Protocols +
plugins.
Every open and merged pull request on projnanda/nandatown, synced straight from GitHub. Twelve protocol layers plus Other — merged PRs land in their layer the moment they merge.
130
111
12/12
Transport
How bytes move between agents.
Communication
Message framing and request/response semantics.
Identity
Sign and verify per-agent payloads.
Registry
Publish and discover agent cards.
Auth
Issue, verify, and revoke capability tokens.
Trust
Reputation scores, attestations, reports.
Payments
Quote, pay, verify, refund.
Coordination
Group decisions and task allocation.
Negotiation
Bilateral bargaining.
Memory
Shared key-value with subscribe and CAS.
Privacy
Encryption and zero-knowledge proofs.
Data Facts
Dataset publish, fetch, and ACL.
Other
Builds that reach beyond the twelve layers.
All pull requests
Merged first,
newest next.
[Fellowship Challenge] registry: index.owned.v1, forbidding a forged card from erasing an honest listing
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Track: quote-amnesia-restart, a seller that forgets work it already answered
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] trust: reputation.capped.v1, a per-observer influence cap
trust/reputation.v1 sums +1/-1 per receipt with no bound on how much any single observer can move a score. reputation_consistent is explicit that it checks the recorded claim, not whether the reporter told the truth or held authority.
[Fellowship Challenge] Path profile for a reused order id with changed terms
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
fix(dashboard): check a submitted source_url is an http(s) URL again
Flagged by an automated security review of main, and confirmed by hand.
fix(identity): let concurrent runs share a keystore without breaking attestations
Follow-up found while reviewing the merged 00a013b, prioritised by Codex.
fix(replay): step through Path bundles instead of crashing
Follow-up found while reviewing the merged 00a013b, raised by Codex.
fix(pulse): record a malformed redirect as the answer the server gave
Lower-priority follow-up to the review of merged 00a013b.
fix: use credentials written into an endpoint URL, never record them
Follow-up to the review of merged 00a013b: URL confidentiality.
docs: say which historical bundles replay, and which cannot
Lower-priority follow-up to the review of merged 00a013b: statements about
fix(evaluator): 0.5.0 binds duplicate delivery to the injected offer and lets only a terminal buyer verdict decide
Follow-up to the review of merged 00a013b. Two of its findings change what the
fix(track): report an application whose acknowledgement was fenced
Follow-up to #264–#277, from the same correctness audit of main at df0b5f1.
fix(coordinator): refuse JSON values the run cannot export
Follow-up to #264–#272, from the same correctness audit of main at df0b5f1.
fix(bundle): read JSON Lines records at LF only
Follow-up to #264–#272, from the same correctness audit of main at df0b5f1.
fix(cli): stop Track processes when the CLI receives SIGTERM
Follow-up to #264–#272, from the same correctness audit of main at df0b5f1.
fix(runner): refuse a Track timeout too short for Town's counterparts
Follow-up to #264–#272, from the same correctness audit of main at df0b5f1.
test(participants): wait for the seller's ack before asserting it
Follow-up to #264–#272, from the same correctness audit of main at df0b5f1.
fix(pulse): refuse a reused --target name
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(path): fail resolution on a malformed local index
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(path): record undecodable terminal output as the subject's
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(cli): print join credentials for run --agent ROLE=external
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(runner): wait for an external buyer's verdict before finishing
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(pulse): attribute availability to the endpoint actually probed
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(receipt): refuse receipts over bundles that fail verification
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(path): keep the tested endpoint and its rerun exact
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(evaluator): require boolean acknowledgement flags and judge every accepted request
Two pre-existing evaluator gaps, reported against #264 and confirmed to
fix(evaluator): fail Track runs with duplicate or uncorrelated quote responses
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
docs(town): align the current manual, trace viewer and build checks
Bring the public entry points into agreement with the rebuilt Town code and its actual evidence boundaries:
fix(packaging): ship runtime assets and verify built distributions
- Regenerate stale exported record schemas and test them against the live models.
fix(catalog): bound submissions and commit history atomically
- Bound streamed JSON request bodies and individual catalog fields before any database work, with shared validation for the API and submission form.
