Weft is an open-source, self-hosted execution ledger for autonomous coding agents. Swarms work one repository concurrently; every change carries signed provenance, machine-checkable intent, and evidence — and lands only when a certified gate says it's proven. Git stays as your front door.
curl -fsSL https://weftgate.com/install | shprebuilt binaries · no signup · weftd then localhost:8747 · agents: weftgate.com/llms.txt
Software collaboration was built on one assumption: a human reads every change before it becomes real. Commits carry prose for a reader. Pull requests exist to chunk work into human-sized pieces. Review is the gate.
Agents break that assumption by two orders of magnitude. A single agent generates more reviewable change in an hour than a person carefully reads in a day. Point five at one repository and you have already lost.
Your fleet runs at one person's reading speed. You bought parallelism and throttled it to a single lane.
Skim, approve, merge. Now nothing checks anything, and unverified generated work is the artifact.
Most teams are quietly sliding from the first to the second, one “looks fine” at a time.
Review was never the gate because humans are good at reading diffs. It's the gate because something has to check before work becomes real — and human attention was the only checker we had.
That stopped being true. Almost everything that matters about a change is machine-checkable: does it compile, do the tests pass, does the citation resolve, does the schema hold, did the agent reason against current state, was it even authorized to touch that path.
Weft replaces the human as the gate with evidence — signed, and bound to the exact bytes. Work lands when it proves itself. Humans move up a level: you decide what must be true, not whether these 400 lines are fine.
Disjoint work commutes, so fifty agents produce one reviewable landing with one evidence run — not fifty pull requests.
“citation [9] is not in references.md”, not “LGTM?”. An agent can act on the first one without a human in the loop.
Every line traces to a model, a delegated capability, and a human authority key.
Even when the diffs don't overlap — the failure git structurally cannot see.
Scoped, expiring, revocable capabilities instead of a shared bot token nobody audits.
One landing to reason about, per-line accountability preserved — and it exports to git as ordinary commits.
Everything forges layered on git assumes human attention is the scarce resource. Agents break that assumption — so Weft removes the ceremonies that existed only to ration it.
The whole protocol in one loop: intent → capabilities → concurrent work → the gate → a certified landing → conventional git commits out the other side.
Fifty agents, one hundred tasks, one repository, no branches, no pull requests — the shipped demo, deterministic across runs (source):
Four agents — real local models via Ollama — write four sections of a research paper concurrently. One fabricates a citation, the way real models do:
The citation checker ran on the exact materialized bytes; a judge attested from outside the sandbox; bisection isolated the bad section so the other three still landed. Nothing here is code-shaped — the artifact is Markdown and the evidence is a linter. full walkthrough, with Hermes agent prompts ↗
50 agents · 100 tasks · one repo · no
branches, no PRs. Stale reads, planted bugs and revoked credentials all
bounce.
--example swarm
Four local models write a research
paper; a fabricated citation is refused while the rest lands.
--example paper
A handbook: doc-linter as gate evidence,
an editor-judge attesting quality with its own key.
--example docs
Ingest, CRDT materialization, and gate
throughput — batched versus contended.
--example bench
Trunk is a hash-chained log certified by a gate quorum. History removal is unrepresentable; disjoint work batches into single landings, amortizing verification.
An agent is an Ed25519 key with delegated, scoped, expiring, revocable authority. Roles are minting templates — never database rows an admin can bypass.
Changes record what the agent observed, not just what it wrote. When concurrent work invalidates that reasoning, the gate catches it — even with disjoint patches.
Repository text is data unless its authors hold the instruct capability — a protocol-level answer to repo prompt injection.
weft clone an existing repo; agents land certified work; weft export writes conventional commits with provenance trailers. GitHub keeps its front door — browse a real woven branch ↗.
Claude, GPT, Qwen, or your agent connects over the Model Context Protocol: lease intents, edit by line number, land through the gate. Refusals name the key a human should authorize — plug in your framework ↓.
Any host with an MCP client works with no integration code at all. Native plugins ship for two of them, for when you want the host's own lifecycle and config surface.
Tools: repo_status · intent_lease · workspace · change_submit · approve · note_add · provenance
Adds an on_session_end hook that writes a session note into the repo's own memory. Tested end to end against a running gate — refusal → delegation → landed → provenance to the authority root. repo ↗
Built on the OpenClaw plugin SDK — definePluginEntry, typed config, registered service and tools. Typechecks against the host SDK; the Hermes path is the one exercised end to end so far. repo ↗
Both keep the agent's Ed25519 key on the agent's machine — the hub returns a digest to sign and only ever receives signatures. all three paths ↗
Six situations, no hypotheticals — every claim below maps to a shipped feature you can run.
Today: you launch agents at midnight and wake to thirty branches, a wall of PR tabs, and merge conflicts. You are the bottleneck to your own tools.
With Weft: you wake to a certified ledger. Everything landed passed your pinned checks; everything rejected names its reason — stale read, failed evidence, revoked key. Mornings start with reading the log, not triaging branches.
Today: agents share a bot account with an org-wide token, and “who approved this AI change?” has no good answer.
