惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
Microsoft Azure Blog
Microsoft Azure Blog
大猫的无限游戏
大猫的无限游戏
月光博客
月光博客
V
V2EX
PCI Perspectives
PCI Perspectives
Latest news
Latest news
博客园 - 三生石上(FineUI控件)
C
CERT Recently Published Vulnerability Notes
W
WeLiveSecurity
Last Week in AI
Last Week in AI
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
P
Palo Alto Networks Blog
T
The Exploit Database - CXSecurity.com
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
WordPress大学
WordPress大学
V
Vulnerabilities – Threatpost
H
Heimdal Security Blog
Attack and Defense Labs
Attack and Defense Labs
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Hacker News: Ask HN
Hacker News: Ask HN
博客园 - 叶小钗
V
Visual Studio Blog
Jina AI
Jina AI
P
Proofpoint News Feed
罗磊的独立博客
SecWiki News
SecWiki News
J
Java Code Geeks
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
L
LINUX DO - 热门话题
Security Archives - TechRepublic
Security Archives - TechRepublic
The Hacker News
The Hacker News
Hugging Face - Blog
Hugging Face - Blog
N
News and Events Feed by Topic
NISL@THU
NISL@THU
T
Tailwind CSS Blog
T
Tenable Blog
Recent Commits to openclaw:main
Recent Commits to openclaw:main
Recent Announcements
Recent Announcements
H
Hacker News: Front Page
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
T
Tor Project blog
宝玉的分享
宝玉的分享
Help Net Security
Help Net Security
S
Security Affairs
Microsoft Security Blog
Microsoft Security Blog
Google DeepMind News
Google DeepMind News
F
Fortinet All Blogs
G
GRAHAM CLULEY

Hacker News - Newest: "AI"

