Layer · identity
Identity
Sign and verify per-agent payloads.
- Submissions
- 15
- Merged
- 14
fix(identity): let concurrent runs share a keystore without breaking attestations
Follow-up found while reviewing the merged 00a013b, prioritised by Codex.
fix(cli): print join credentials for run --agent ROLE=external
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(pulse): attribute availability to the endpoint actually probed
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(evaluator): fail Track runs with duplicate or uncorrelated quote responses
One of nine independent PRs from a correctness audit of main at df0b5f1. Each merges cleanly with the others in any order; together they pass 908 tests locally on Python 3.11 and 3.14 (CI covers 3.11 and 3.12).
fix(runtime): serialize mailbox work and settle participant processes
- Serialize mailbox claim/ack/reoffer decisions with their writes and evidence events; finish is atomic/idempotent and terminal runs reject subsequent mutations.
Reject malformed run grant timestamps without changing signed payloads
Reject malformed or non-finite timestamps when verifying current Town run grants, without changing signed payloads or adding permission policy.
Make message acceptance atomic and bind the complete envelope
Make current Town's durable message acceptance atomic and bind replay to the complete message envelope.
test: require run-bound session proof at grant join
Preserves the absent/wrong-presenter test requirement from legacy #156 (@mwarsss) on current Town Run Grants. The production check already exists; this PR adds seven regressions only, with no runtime, permission or schema change.
test: preserve grant key-binding regressions from legacy #172
Retain the key-substitution regression requirement from #172 by @theCodeForgerHQ against current Run Grants.
fix(bundle): verify the declared bundle fingerprint
Verify that the manifest's declared bundle_fingerprint matches the canonical fingerprint of its file-hash map before accepting a bundle.
Enforce Run Grant permissions on join and every mailbox action
nandatown run --identity joins each role through a Run Grant: a controller-signed authorization for one disposable session key, for one run, with named permissions.
feat(agent-test): test an existing OpenClaw agent from the CLI
The headline workflow should be one clear command for a terminal-comfortable developer, not a private bridge or hand-edited adapter.
stellarminds-ai: AAE permit gate — pre-action authorization with signed denial receipts
Layer: trust · Persona: stellarminds-ai
stellarminds-ai: Real Ed25519 identity with key rotation and as-of verification
Problem: 05-identity-ed25519-key-rotation · Persona: stellarminds-ai · Layer: identity
[Fellowship Challenge] Track: a poison request is redelivered forever; claim + reproduction
Submission for the Hexaware x Project NANDA Fellowship Technical Challenge