With Weft: each agent holds a scoped, expiring capability; every line traces model → delegation → authority key; revocation is instant while certified history stays valid. An AI adoption story your security team can actually sign.
Today: every low-effort AI pull request costs your attention just to close. The flood taxes exactly the resource it ignores.
With Weft: contributions — human or agent — must pass your pinned suite and policy before they earn eyes; the bridge returns clean, provenance-trailed commits to GitHub. Your attention is spent only on work that already proved itself.
Today: handbooks and runbooks rot, and once agents help write them, nobody knows which model wrote what or why to trust it.
With Weft: agents propose sections, a doc-linter gates structure and links, and an editor — human or model — attests as a judge with its own key. Runnable now: --example docs. Every paragraph has provenance.
Today: audit season means weeks of screenshots, tickets, and reconstructed timelines.
With Weft: the hash-chained, signed landing log is the change record — and auditors don't take your word: they run a verify-don't-trust replica (--follow) that re-derives the whole chain itself. Audit prep becomes a URL.
Today: several models draft sections, someone pastes them together, and a fabricated citation survives because nobody checked every bracket by hand.
With Weft: agents write concurrently against a shared reference list; a citation checker runs on the exact bytes and the section citing a source that doesn't exist never lands — while the other three do. Real local models, runnable: --example paper. walkthrough ↗
Today: a score lives in a spreadsheet, unlinked from the exact artifact version that earned it.
With Weft: evidence binds to a Merkle manifest of exact bytes, and judges sign from distinct trust roots. “Which version scored 84%?” stops being archaeology and becomes a cryptographic lookup.
Three workloads. Identical agents, identical contributions, assembled two ways — then the same validator run over both. The difference isn't an argument, it's an exit code.
4/4 unguarded outputs failed their own validator. 4/4 gated outputs passed it. The agents were identical in both columns — nobody got smarter and nobody wrote a better prompt. The only difference is whether anything checked before the work became the artifact. Browse every file, and the notes on what's planted vs realistic: docs/showcase ↗ · regenerate with --example showcase
Every claim on this page has a receipt — and you don't have to run anything to see it. These are recorded runs: unedited terminal output from real machines, with the source beside each one if you'd rather reproduce it.
Prefer it as a paper? Weft: Evidence-Gated Version Control for Autonomous Agent Swarms — peer-citable, DOI 10.5281/zenodo.21882499 ↗ — design, related work (optimistic concurrency control, verifiable logs, supply-chain attestation), the evaluation above, and a limitations section that names what is not solved. PDF ↗ · markdown source ↗
Index of every recorded run, with notes on what they deliberately show rather than hide: docs/runs ↗
RFC-0001 survived two independent frontier-model adversarial reviews, an executable prototype, clean-room CI, a public review, and a 50-agent live demo — each catching a class of defect the others missed. Every finding and its disposition is public.
The strongest versions of the questions we'd ask ourselves — answered concretely, and honestly where the answer is “that's a real limit today.”
Branches give agents isolation — which was never the hard part. The hard parts are what happens after: fifty branches racing to merge serialize on line-level textual conflicts, and someone has to arbitrate. In Weft, state is a set of identity-anchored changes, so disjoint work commutes — the live demo lands 40 independent changes in one certified landing with a single evidence run.
Worse is what git can't see at all: agent B reads api.rs and writes client.rs; agent A rewrites api.rs first. B's branch merges cleanly — nothing overlaps textually — but B reasoned against a world that no longer exists. Weft changes carry a read-set, and the gate rejects exactly this (8/8 in the demo). And finally, the gate itself: with branches, the merge gate is a human reading diffs — at agent throughput, that's the bottleneck, or nobody.
That stack is Weft's closest ancestor — Weft is roughly what it becomes when promoted from forge features into a signed protocol. The differences: a green check attests “CI passed on this branch,” not on these exact bytes (Weft evidence binds to a Merkle manifest of the materialized tree). Permissions are database rows an admin can bypass; in Weft, unauthorized writes are unrepresentable — every object carries a capability chain to the authority key. Provenance — which model, under whose delegated authority, having observed what — has no home in a PR. And the queue, reviews, and issues live in the forge's database: clone the repo, lose the coordination. Weft's coordination state replicates with the repo.
For most repositories you don't write one — you point at the checks you already have. An evidence recipe is a command. If your project has a test command, that command is a valid gate today, unmodified:
"recipes": [{ "kind": "test", "cmd": ["python", "-m", "pytest", "-q"] }]
That's the entire gate for one of the showcase scenarios — three agents extend a module, one "improves" a function in a way that breaks the existing test, and the gate refuses it. Nothing was written for Weft. cargo test, npm test, go test ./... work the same way.
There's a ladder above that: no recipes at all is legal (you still get provenance, capabilities and concurrent landing); then your existing CI checks, one line each; then a domain check like a CSV schema or citation validator, which in the showcase are about ten lines of Python; then human approvals on sensitive paths; then independent judges from distinct trust roots for subjective work. Most teams sit between rungs one and three indefinitely.
