@mcsherrylabs/pi-evolver

A Pi agent extension: chain-generic tools over an Evolver node. Read the chain, sign a transfer, submit a signed transaction.

It wraps @mcsherrylabs/evolver-client and implements no wire format or signing encoding of its own. It knows about no particular channel, ledger or service — a tool that names a channel belongs in that channel's own repository.

Spec: specs/161-pi-evolver-tools/.

Running the checks

Every check runs with one command (Constitution Quality Gate 10), from this directory:

Command	What it pins
npm test	everything below, after building the client
npm run check:config	the precedence rule — a project file may override the chain url and nothing else
npm run check:result	the failure taxonomy — a transport error is never a refusal, fined is never committed
npm run check:principal	a name that exists as the OTHER kind is wrong_kind, never absent — and a 404 group is null, not an empty one
npm run check:decode	every transaction body decodes, through a reader written from the WIRE FORMAT rather than from the encoder it checks
npm run check:admin	every signing verb signs and submits nothing, records what it composed, and refuses what the chain would only refuse by FINING
npm run check:amount	amounts are strings out and bigint in, and the string is validated
npm run check:boundary	scan coverage is a round window, never a row count
npm run check:signing	signing does not submit
npm run check:surface	no tool names a channel; the sign tool takes exactly two fields
npm run check:packaging	the package declares an entry point that resolves
npm run check:registration	loading the extension registers every tool

⚠️ These are a manual pre-merge gate. No CI job in this repository runs npm (issue #77), so a green pipeline says nothing about this package. Run them yourself.

⚠️ npm test builds @mcsherrylabs/evolver-client first on purpose. The checks import it by package name, which resolves to its built output — without the build they would pass against stale bytes.

⚠️ The ownership report is a tripwire, not decoration

evolver_status reports what the configured identity owns. It should say none.

⚠️ AND THE AGENT CAN NOW END THAT ITSELF. Before 162 the only way this identity came to administer anything was somebody else adding it to a group. It can now create groups, admit members and hand groups over — so "owns nothing" stops being true by the agent's own action, and the no-confirmation decision that rests on it (161 FR-012a) has to be re-made rather than re-weighed when it does.

Nothing enforces that. Ownership is reported, never a precondition for signing: the chain is the authority — a non-owner's membership change is FINED and a transfer spends only the sender's balance — and a gate here would add nothing while coupling every signature to a paged walk of every channel owner on the chain. The status tool is the tripwire, and a human reading it is what notices. It is re-asked after any submission that can change the answer, so it will not keep reporting a state the agent has already left.

This package spends without asking for confirmation, and that decision is sound because the consequence of a mistake — or of an instruction injected through chain content the agent reads — is bounded by this identity's own balance. That bound holds only while the identity owns nothing.

"Owns nothing" is a state a stranger can end. A group owner may add any identity to their group without that identity's consent or knowledge, and membership of a group that owns a channel confers administration of it — changing its toll, its write policy, its availability policy, or releasing it. The likeliest route is not an attack but a favour: adding the agent to the group is the only way to let it write to that group's channel.

So if owns ever reports anything but none, the premise behind spending-without-confirmation has expired and that decision has to be made again rather than weighed again. Signing refuses outright if ownership cannot be determined at all — an authority question with no answer is not a yes.

Configuration

.pi/agent/evolver.json in a project, or ~/.pi/agent/evolver.json globally.

⚠️ A project-level file may override the chain URL and nothing else. The identity, the key and how the endpoint is trusted come from the home-level file or the environment only — otherwise a repository you open could name a different signing key, and the only gate is a prompt about trusting a project.

What this package will not do

• Name a channel, ledger or service in any tool.
• Claim an identity. It is given one.
• Accept a transaction body, ledger, kind or sender in a signing tool — a signing tool composes what it signs from named fields and pins the ledger itself.