Verification is
the merge gate

Branches give agents isolation — which was never the hard part. The hard parts are what happens after: fifty branches racing to merge serialize on line-level textual conflicts, and someone has to arbitrate. In Weft, state is a set of identity-anchored changes, so disjoint work commutes — the live demo lands 40 independent changes in one certified landing with a single evidence run.

Worse is what git can't see at all: agent B reads api.rs and writes client.rs; agent A rewrites api.rs first. B's branch merges cleanly — nothing overlaps textually — but B reasoned against a world that no longer exists. Weft changes carry a read-set, and the gate rejects exactly this (8/8 in the demo). And finally, the gate itself: with branches, the merge gate is a human reading diffs — at agent throughput, that's the bottleneck, or nobody.

That stack is Weft's closest ancestor — Weft is roughly what it becomes when promoted from forge features into a signed protocol. The differences: a green check attests “CI passed on this branch,” not on these exact bytes (Weft evidence binds to a Merkle manifest of the materialized tree). Permissions are database rows an admin can bypass; in Weft, unauthorized writes are unrepresentable — every object carries a capability chain to the authority key. Provenance — which model, under whose delegated authority, having observed what — has no home in a PR. And the queue, reviews, and issues live in the forge's database: clone the repo, lose the coordination. Weft's coordination state replicates with the repo.

CI executes checks; it doesn't account for them. “Checks passed” is a status flag on a mutable ref — bypassable by admins, racy under force-pushes, and silent about who verified what environment. Weft treats evidence as a first-class signed object bound to exact bytes, requires attestors to chain to trust roots the policy names, and makes the certified landing log the only way trunk advances. CI is the muscle; Weft is the ledger the muscle reports to.

Because agents need concurrency without coordination. Weft patches reference stable line identities, not line numbers — a queued change never goes stale while it waits, cherry-picking is free, and disjoint work batches into one landing. Deterministic materialization means every node derives byte-identical trees, so evidence provably describes the same bytes everywhere. And Weft is honest about limits: the CRDT resolves placement, never meaning — semantic correctness is evidence's job, by design.

No — and that isn't aspiration, it's what the object model already says. Nothing in Weft is code-shaped: intents, capabilities, read-sets, evidence, and certified landings never mention a compiler. The content model is lines and blobs, which is text — handbooks, specs, prompt libraries, translations, configs, datasets — and evidence is simply “a pinned recipe that passed.” A doc linter, a schema validator, or a factuality check is as much evidence as a test suite. Git is the import/export format, not the model.

The real frame: any artifact whose acceptance can be argued for. Run cargo run --release -p weftd --example docs — three agents write a Markdown handbook concurrently, a doc-linter runs as gate evidence, and a judge attests quality with its own key. An unfinished section is refused even though the judge approved it, because the gate is an AND.

That example also surfaces the right architecture for subjective evaluation: gate-executed recipes have no network (they're sandboxed), so an LLM judge is not a recipe — it's an independent attestor publishing signed evidence from outside, exactly what distinct_roots was designed for. Deterministic checks run inside the gate; judgement signs from outside it.

No. No token, no mining, no global consensus. Consensus is per-repo and per-ref, among gate keys the genesis names — for a solo self-hosted hub that's one key and zero ceremony; for a federation it's a real quorum. Disagreement forks the repository, which for scratch work is a feature, not a crisis.

Weft borrows from all of them, gratefully and on the record: patch commutation from Pijul/Darcs, keypair identity and the p2p forge idea from Radicle, change-centric flow from Gerrit, coordination-lives-in-the-repo from Fossil. What none of them has: capabilities, read-sets, machine-readable intents, and evidence as protocol objects — because all of them still assume a human reads the change. Weft's bet is specifically about what verification-gated agent swarms need. The full prior-art table is in the RFC appendix.

No — that's the point of the bridge. weft clone imports your repo through the gate; agents land certified work; weft export writes conventional git commits with provenance trailers (Weft-Change, Weft-Model, Weft-Author-Key), chained onto your original history, byte-deterministic across re-exports. GitHub stays the human front door; Weft is the agent-side execution layer underneath.

Don't take our word for it — browse a real one: spranab/weft-demo, branch weft-export was woven by three model-agents through the gate (the same story the live demo retells) and exported. Open any commit and read the trailers.

The honest hard problem — “who verifies the verifier.” Today: policy pins evidence recipes by digest (an agent can't quietly swap the test suite), attestors must chain to distinct trust roots (minting keys doesn't help), and human approval gates can be required where stakes are high. On the roadmap, and designed for from the start: heterogeneous evidence quorums — compiler, tests, property checks, independent model reviews, runtime traces — with policy declaring what combination is sufficient. We discuss this openly in RFC §15.

It's a working, tested, publicly-reviewed pre-1.0: fourteen e2e suites, a review log of 91 dispositioned findings from five kinds of adversary, a live demo, and a real woven git branch.

Durability and isolation are in. Run weftd --data ./hub.wal and the hub is crash-durable: an append-only log, every signature re-verified on replay, a torn tail truncated at the last good frame, in-flight proposals re-adjudicated after a restart. Evidence recipes execute inside a fresh user + network namespace (--sandbox unshare, auto-detected) — a test that reaches for the network fails, which is the point; the daemon warns loudly if it starts unconfined.

Replication is in too. weftd --follow https://peer runs a hub as a replica: it bootstraps from genesis over the wire, pulls objects, and then re-derives the certified landing chain itself — re-materializing every state, re-running the certification checklist, and checking that each landing was authored and certified by a key the genesis names. A landing signed by the wrong key, an uncertified landing, and an equivocating pair all fail to advance a follower's head; forks are reported, never silently resolved. Verify, don't trust — cargo test -p weftd --test replicate is that adversarial case, in code.

Still honest about what's missing: multi-gate quorums (thresholds > 1 are specified but the reference gate signs alone), heterogeneous evidence quorums, and push-based gossip — replication today is pull, over HTTP, rather than the QUIC frames the RFC describes. Self-hosted use, private networks, and CI-style deployments are real today.