What is real work, stated plainly: key management, running the hub, deciding policy — and the fact that a bad check is worse than no check. The full answer, with costs per rung ↗
CI executes checks; it doesn't account for them. “Checks passed” is a status flag on a mutable ref — bypassable by admins, racy under force-pushes, and silent about who verified what environment. Weft treats evidence as a first-class signed object bound to exact bytes, requires attestors to chain to trust roots the policy names, and makes the certified landing log the only way trunk advances. CI is the muscle; Weft is the ledger the muscle reports to.
Because agents need concurrency without coordination. Weft patches reference stable line identities, not line numbers — a queued change never goes stale while it waits, cherry-picking is free, and disjoint work batches into one landing. Deterministic materialization means every node derives byte-identical trees, so evidence provably describes the same bytes everywhere. And Weft is honest about limits: the CRDT resolves placement, never meaning — semantic correctness is evidence's job, by design.
No — and that isn't aspiration, it's what the object model already says. Nothing in Weft is code-shaped: intents, capabilities, read-sets, evidence, and certified landings never mention a compiler. The content model is lines and blobs, which is text — handbooks, specs, prompt libraries, translations, configs, datasets — and evidence is simply “a pinned recipe that passed.” A doc linter, a schema validator, or a factuality check is as much evidence as a test suite. Git is the import/export format, not the model.
The real frame: any artifact whose acceptance can be argued for. There is a full walkthrough where four local models write a research paper concurrently and the one that fabricates a citation gets refused. Smaller version — cargo run --release -p weftd --example docs — three agents write a Markdown handbook concurrently, a doc-linter runs as gate evidence, and a judge attests quality with its own key. An unfinished section is refused even though the judge approved it, because the gate is an AND.
That example also surfaces the right architecture for subjective evaluation: gate-executed recipes have no network (they're sandboxed), so an LLM judge is not a recipe — it's an independent attestor publishing signed evidence from outside, exactly what distinct_roots was designed for. Deterministic checks run inside the gate; judgement signs from outside it.
No. No token, no mining, no global consensus. Consensus is per-repo and per-ref, among gate keys the genesis names — for a solo self-hosted hub that's one key and zero ceremony; for a federation it's a real quorum. Disagreement forks the repository, which for scratch work is a feature, not a crisis.
Weft borrows from all of them, gratefully and on the record: patch commutation from Pijul/Darcs, keypair identity and the p2p forge idea from Radicle, change-centric flow from Gerrit, coordination-lives-in-the-repo from Fossil. What none of them has: capabilities, read-sets, machine-readable intents, and evidence as protocol objects — because all of them still assume a human reads the change. Weft's bet is specifically about what verification-gated agent swarms need. The full prior-art table is in the RFC appendix.
No — that's the point of the bridge. weft clone imports your repo through the gate; agents land certified work; weft export writes conventional git commits with provenance trailers (Weft-Change, Weft-Model, Weft-Author-Key), chained onto your original history, byte-deterministic across re-exports. GitHub stays the human front door; Weft is the agent-side execution layer underneath.
Don't take our word for it — browse a real one: spranab/weft-demo, branch weft-export was woven by three model-agents through the gate (the same story the live demo retells) and exported. Open any commit and read the trailers.
The honest hard problem — “who verifies the verifier.” Today: policy pins evidence recipes by digest (an agent can't quietly swap the test suite), attestors must chain to distinct trust roots (minting keys doesn't help), and human approval gates can be required where stakes are high. On the roadmap, and designed for from the start: heterogeneous evidence quorums — compiler, tests, property checks, independent model reviews, runtime traces — with policy declaring what combination is sufficient. We discuss this openly in RFC §15.
It's a working, tested, publicly-reviewed pre-1.0: fourteen e2e suites, a review log of 92 dispositioned findings from five kinds of adversary, a live demo, a real woven git branch, and a published paper whose limitations section names what is not solved.
Durability and isolation are in. Run weftd --data ./hub.wal and the hub is crash-durable: an append-only log, every signature re-verified on replay, a torn tail truncated at the last good frame, in-flight proposals re-adjudicated after a restart. Evidence recipes execute inside a fresh user + network namespace (--sandbox unshare, auto-detected) — a test that reaches for the network fails, which is the point; the daemon warns loudly if it starts unconfined.
Replication is in too. weftd --follow https://peer runs a hub as a replica: it bootstraps from genesis over the wire, pulls objects, and then re-derives the certified landing chain itself — re-materializing every state, re-running the certification checklist, and checking that each landing was authored and certified by a key the genesis names. A landing signed by the wrong key, an uncertified landing, and an equivocating pair all fail to advance a follower's head; forks are reported, never silently resolved. Verify, don't trust — cargo test -p weftd --test replicate is that adversarial case, in code.
Still honest about what's missing: multi-gate quorums (thresholds > 1 are specified but the reference gate signs alone), heterogeneous evidence quorums, and push-based gossip — replication today is pull, over HTTP, rather than the QUIC frames the RFC describes. Self-hosted use, private networks, and CI-style deployments are real today.