AI can't read an investor deck AI as an attorney? Student uses ChatGPT, Gemini to sue UW over alleged racial discrimination Hacking MCP Servers in AI Systems – The Rug Pull: Tool Changes After Approval GitHub - MeepCastana/KubeezCut: Free Web based video editor GitHub - GenAI-Gurus/awesome-eu-ai-act: Curated tools, official sources, OSS, templates, and guides for EU AI Act compliance. Can AI judge journalism? A Thiel-backed startup says yes, even if it risks chilling whistleblowers Coming soon: 10 Things That Matter in AI Right Now DARPA built an AI to fact-check enemy weapons claims What explains heterogeneity in AI adoption? When AI Meets Muscle: Context-Aware Electrical Stimulation Promises a New Way to Guide Human Movements - Department of Computer Science AI Changed How We Build. It Did Not Change What Matters. Linux rules on using AI-generated code - Copilot is OK, but humans must take 'full responsibility for the… Meta spins up AI version of Mark Zuckerberg to engage with employees Code Mode: Let Your AI Write Programs, Not Just Call Tools | TanStack Blog GitHub - Delavalom/graft: Go framework for building AI agents. Type-safe tools, multi-provider (OpenAI, Anthropic, Gemini, Bedrock), zero vendor SDKs. India's TCS tops estimates, says new AI models did not dent services demand Gen Z's fading AI hype Strong feeling: we are in a folded AI reality GitHub - machinarii/total-recall-catalog: A reference catalog of latest knowledge retrieval, memory & RAG systems GitHub - mensfeld/code-on-incus: Give each AI agent its own isolated machine with root, Docker, and systemd. Active defense detects and stops threats automatically.. Quantization, LoRA, and the 8% Problem: Benchmarking Local LLMs for Production AI Iran war: We spoke to the man making Lego-style AI videos that experts say are powerful propaganda Powell, Bessent discussed Anthropic's Mythos AI cyber threat with major U.S. banks GitHub - immartian/bellamem: Persistent belief-graph memory for AI agents. Retrieves decisive context by importance — not recency, not RAG, not /compact. recursive-mode: The Repo-Native Operating System for AI Engineering After the attack on Sam Altman's home, will AI CEO's go on the offensive? The biggest advance in AI since the LLM Opus 4.6 vs GPT 5.4 One Prompt Unity World Generation Test “AI polls” are fake polls Client Challenge Can AI be a 'child of God'? Inside Anthropic's meeting with Christian leaders How to Switch AI Chatbots and Why You Might Want To GitHub - MattMessinger1/agentic_refund_guardrail: Safe refund policy layer for AI agents — Python + TypeScript. Same behavior, shared tests. Adam/papers/emergent_values_whitepaper.md at master · strangeadvancedmarketing/Adam Ask HN: How do you stop playing 20 questions with your AI coding tools How far can automation and AI support psychotherapy? - @theU GitHub - stagas/rtdiff: realtime git diff gui and AI-assisted commits A Mac Studio for Local AI — 6 Months Later A History of the Early Years of AI at the University of Edinburgh Why AI Coding Tools Still Feel Stuck on Localhost MSN AI Datacenters Are Becoming Strategic Targets twitter.com Penn Researchers Use AI to Surface Unreported GLP-1 Side Effects in Reddit Posts Show HN: MoodSense AI (ML and FastAPI and Gradio, Deployed on Hugging Face) Moodsense Ai - a Hugging Face Space by aman179102 AI models are terrible at betting on soccer—especially xAI Grok GitHub - xialeistudio/echoic GitHub - HimashaHerath/github-dev-wrapped: AI-powered weekly GitHub activity reports deployed to GitHub Pages GitHub - alejandrobalderas/claude-code-from-source: Architecture, patterns & internals of Anthropic's AI coding agent — reverse-engineered from source maps AI and Tech brief: Ireland ascendant GitHub - Titovilal/context0: Context0 - Never Surrender Training for a Marathon with an AI Coach: What Worked and What Didn't Cyber Pulse: Agentic Intel - Apps on Google Play I Built an AI PR Reviewer That Catches Bugs by Not Looking for Bugs Gen Z workers are so fearful AI will take their job they’re intentionally sabotaging their company’s AI rollout | Fortune How AI Is Reimagining the Game of Golf–For Both Players and Courses GitHub - nattergabriel/reseed: A CLI tool for managing and distributing agent skills across projects Is SVG the final frontier? My AI workflow evolved from prompts to a near-autonomous workflow MLSharp Help - 3DGS Viewer & Generator I put my cognitive field based AI's runtime on GitHub Is Numble the first AI-proof game? A3: Kubernetes for autonomous AI agent fleets | Emergent Principles Deepali Vyas ("The Elite Recruiter") GitHub - msmarkgu/RelayFreeLLM: A restful API designed to route user prompts to various AI model providers. Unionized ProPublica staff are on strike over AI, layoffs, and wages Unleashing the Advantage of Quantum AI We're heading for an AI-fueled 'dementia crisis,' brain scientist warns The AI-Assisted Breach of Mexico's Government Infrastructure [pdf] GitHub - stef41/lmscan: 🔍 Detect AI-generated text and fingerprint which LLM wrote it. Open-source GPTZero alternative. Zero dependencies, works offline. MSN GitHub - visionscaper/collabmem: Enabling long-term collaboration with Agentic AI - building up episodic and world model memory over time with in-context awareness We gave an AI a 3 year retail lease in SF and asked it to make a profit | Andon Labs AI Code is Hollowing Out Open Source, and Maintainers are Looking the Other Way What leaked "SteamGPT" files could mean for the PC gaming platform's use of AI AI is the boss at this retail store. What could go wrong? GitHub - Wuzu11517/agentic-proxy: Local proxy meant to help reduce With Drones, Geophysics and ArtificiaI Intelligence, Researchers Prepare to Do Battle Against Land Mines A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report 在 Steam 上购买 FriedrichAI: Offline AI 立省 10% GitHub - inevolin/resume-cli: Hit Claude usage limits? Resume any AI coding session elsewhere. Switch tools at zero friction. GitHub - atripati/ark: AI Runtime Kernel — a context operating system for AI agents. Eliminates tool bloat, loads only what’s needed, and gives LLMs their reasoning space back. How to Build a Secure AI PR Reviewer with Claude, GitHub Actions, and JavaScript This Startup Wants You to Pay Up to Talk With AI Versions of Human Experts Intel Arc Pro B70 Brings 32GB VRAM to Local AI for $949 WordPress 7.0: The Good, the AI, and the Still Missing AI on the couch: Anthropic gives Claude 20 hours of psychiatry IatroBench: Pre-Registered Evidence of Iatrogenic Harm from AI Safety Measures AI Agents Know About Supabase. They Don't Always Use It Right. The history and future of AI at Google, with Sundar Pichai Inside an AI‑enabled device code phishing campaign How Meta Used AI to Map Tribal Knowledge in Large-Scale Data Pipelines AI for Systems: Using LLMs to Optimize Database Query Execution Forecasting the Economic Effects of AI Introducing Tinker: Play with AI, bring your ideas to life AI sheds light on an ancient gaming mystery People really hate AI but not as much as Iran—or Democrats | Fortune What is an AI Product Engineer? Phoebe Gates wants her $185 million AI startup to succeed with 'no ties to my privilege or my last name': 'I have a chip on my shoulder' | Fortune
GitHub - arian-gogani/nobulex: The accountability primitive for AI agents. Cryptographic behavioral commitments with trustless verification.
arian_ · 2026-04-25 · via Hacker News - Newest: "AI"

CI OpenSSF Best Practices

AI agents can't prove they followed their own rules. Nobulex fixes that.

