Skip to content

v1.2.0 — Trust Vector + Action Receipt v0.1 + Capability Tokens + UETA Undo

Latest
Latest

Choose a tag to compare

View all tags
@ardakutsal ardakutsal released this 27 Apr 14:20
· 124 commits to main since this release
v1.2.0
648e335
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What ships

This release lands the agent-economy primitives on top of the v1.1 receipt foundation: multi-dimensional Trust Vector, generic Action Receipts (any tool call, not just commits), JWT-shaped capability tokens with side-effect-classed gating, and UETA §10(b) consumer-undo.

Backend

  • Trust Vector v0.1 — GET /api/v1/agents/{id}/trust-vector returns multi-dimensional reputation. Different domains stress different dimensions; null means "not yet measured", not "scored zero".
  • Action Receipt v0.1 — POST /api/v1/receipts accepts the new envelope (action_type ∈ {code_write, api_call, payment, browser_action, file_op, tool_call}, side_effect ∈ {none, reversible, irreversible}, capability_request, attestations, redaction_policy). Spec: protocol/spec/action-receipt-v0.1.md.
  • Capability tokens — POST /api/v1/capability/{issue,verify,revoke,evaluate}. JWT-shaped envelope, ECDSA-secp256k1 + RFC 6979 deterministic, Biscuit-style attenuation chain (children narrow only).
  • Capability Gate — pre-flight evaluation: agent's Trust Vector × side-effect class → {decision, [token]}. Below-threshold + irreversible → requires_human escalation, not flat denial.
  • Reversibility — POST /api/v1/receipts/{id}/undo triggers UETA §10(b) consumer-undo for reversible receipts. Refuses irreversible cleanly.
  • Public stats — GET /api/v1/public-stats for embedders + https://garl.ai/stats page.
  • Monthly cap — silent per-agent 10K/month receipt cap, env-tunable.

Solidity

  • MerkleAnchor.sol + Foundry tests + Deploy script. Single-owner, two-step ownership transfer, batch anchoring on Base L2 (~$0.001/anchor → $1-3/year for weekly anchoring). forge script ready under contracts/.

Tests

  • 313 → 484 passed, 6 skipped, 10 deselected.

Packages

Registry Package Version
PyPI garl-protocol 1.3.0
npm @garl-protocol/sdk 1.2.0
npm @garl-protocol/mcp-server 1.4.0

Cleanup

  • Removed OpenClawAdapter, OpenClawIngestPayload, /ingest/openclaw endpoint, integrations/garl-reputation/ (OpenClaw skill EOL).
  • Drift sweep: "Universal Trust Standard" / "SOVEREIGN TRUST LAYER" pre-pivot copy removed from 7 surfaces.

Deferred to a future release

  • Mainnet Base broadcast — contract + script ready under contracts/; needs operator wallet + Base ETH.
  • Cloud Team SaaS private repo — pricing/SSO/billing decisions deferred.
  • Action Receipt v1.0 sealing — needs 3-6 months of production data first.

Migration notes

  • v17 (agents.trust_vector JSONB) and v18 (receipts, capability_tokens, compensations, merkle_batches) migrations applied to the canonical Supabase. Self-hosted instances: see backend/migrations/v17_trust_vector.sql and backend/migrations/v18_wave2_foundation.sql.
  • Legacy traces table stays the home for git-commit flavored traces (GitHub Action, PR Bot). New surfaces use receipts.
  • Legacy /api/v1/trust/* endpoints stay live with Deprecation: true + Sunset: 2027-04-15 headers (RFC 9745 / RFC 8594).

🤖 Generated with Claude Code

Assets 2
Loading