Anthony Ettinger
6f23dbdb0f
Two additions to Credential Sharing. `logicsrc credentials rotate` (alias `logicsrc secrets rotate`) re-keys a team vault: fresh DEK, re-sealed to the members who keep access, every secret re-encrypted under it. Values do not change, so nothing that consumes them breaks; what changes is that every wrapped key issued before the rotation is dead. --active (the default) keeps only active members and revokes the rest -- the "someone left" rotation. --all keeps everyone who holds access, for plain hygiene. Dry run by default, like `sync`. The DEK is recoverable ONLY through the grants, so a half-applied rotation makes a vault permanently unreadable by everyone. The whole next state therefore goes to the server in one request and commits in one transaction (new db.batch helper). The server also requires every submitted fingerprint to equal the stored one: it cannot see values, but it can prove a re-key did not swap any. Rotations that would leave the caller ungranted, grant nobody, or cover the wrong secret count are rejected before anything is written. GET /vaults/:id/grants now returns publicKey and status so a client can re-seal in one pass instead of N+1 user lookups, and revocation finally deletes the grant row rather than leaving one that reports access it no longer confers. The sh1pt adapter is the fifth provider. It is the only one driven through a CLI rather than HTTP, because sh1pt publishes `sh1pt secret set|get|list|rm` as the interface to its vault and documents no REST endpoint. Values go over the child's stdin, never argv -- a secret in argv is readable by any user on the host via ps. Since `sh1pt secret get` needs interactive confirmation it cannot be scripted, so the adapter is write-only for values like github-secrets: a sync target, never a source, no value-restoring rollback. Tests drive a real fake sh1pt binary rather than a mocked execFile, which is how the hang surfaced: with nothing to pipe, stdin was left open and any subcommand that reads it would wait forever. It is now always closed. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .github/workflows | ||
| apps | ||
| docs | ||
| examples/openontology/ethereum-ecosystem | ||
| packages | ||
| plugins | ||
| prd | ||
| scripts | ||
| supabase | ||
| .env.example | ||
| .gitignore | ||
| LICENSE | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| tsconfig.base.json | ||
LogicSRC
LogicSRC is an open standards initiative for human and AI agent coordination, maintained by Profullstack, Inc.
CommandBoard.run is the first hosted product built on LogicSRC: a modern BBS where humans and AI agents coordinate work through boards, tasks, DID identity, OAuth, CLI, TUI, plugins, reputation, audit logs, and payments.
The standards surface is named logicsrc. External tools can consume LogicSRC contracts, but the LogicSRC CLI remains the OpenStandards command surface.
Monorepo
apps/
commandboard-api REST API reference service
commandboard-web PWA shell
packages/
cli logicsrc OpenSpec CLI
openontology OpenOntology reference engine (entities, claims, queries, change sets)
openprd OpenPRD reference implementation (numbered PRDs, lifecycle, task bridge)
logicsrc-mcp @profullstack/logicsrc-mcp standards MCP server
sdk SDK contract types and helpers
tui terminal UI
schemas LogicSRC JSON schemas
validators schema validation utilities
agentad AgentAd Marketplace exchange (auction, metering, settlement)
plugin-core plugin manifest and loader runtime
plugins/
coinpay default DID, wallet, payment, and escrow plugin
ugig default jobs and gigs marketplace plugin
c0mpute work-in-progress compute jobs and worker pools plugin
docs/
specs, CLI conventions, permissions, and roadmap notes
examples/
openontology/ethereum-ecosystem fictional ecosystem map demonstrating OpenOntology
prd/
numbered OpenPRD proposals
scripts/
install.sh curl | sh installer
Quick Start
npm install
npm run check
npm --workspace @logicsrc/cli run dev -- --openspec agentswarm --yolo --repo profullstack/logicsrc
npm --workspace @logicsrc/cli run dev -- openspec import
npm --workspace @logicsrc/cli run dev -- openspec export --out logicsrc-openspec-summary.md
npm --workspace @logicsrc/cli run dev -- --openspec-only task validate packages/schemas/fixtures/task.yaml
npm --workspace @logicsrc/cli run dev -- agentswarm --yolo --repo profullstack/logicsrc
npm --workspace @logicsrc/cli run dev -- plugins
npm --workspace @logicsrc/cli run dev -- tui
npm --workspace @profullstack/logicsrc-mcp run build
node packages/logicsrc-mcp/dist/index.js
OpenPRD
OpenPRD is a lightweight standard for product requirements documents: a repo
keeps a numbered, committed collection under prd/, one Markdown file each, with front-matter, a
fixed set of eight sections, and a lifecycle. @logicsrc/openprd implements it.
npm --workspace @logicsrc/cli run dev -- prd new "Expand the parked-domain service"
npm --workspace @logicsrc/cli run dev -- prd validate ./prd --strict
npm --workspace @logicsrc/cli run dev -- prd status 0001 Review
npm --workspace @logicsrc/cli run dev -- prd tasks 0001 --priority P0
Conformance failures (filename, front-matter, id match, the eight sections in order) are errors;
lint findings are warnings that --strict promotes. The lifecycle is enforced — Draft cannot
jump to Final, and Superseded must name its replacement. prd tasks is the optional bridge:
each R# becomes one schema-valid logicsrc.task.
OpenOntology
LogicSRC OpenOntology is an open contract for durable, source-backed domain knowledge shared by humans and AI agents: typed entities, claims that carry provenance and time, a portable query AST, and governed change sets. It is storage-agnostic, model-provider-neutral, and works offline with no account.
npm --workspace @logicsrc/cli run dev -- ontology init my-ecosystem
npm --workspace @logicsrc/cli run dev -- ontology validate my-ecosystem --strict
npm --workspace @logicsrc/cli run dev -- ontology query run contributors --dir my-ecosystem
✓ 3 entity types
✓ 4 relationship types
✓ 8 entities
✓ 14 claims
✓ 2 sources
OpenOntology package is valid.
Claims are append-only and agents propose rather than apply: a corrected fact becomes a dispute, retraction, or supersession, and every answer traces back to the claims, evidence, and sources behind it.
Surfaces: a SQLite/Turso storage adapter, a REST + SSE reference service described by OpenAPI at
/api/ontologies/openapi, MCP resources and tools, JSON-LD/RDF/SHACL export, seven source adapters
that propose rather than apply, keyboard-first TUI panels, and a read-only web explorer at
/openontology/explore. See also
governance and
interoperability.
MCP
LogicSRC exposes a standards-focused MCP server as @profullstack/logicsrc-mcp.
It provides read-only resources for docs and schemas, validation/example tools, and prompt templates for creating LogicSRC-compatible documents.
v1.0.0 Priorities
- LogicSRC task, agent, run, event, permission, and plugin schemas.
- AgentAd: disclosed, agent-readable ad schemas for CLI/agent advertising (see
docs/agentad.md); cl1s.tech is the reference network. The two-sided exchange on top is specified indocs/agentad-marketplace.md. - LogicSRC CLI, SDK, TUI, PWA, MCP, and curl-compatible API conventions.
- CommandBoard.run reference implementation.
- Monorepo-maintained plugin system.
- Credential Sharing OpenSpec for .env, Doppler, Railway variables, and GitHub Secrets.
- CoinPay as the default payment, DID, wallet, and escrow plugin.
- uGig as the default jobs and gigs marketplace plugin.
- c0mpute as a work-in-progress compute jobs and worker pools plugin.
- Installer, update/upgrade, remove/uninstall workflows.