$ npx tsx examples/demo.ts

Agent A declares covenant: permit read, forbid transfer > 500
Agent A executes 5 actions...
  ✓ read /data/users — allowed
  ✓ transfer $300 — allowed
  ✓ read /data/orders — allowed
  ✗ transfer $600 — BLOCKED by covenant
  ✓ read /data/config — allowed

Agent B verifies Agent A...
  ✓ Step 1: Covenant signature valid
  ✓ Step 2: Proof signature valid
  ✓ Step 3: Log integrity verified (5 entries, chain intact)
  ✓ Step 4: Compliance check passed (0 violations)
  ✓ Step 5: History length sufficient (5 ≥ 1)
  ✓ Step 6: Covenant matches requirements
  ✓ Step 7: Audience binding confirmed
  ✓ Step 8: Task class verified

Result: Agent B trusts Agent A ✅

Agent C presents tampered proof...
  ✓ Step 1: Covenant signature valid
  ✓ Step 2: Proof signature valid
  ✗ Step 3: FAILED — hash chain broken at entry 2

Result: Agent B refuses Agent C ❌

Three primitives. That's the whole protocol:

  1. Declare — write rules: permit, forbid, require
  2. Enforce — check every action before it runs
  3. Prove — tamper-evident hash chain anyone can verify

Tests License TypeScript

Try it live · Policy Designer · Quickstart · Compare · Receipt Schema · Pricing · IETF Draft

What is Proof-of-Behavior?

You can't audit a neural network. But you can audit actions against stated commitments.

verify(covenant, actionLog) → { compliant: boolean, violations: Violation[] }

This is always decidable, always deterministic, always efficient. No ML, no heuristics — mathematical proof.

Proof-of-behavior means every autonomous agent action is:

  • Declared — behavioral rules defined before deployment in a formal language
  • Enforced — violations blocked at runtime, before execution
  • Proven — every action hash-chained into a tamper-evident audit trail that third parties can independently verify

Quick Start

npm install @nobulex/sdk
import { createDID, parseSource, EnforcementMiddleware, verify } from '@nobulex/core';

// 1. Create an agent identity
const agent = await createDID();

// 2. Write behavioral rules
const spec = parseSource(`
  covenant SafeTrader {
    permit read;
    permit transfer (amount <= 500);
    forbid transfer (amount > 500);
    forbid delete;
  }
`);

// 3. Enforce at runtime
const mw = new EnforcementMiddleware({ agentDid: agent.did, spec });

// $300 transfer — allowed
await mw.execute(
  { action: 'transfer', params: { amount: 300 } },
  async () => ({ success: true }),
);

// $600 transfer — BLOCKED before execution
await mw.execute(
  { action: 'transfer', params: { amount: 600 } },
  async () => ({ success: true }),  // never runs
);

// 4. Prove compliance
const result = verify(spec, mw.getLog());
console.log(result.compliant);    // true
console.log(result.violations);   // []

Cross-Agent Verification Handshake

Before two agents transact, they verify each other's proof-of-behavior. No proof, no transaction.

import { generateProof, verifyCounterparty } from '@nobulex/sdk';

// Agent A generates its proof-of-behavior
const proof = await generateProof({
  identity: agentA,
  covenant: spec,
  actionLog: middleware.getLog(),
});

// Agent B verifies Agent A before transacting
const result = await verifyCounterparty(proof);

if (!result.trusted) {
  console.log('Refusing transaction:', result.reason);
  return; // No proof, no transaction
}

// Safe to transact — Agent A is verified
await executeTransaction(proof.agentDid, amount);

The handshake checks eight things in order: covenant signature, proof signature, log integrity, compliance, minimum history, required covenant, audience binding, and task class scoping. If any check fails, the transaction is refused.

Why Proof-of-Behavior Matters

What exists today What's missing
Guardrails filter prompts and outputs No proof the agent followed rules at the action layer
Monitoring watches what agents do after the fact No enforcement before execution
Identity verifies who the agent is No verification of what the agent did
Governance platforms provide dashboards and policies No cryptographic evidence a third party can independently verify

Proof-of-behavior fills the gap: declare → enforce → prove.