fix(viewers): safely render evidence and rank only verified bundles
- Render participant-controlled viewer values as inert text, escape the HTML title/script-data boundary, constrain styles, and support the actual Path profile and empty timelines.
fix(imports): preserve pinned snapshots and disclose incomplete imports
- Refuse silent replacement of an on-ramp snapshot and validate the full pinned release reference on an idempotent re-import.
fix(runtime): serialize mailbox work and settle participant processes
- Serialize mailbox claim/ack/reoffer decisions with their writes and evidence events; finish is atomic/idempotent and terminal runs reject subsequent mutations.
fix(evidence): bind receipt claims and version strict Path evaluation
A valid signature alone was too easily confused with agreement between a receipt's claims and its bundle. Incomplete/malformed bundle manifests and replay ambiguities could also undermine downstream verification.
Bind marketplace settlements to capped negotiations
- Enforce the stock marketplace buyer's configured unit-price cap before an order or escrow hold can be created.
Fail closed on invalid fault-rule numbers
- Validate every current fault-rule numeric field before a run starts.
Reject duplicate bids in sealed-bid auctions
- Make the current advertised sealed-bid auction accept at most one bid from each bidder before award.
Stop fetching untrusted catalog URLs on submission
- Stop the catalog form from fetching user-submitted URL and GitHub sources.
Reject malformed ledger amounts before mutation
- Enforce the declared integer-cent domain at every current ledger entry boundary.
Reject malformed run grant timestamps without changing signed payloads
Reject malformed or non-finite timestamps when verifying current Town run grants, without changing signed payloads or adding permission policy.
Make message acceptance atomic and bind the complete envelope
Make current Town's durable message acceptance atomic and bind replay to the complete message envelope.
Add optional quote-intent profile for cheaper wrong-item failures
Add the optional a2a-quote-intent@0.1 profile to the existing Path runner. A quote within the price ceiling is not enough if it describes the wrong item.
test: require run-bound session proof at grant join
Preserves the absent/wrong-presenter test requirement from legacy #156 (@mwarsss) on current Town Run Grants. The production check already exists; this PR adds seven regressions only, with no runtime, permission or schema change.
fix(catalog): guard form submission re-entry
Rescues the client-side re-entry guard from @stanleyoz's legacy #204 onto current main. The retained SkillMD form could queue a second action when submit events arrived before the pending render or while the first action was outstanding.
fix: validate catalog sources and label unchecked links
Preserve the useful current-catalog requirements from #130 by @nonggde and the review by @dhve, without adding another automatic remote probe.
fix: bind Lab auction settlement to its task and payee
Current Lab auction settlement checks the payer and amount but not the payee or task. A real local run with the ledger transfer redirected to a losing bidder still reports passed, even though the auctioneer receives zero.
fix: verify correlated majority evidence in Lab consensus
Fix a false-positive in the current Lab consensus evaluator. It previously counted delivered prepare_ack events and entries in the proposer’s acks list without independently establishing distinct eligible voters or binding the…
test: preserve grant key-binding regressions from legacy #172
Retain the key-substitution regression requirement from #172 by @theCodeForgerHQ against current Run Grants.
fix(lab): verify receipt-backed reputation arithmetic
The marketplace reputation stage previously accepted two updates ending at score 2, even if receipt events were absent, a receipt named a different seller, or the first score was 999.
fix(path): require exact fulfillment request correlation
Require a fulfillment's returned request_id to match the exact, nonempty order identifier Town issued and recorded as the event subject.
fix(runner): reject unknown agent override roles
Reject unsupported role keys in both harnesses and external before starting a Track run.
fix(receipt): verify evidence before rendering Town Proof
Require successful bundle verification before rendering Town Proof or automatically creating its receipt.
fix(bundle): verify the declared bundle fingerprint
Verify that the manifest's declared bundle_fingerprint matches the canonical fingerprint of its file-hash map before accepting a bundle.
fix(lab): disclose untested scope of imported scenarios
Imported legacy scenarios run Town reference agents, not their original plugins or validators. Previously a declared network_partition disappeared silently, and a generic adapted exchange could pass without any result saying that the…
fix(a2a): bound streamed responses and version transport policy
Bound external AgentCard and native A2A JSON responses before parsing, and record the effective transport policy in each Path run.
