrc/validators
- flip logicsrc.com/credential-sharing band from coming-soon to available
- 37 tests pass; full env->env lifecycle verified; artifacts schema-validate
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add files/publishConfig(public)/repository/keywords + prepublishOnly build;
exclude *.test.ts from the tsc build so dist (and the published tarball) ships
only library code. Package size 17 kB, 38/38 tests still green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
withX402() wraps the Web handler so unpaid calls get a standard HTTP 402
challenge (x402Version + accepts[]) and paid calls fall through to the agent.
Payment verification is injectable (host wires CoinPay/x402); CORS preflight
passes through untouched; custom challenge responses supported. README documents
the optional c0mpute.com GPU backend.
4 new tests; 38/38 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createC0mputeModel() turns a connected c0mpute.com account (apiKey + OpenAI-
compatible base URL) into a LangChain chat model, usable as the model for
createDeepAgentRunner or the chatModel for the judge/router — so agent inference
can run on community-shared GPUs. Opt-in; default stays the hosted provider.
agentswarm performs no OAuth: the host's c0mpute connector supplies credentials
(resolveC0mputeConnector / c0mputeConnectorFromEnv normalize them). DeepAgent
runner now accepts a model instance, not just a provider string.
7 new tests (defaults, env mapping, not-connected + missing-peer errors); 34/34 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
BudgetLedger interface + InMemoryBudgetLedger reference impl (reserve/settle/
release with refund of unused holds; mirrors the b1dz budget+ledger concept).
withBudget() wraps any SwarmRunner: reserves up front (throws SwarmError 402 when
out of funds, before running), settles actual cost on success, releases on error.
AgentIdentity DID aligns with @logicsrc/agentstack.
8 new tests; 27/27 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
createSwarm() composes named agents into one SwarmRunner: a router picks the
first agent; any agent hands control to a named peer via `HANDOFF: <name>`,
bounded by maxHandoffs. createLLMRouter() is a cheap-model router. Composes
with the rubric loop and HTTP handler since a swarm is itself a SwarmRunner.
6 new tests (routing, handoff, maxHandoffs cap, unknown-peer/unknown-route
fallbacks, empty-agents guard); 19/19 pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@logicsrc/agentswarm: a self-hosted, framework-agnostic multi-agent runtime
that each app mounts on its own route (e.g. tronbrowser.dev/swarm).
M1 — core:
- createSwarmHandler(): Web (Request)=>Response handler, CORS + validation
- SwarmRunner: injectable engine interface
- createDeepAgentRunner(): deepagents (createDeepAgent) adapter; deepagents +
@langchain/langgraph are optional peers loaded via dynamic import so the core
builds/tests with zero heavy deps
- SwarmError + onRequest gate: seam for x402 metering / auth (402/403)
M3 — rubric self-check (deepagents RubricMiddleware is Python-only, so ported
at the runner layer):
- createRubricRunner(): grades output via an injectable judge and revises until
it passes or maxIterations; passes through untouched when no rubric
- createLLMJudge(): cheap-model grader (lazy langchain initChatModel)
13/13 vitest pass; tsc clean; examples/server.mjs demo verified.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
M1 of the ANS SDK (docs/ans-sdk.md):
- name: parse/format ans://v<semver>.<agent>.<domain>
- cbor: minimal RFC 8949 codec for the COSE_Sign1 subset
- verify/merkle: RFC 6962 leaf/node hashing, tree build, inclusion-proof
generation + verification
- verify/es256 + cose: COSE_Sign1 build/parse, Sig_structure, ES256 (WebCrypto)
- verify/rootkeys: kid -> verifier key (JWKS entries; sumdb-note is M2)
- verify: verifyReceipt() + verifyResolution() (signature + inclusion proof +
name binding), pure and offline
- client: AnsClient resolve/rootKeys/register/status over injectable fetch,
with a DnsApplier hook for verify-dns
Tests (24) cover name parsing, CBOR round-trips/vectors, RFC 6962 proofs, a full
ES256+Merkle receipt round-trip with positive/negative cases, and the client
against mocked fetch. Wired into the root build script.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Design doc for the LogicSRC TS SDK for the Agent Name Service (ANS): resolver +
offline transparency-log verifier + registration client + coinpay-DID bridge.
Covers scope, package layout, full API surface, the ans-verify algorithm,
milestones (M1 verifier -> M2 register -> M3 DID bridge), and risks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Product requirements for @logicsrc/agentstack: summary, goals/non-goals,
users, current v0.1.0 state, functional/non-functional requirements,
roadmap (M1–M6), success metrics, and open questions. Grounded in the
existing in-memory coordinator and the agentstack OpenSpec capability.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The agentmail workspace was added to package.json but the lockfile was not
regenerated, so CI's `npm ci` failed (EUSAGE: missing from lock file). Regenerate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
AgentGit is a thin, DID-gated source-collaboration layer over a backend
forge (default Forgejo at git.profullstack.com, BBS-members-only) — not a
new git host. M1 implements the contract and engines:
- forge/adapter.ts: ForgeAdapter interface (only forge-specific surface)
- forge/forgejo.ts: ForgejoAdapter over Forgejo/Gitea REST v1 (injectable
fetch, typed errors), incl. ensureUser for member provisioning
- access.ts: gateAccess DID membership gate (owner/role/visibility)
- merge-policy.ts: evaluateMergePolicy pure engine (reviews, reputation
floor, checks, escrow, merge method, agent-merge toggle)
- service.ts: AgentGitService ties gate + policy to the adapter; refuses
policy-failing merges; provisionMember hook for AgentBBS
- schemas: logicsrc-repo + logicsrc-pull-request, registered in
@logicsrc/validators with fixtures
- docs/agentgit.md spec; plugin wired into root build (default/disabled)
27 vitest tests pass; full monorepo build green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
