Rust monorepo with Cargo workspace. See docs/spec/architecture.md for component inventory.
See docs/spec/credential-backend-interface.md for the CredentialBackend trait contract (15 methods).
See docs/spec/plans/development-stages.md for the 8-stage build plan.
See docs/spec/plans/execution-plan.md for the orchestration runbook (ralph, team, ultraqa).
Do not read folder docs/archived
Use jj (Jujutsu) for all version control. Never use raw git commands.
On every session start:
jj log --limit 10 && cat harness/progress.json && bash harness/init.sh $(jq -r .current_stage harness/progress.json)- Read the stage contract for your current stage in
docs/spec/plans/development-stages.md - Pick the HIGHEST-PRIORITY incomplete deliverable from
harness/features.json - Implement ONE deliverable
- Run tests:
cargo test -p <crate>for the affected crate - Describe:
jj describe -m "agentkeys: stage N -- <deliverable name>" - Update
harness/features.json(setimplemented: true) andharness/progress.json - New change:
jj new -m "harness: update progress"
- Run
bash harness/stage-N-done.sh-- must exit 0 jj bookmark create stage-N-done(bookmark marks the completion point)- Update
harness/progress.json: set stage status to "complete" jj describe -m "harness: stage N complete"jj new(start fresh change for next stage)
- Rust:
thiserrorfor library errors,anyhowfor binary errors - All async:
tokioruntime,#[tokio::test]for async tests - Crate names: agentkeys-types, agentkeys-core, agentkeys-cli, agentkeys-daemon, agentkeys-mock-server, agentkeys-mcp, agentkeys-provisioner
- Git commits:
agentkeys: stage N -- <deliverable> - Never self-grade: run
bash harness/stage-N-done.shto verify
The mock server mirrors Heima blockchain extrinsics. Follow these rules:
- Typed parameters: Every endpoint must accept explicit typed inputs (e.g.,
identity_type+identity_value), never parse opaque JSON blobs to guess types at runtime. Blockchain extrinsics require typed parameters -- the mock must enforce the same contract. - Shared identity resolution: Use a single
resolve_identity(db, identity_type, identity_value) -> Result<String>utility inhandlers/identity.rsfor all identity-to-wallet lookups. Never inline if/else chains per identity variant. - Modular handlers: Split request-type-specific logic into separate functions (e.g.,
mint_pair_session(),mint_recover_session()). Theapprove_auth_requesthandler dispatches to these, not inline everything.
cargo test -p agentkeys-types
cargo test -p agentkeys-core
cargo test -p agentkeys-mock-server
cargo test -p agentkeys-cli
cargo test -p agentkeys-daemon -p agentkeys-mcp
cargo test -p agentkeys-provisioner
npm test --prefix provisioner-scripts