fix(lab): require scenario coverage before a passing verdict
A registered Lab validator can return no scenario checks and still receive a passing verdict from generic checks. This change makes missing scenario coverage explicit before those generic checks are appended.
fix(path): preserve the explicit profile in rerun commands
Generated Path rerun commands used --profile, but the already-running-agent CLI consumes --path-profile. A rerun therefore used the current default instead of the profile recorded in the evidence bundle.
feat(agent-test): test an existing OpenClaw agent from the CLI
The headline workflow should be one clear command for a terminal-comfortable developer, not a private bridge or hand-edited adapter.
feat(agent-test): run managed runtimes through Town
A prepared runtime still needs lifecycle-safe orchestration through the shared loopback adapter and Town evaluator without coupling the engine to OpenClaw internals.
feat(agent-test): add a bounded OpenClaw connector
Testing an existing OpenClaw agent needs a bounded connector that checks the behavior Town relies on without locking users to one release or guessing across incompatible routes, retries, or output envelopes.
refactor(agent-test): share the local adapter server
The managed-runtime path needs the same strict authenticated loopback server as the public reference adapter without duplicating or drifting its wire behavior.
feat(agent-test): add the local-adapter CLI
Developers need a documented command to attach a strict local adapter, run the Town test, and consume stable human or machine-readable results.
feat(agent-test): evaluate external agents in Town
A successful adapter exchange is not enough: Town must drive the participant through a real deterministic workflow and emit honest, stage-specific evidence instead of a single opaque score.
feat(agent-test): add a hardened loopback HTTP driver
Town needs a small local adapter transport with strict authentication, bounds, timeouts, and failure attribution before external agents can safely participate in a test run.
feat(agent-test): define version 1 contracts and profiles
External-agent tests need a strict, versioned contract whose wire bytes, profile identity, result semantics, and extension boundary are reviewable independently of transport and CLI code.
feat(town): add deterministic capability testing support
Town needs a deterministic, real execution seam before an external agent can be evaluated through the simulator without coupling generic scenario code to the agent-test feature.
Fix/enforce grant permissions
Merging branch with added visualization.
Enforce Run Grant permissions on join and every mailbox action
nandatown run --identity joins each role through a Run Grant: a controller-signed authorization for one disposable session key, for one run, with named permissions.
Add Agentic Commerce Hackathon page
Adds a page promoting the Agentic Commerce Hackathon (Devfolio, July 31 - Aug 2 2026), where Project NANDA is a partner sponsor.
Trust/Payments layer: verifiable capsule receipts (capsule-emit-nanda) — rebuild addressing #177
Re-opens the work from #54 → #177 (closed by @Skyrider3), rebuilt to address every
Trust layer: verifiable capsule receipts with CCF write-receipt anchoring
Re-opens the work from #54 → #177 (closed by @Skyrider3), rebuilt with a fundamentally
Nanda Town UI: audience-choice voting, live PR gallery, and site cleanup
Brings the live nandatown.projectnanda.org UI onto the repo. All commits authored by dhve. Changes are confined to apps/nest-dashboard/ (no packages/ or scenarios/ touched), so this composes with the merged hackathon PRs already on main.
Revert "[Hackathon] distributed-sys-engg: deterministic negotiation session ids (ADR-004 sibling fix)"
Reverts projnanda/nandatown#184
distributed-sys-engg: deterministic negotiation session ids (ADR-004 sibling fix)
Persona: distributed-sys-engg — reliability/determinism focus.
calyirex: validators must not certify corrupted ground truth (3 fixes: auction shill, voting inflation, revocation laundering)
Three validator fixes, one defect class: a validator that reconstructs 'ground truth' from attacker-influenceable data ends up certifying the very corruption it exists to catch.
replay-safe: comms replay-attack resistance on top of authenticated
I picked #01 — versioned message schemas
[hackathon phase 1] fix: return defensive copy from CidFacts.fetch()
Fixes a bug where CidFacts.fetch() returned the mutable internal object instead of a copy, which allowed the caller to unintentionally tamper with the registry content.
dashrath: agent_receipts — sever collusion by evidence shape, not size (closes #97)
Credit to @SwasthikaDev's issue #97 for identifying the flaw.
dhritimandas: capability-conformance registry gate
AgentCard.capabilities (nest_core/types.py:82) is a bare, self-asserted list[str]. Registry.lookup() does string matching against this list.