The Covenant DSL

covenant SafeTrader {
  permit read;
  permit transfer (amount <= 500);
  forbid transfer (amount > 500);
  forbid delete;
  require counterparty.compliance_score >= 0.8;
}

Forbid wins. If any forbid matches, the action is immediately blocked regardless of permits. Default deny for unmatched actions. Conditions support >, <, >=, <=, ==, != on numeric, string, and boolean fields.

Three keywords. No configuration files. No YAML. No JSON schemas. Just rules.

Architecture

┌─────────────────────────────────────────────────────────────┐
│                      Integrations                           │
│            mcp-server  ·  a2a  ·  langchain                 │
├─────────────────────────────────────────────────────────────┤
│                       User API                              │
│                         sdk                                 │
├─────────────────────────────────────────────────────────────┤
│                   Proof-of-Behavior                         │
│                                                             │
│  identity · covenant-lang · action-log · enforcement        │
│  middleware · verification · crypto · merkle · proofs       │
│                                                             │
│                         core                                │
└─────────────────────────────────────────────────────────────┘

Packages

Package What It Does
@nobulex/core Everything — identity (DIDs), covenant DSL, hash-chained action logs, enforcement middleware, verification, cryptographic proofs
@nobulex/sdk User-facing API — NobulexClient, CovenantAgent, cross-agent handshake
@nobulex/mcp-server MCP compliance server for Claude Desktop, Cursor, VS Code
@nobulex/a2a A2A Agent Card behavioral attestation extension
@nobulex/langchain LangChain callback integration
@nobulex/claude-agent-sdk Claude Agent SDK compliance hooks — PreToolUse/PostToolUse gating, tamper-evident tool-call logs

Integrations

  • npmnpm install @nobulex/sdk
  • MCPnpx @nobulex/mcp-server (works with Claude Desktop, Cursor, VS Code)
  • A2A — Agent Card behavioral attestation extension
  • LangChain — drop-in compliance callbacks

Conceptual Comparison

Bitcoin Ethereum Nobulex
What it verifies Monetary transfers Contract execution Agent behavior
Mechanism Proof of Work Proof of Stake Proof of Behavior
What's proven Transaction validity State transitions Behavioral compliance
Guarantee Trustless money Trustless contracts Trustless agents

Live Demo

npx tsx examples/demo.ts

Creates two agents, defines behavioral rules, enforces at runtime, blocks a forbidden transfer, generates a proof-of-behavior, runs the 8-step handshake, and then shows the same handshake rejecting a third agent whose log was tampered with — all in one script.

npx tsx examples/langchain-agent.ts   # covenant enforcement around a mocked LangChain agent
npx tsx benchmarks/bench.ts           # protocol performance on your hardware

Security Audit

We've conducted an internal security review. Here's what we tested and what we found:

Verified secure:

  • Hash chain integrity: modifying any entry breaks the chain (property-tested with fast-check across random chains of varying length).
  • Signature forgery: invalid signatures are rejected 100% of the time.
  • Replay attack prevention: audience-bound proofs fail when replayed to a different verifier (property-tested).
  • Covenant enforcement: forbidden actions are blocked before execution, never after — the handler never runs.

Known limitations:

  • No key revocation mechanism yet — compromised keys remain trusted until removed out-of-band.
  • No rate limiting on handshake verification — potential DoS vector under adversarial load.
  • Single-threaded chain verification — chains above ~100K entries take visible time (see benchmarks).
  • Clock skew tolerance is 0 — agents with desynchronized clocks may fail timestamp checks.

Not in scope:

  • Model-level safety (prompt injection, jailbreaking) — use guardrails for that.
  • Network transport security — use TLS.
  • Key storage — use your platform's HSM or key vault.

See docs/threat-model.md for the full threat model.

Development

git clone https://github.com/arian-gogani/nobulex.git
cd nobulex
npm install
npx vitest run             # full test suite (incl. fast-check property tests)
npx tsx examples/demo.ts   # see the protocol run end-to-end
npx tsx benchmarks/bench.ts

Standards

Ecosystem

Projects building on or composing with Nobulex:

Partner Layer Integration
Dominion Observatory Pre-call trust scores Feeds trust_score into covenant require
SidClaw HITL approval Signed state-transition receipts
Aira Authorization + audit Multi-party signing with RFC 3161
Signet Signing layer Bilateral co-signing, policy attestation
AgentMint Runtime enforcement Ed25519 plan signing, scope matching
APS Receipt schema Co-designed outcome_hash format

Documentation

Links

License

MIT — use it for anything.