RepoMesh

Release ledger and XRPL-anchored trust clock for a repo network: signed events, node manifests, and verification. Separate from Attestia's event store.

Place in the system

Attestia, Cognate, and RepoMesh are three products.

RepoMesh is the release network: signed events, node manifests, and an XRPL-anchored trust clock. It keeps its own RFC 6962 ledger.

Attestia proves that an event, a transaction, or a state transition happened, and binds that proof to a chain. The domain it ships is financial truth: personal vault, org treasury, and registrum. Its Merkle proofs are not this ledger.

Cognate is the AI governance domain on Attestia's event store and Merkle proofs. It calls RepoMesh when it needs a release checked. It does not keep a second event store, and it does not use Attestia's Merkle tree for this network.

What's new in 2.4 and 2.5

Version 2.5.1.

• 2.5.1: verification hardening. When a verifier signs more than one verdict for the same check, every consumer now picks the latest by ledger position, not by the signer's own timestamp. A missing or malformed verifier.policy.json now fails closed, and any check type the policy does not know is treated as closed in every mode.

• 2.5.0: anchor posting fails closed. post-anchor.mjs refuses to post, and opens no connection, unless the config says testnet and the WebSocket URL is a known testnet endpoint. An environment variable alone can't switch posting to mainnet. See XRPL Anchoring (Testnet Guard).

• 2.5.0: a required test gate. Every pull request runs all 9 node --test suites with a line-coverage floor and a production npm audit at high. validate-ledger and test are required checks on main, and registry-ci.yml now runs only after ledger-ci succeeds on main.

• 2.4.0: run attestations from Cognate. The ledger accepts three new attestation types, run.preregistered, run.outcome and cognate.root.anchored, each with a sha256 digest and a urn:cognate:... URI. Only a governance node on both trustedAttestors and trustedRunAttestors (today, mcp-tool-shop-org/cognate) may sign them, and it may sign nothing else. Every run.outcome must reference a run.preregistered event already on the ledger.

• 2.4.0: the signing contract is checked. An Ed25519 signature must be over the 32 raw bytes of canonicalHash. The validator names and refuses a signature made over the canonical JSON text or over the 64-character hex string.

See CHANGELOG.md for the full list.

What is this?

RepoMesh turns a collection of repos into a cooperative network. Each repo is a node with:

• A manifest (node.json) declaring what it provides and consumes
• Signed events broadcast to an append-only ledger
• A registry indexing all nodes and capabilities
• A profile defining what "done" means for trust

Today one GitHub organization, mcp-tool-shop-org, operates the log, the attestors, the policy check, and the XRPL anchor. Seven registered nodes do not make seven operators. An independent witness would be a party this organization does not operate.

The network enforces three invariants:

1. Deterministic outputs — same inputs, same artifacts
2. Verifiable provenance — every release is signed and attested
3. Composable contracts — interfaces are versioned and machine-readable

Quick Start (1 command + 2 secrets)

npx @mcptoolshop/repomesh init --repo your-org/your-repo --profile open-source
# JSON output for CI piping:
npx @mcptoolshop/repomesh init --repo your-org/your-repo --profile open-source --json

This generates everything you need:

• node.json — your node manifest
• repomesh.profile.json — your chosen profile
• .github/workflows/repomesh-broadcast.yml — release broadcast workflow
• Ed25519 signing keypair (private key stays local)

Then add two secrets to your repo:

1. REPOMESH_SIGNING_KEY — your private key PEM (printed by init)
2. REPOMESH_LEDGER_TOKEN — GitHub PAT with contents:write + pull-requests:write on this repo

Cut a release. Trust converges automatically.

CLI Flags

All commands accept: --quiet, --verbose, --debug, --no-color. The init command also supports --json for machine-readable output.

Shell completions are available:

repomesh completion bash >> ~/.bashrc
repomesh completion zsh >> ~/.zshrc

Environment Overrides

Variable	Purpose
REPOMESH_LEDGER_URL	Override ledger endpoint
REPOMESH_MANIFESTS_URL	Override manifests endpoint
REPOMESH_FETCH_TIMEOUT	Fetch timeout in ms

Profiles

Profile	Evidence	Assurance Checks	Use When
baseline	Optional	None required	Internal tools, experiments
open-source	SBOM + provenance	License audit + security scan	Default for OSS
regulated	SBOM + provenance	License + security + reproducibility	Compliance-critical

Check Trust

node registry/scripts/verify-trust.mjs --repo your-org/your-repo

Shows integrity score, assurance score, profile-aware recommendations.

Overrides

Per-repo customization without forking verifiers:

// repomesh.overrides.json
{
  "license": { "allowlistAdd": ["WTFPL"] },
  "security": { "ignoreVulns": [{ "id": "GHSA-xxx", "justification": "Not reachable" }] }
}

This is the beginning of the README. Read the rest at the original. Read the full README ↗