Hackathon/parsa noah mesh revocable auth
delegatable (#138) solved delegation, but its revocation set is one in-process
Redeem_Grimm: authenticate failure-detector heartbeats against a forgery attack
This is a direct follow-up to the failure-detector layer merged in #46. In the review on merge, @Skyrider3 flagged two gaps, and both are worth fixing:
ckeda-security: delegatable capability tokens with cascading revocation
Branch: hackathon/ckeda-delegatable-auth · Problem 04
bogacsmz: byzantine-resistant gossip registry — signed-equivocation quarantine + eclipse resistance
Persona for this review: trust/honesty auditor. I built the adversarial
libre: attested-peering trust plugin
Persona: libre — a self-sovereignty / decentralized-infrastructure engineer
moltpass.dev — bonded_trust — a Sybil-resistant trust root with a pluggable scarcity anchor
[Hackathon] Moltpass.dev — bonded_trust — a Sybil-resistant trust root with a pluggable scarcity anchor
validators: fix auction_winner_highest trusting the announced amount over real bids
Fixes validate_auction_winner_highest returning PASS for an auction where a lower bidder was awarded, when the won: message announces a winning amount inflated past every real bid.
hackathon/sam04-trust-gated-privacy
The merged hybrid_x25519 plugin (#28) answers *who* can read with a static, all-or-nothing audience — it is deliberately trust-blind. Meanwhile the trust layer computes reputation scores that no privacy plugin consumes.
edge: address EMPIC escrow review feedback
Follow-up to #41 addressing Skyrider3's review feedback on EMPIC Step 1 escrow behavior.
protocol-security-engineer: tamper-evident comms that resist version downgrade
A new authenticated comms plugin. It's versioned plus an HMAC-SHA256 tag over
stellarminds-ai: AAE permit gate — pre-action authorization with signed denial receipts
Layer: trust · Persona: stellarminds-ai
trust: parc — selective disclosure via Merkle inclusion proofs (stacked on #63)
Selective disclosure for trust: parc credentials: a holder reveals only chosen receipts from their ledger, each with a Merkle inclusion proof against the credential's signed behavioral_merkle_root — a verifier confirms every revealed…
stellarminds-ai: PARC — portable reputation credentials with a recomputing admission gate
Reputation in NEST dies with the run. Every trust plugin holds an in-memory ledger; nothing exports it, carries it, or verifies it in another trust domain — an agent that migrates starts from zero, and a domain that wants to admit a…
Redeem_Grimm: failure-detector layer with a phi-accrual liveness oracle
NANDA Town models failure by injection. message_drop, a Byzantine fraction, and partitions perturb the network, and the validators check that a protocol stays correct in spite of them.
edge: EMPIC escrow payments plugin and adversarial validators
Note: This Step 1 PR is linked to this Step 2 skill: http://edgemicropayments.ddns.net:8099/skill.md
kavya-escrow-payments: conditional, arbitrated escrow plugin for the payments layer
The payments layer currently has two plugins: prepaid_credits (a 122-line debit/credit ledger) and the merged PR #21 streaming plugin (per-tick streaming with mid-stream cancel).
swamx: Partition-tolerant BFT coordination with HotStuff
[Hackathon] swamx: Partition-tolerant BFT coordination with HotStuff view-change
data-engineer: content-addressed datafacts with provenance and signed freshness
[08 — content-addressed datasets with provenance chains and freshness proofs](docs/hackathon/problems/08-datafacts-content-addressed.md).
simon-mechanism-design: Pareto-seeking multi-attribute negotiation with a dominance validator
The reference alternating_offers plugin collapses multi-attribute bargaining into a one-dimensional price fight: its respond only looks at terms.price and never reads conditions['deadline_days'].
[NandaHack] privacy: hybrid_x25519 — real hybrid encryption, selective disclosure & broadcast revocation
Persona: applied-cryptography / security engineer. The code is
stellarminds-ai: Receipt-corroborated reputation with collusion-ring severance
Layer: trust · Persona: stellarminds-ai
stellarminds-ai: Real Ed25519 identity with key rotation and as-of verification
Problem: 05-identity-ed25519-key-rotation · Persona: stellarminds-ai · Layer: identity
bori7-onchain-registry-author: gossip registry plugin with partition-honest eventual consistency
[#06 registry-gossip-eventual-consistency](https://github.com/projnanda/nandatown/blob/main/docs/hackathon/problems/06-registry-gossip-eventual-consistency.md).
[NANDAHack] Improve memory layer: LWW-Register CRDT plugin with convergence validators
Adds a state-based last-writer-wins register CRDT (lww_register) for the memory layer, fixing the blackboard's order-dependent, silently-diverging writes.
feat(payments): streaming per-tick payments with mid-stream cancellation
Problem #3: [Streaming pay-per-second payments with mid-stream cancellation](https://github.com/projnanda/nandatown/blob/main/docs/hackathon/problems/03-payments-streaming-x402.md)
wire-compat: versioned comms layer with forward/backward …
…compat
[Platform] Hackathon marketplace UI: /hackathon section with submissions, layers, authors
Extends the existing apps/nest-dashboard Next.js 16 app (App Router, React 19, Tailwind 4). Same cream / ink / rust palette, Instrument Serif / Geist Sans / Geist Mono, same paper-texture, eyebrow, btn-primary utilities — no new design…
[Platform] Research harness for A/B hackathon experiments
Ships scripts/harness/ — multi-condition, reproducible experiment infrastructure to turn the hackathon into a publishable AI benchmark.
[Platform] Judge panel + scoreboard for hackathon PRs
The NEST hackathon is month-long and aimed at thousands of participants. Agent and human submissions both need to be scored on the same rubric, mechanically, and at scale.
[Platform] Open problems + charter + judging doc
Ships the participant-facing scaffolding for the NEST hackathon:
[Platform] CI hygiene: Makefile, pre-commit, feedback bot, Definition of Done
Closes the gap where hackathon contributors run ruff check + pytest, call that "the tests", and ship PRs that fail CI on ruff format --check and/or pyright.
[Platform] Integration v2
Rebuild post-schema-recon + post-live-judge. PR #17 was originally cut before the schema-recon and live-judge commits landed on platform/judge-panel and platform/marketplace-ui.
Add missed-ack-escalation scenario: 3 dropped prepare_acks force retr…
New scenario testing consensus recovery when acknowledgments are dropped.
examples(llm_market): model-driven buyers in a sealed-data market (stacked on #298)
Depends on #298. Merge after it. This branch is stacked on #298, so until #298 merges the diff also shows its commits. The only new commit is the last one, examples(llm_market). It was moved out of #298 at review, unchanged.
fix(evaluator): do not pass `correct` on an assertion the run contradicts
…icts
Report: attribute the processed claim to the seller's acknowledgement
Town reads the seller’s recorded acknowledgement but doesn’t observe the seller applying the task. This rewords the processed stage so the report says what the evidence is, and adds a test for it.
[Fellowship Challenge] Add terminal Contract-Net task cancellation
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] negotiation: posted-price clocks, Dutch and IOC-limit rising, that hold a delayed accept to a safe price
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] payments: a duplicated award settles once and leaves a verifiable replay record
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] privacy: redact.values.v1, a secret copied under another field name stays out of the evidence
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Lab: bounded voting finality under delayed ballots
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] payments: add bound.v1, escrow that pays only the seller it names
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Lab: prevent a losing bidder from being paid for a supply-chain part it was not awarded
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] payments: hashlock.v1, sealed digital goods and payment change hands in one step
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] haggle.expiring.v1 - an offer lapses; a stale acceptance is refused
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Coordination: one-shot ContractNet finalization under duplicate delivery
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Expiring memory (ttl.v1) for the memory layer
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Partition fault: consensus stays safe while the town is split
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Track: a poison request is redelivered forever; claim + reproduction
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] payments: leased escrow, a stranded hold refunds itself when its lease ends
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge
[Fellowship Challenge] Corrupt fault: prove signed message bodies survive tampering in transit
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge