- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
deterministic bytes; folder hashes over sorted relpath+filehash lines so
tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
is a byte-level no-op
- update advances the pinned rev, rewrites the external area via staging+swap,
reports added/changed/removed per type; include mode holds its selection,
vanished include entries abort loudly with the tree untouched
- all mode pulls new upstream items automatically; collision checks re-run on
every update and honor the rename map
- diff is strictly read-only (temp dir outside the repo) and surfaces new
upstream items as available-but-not-selected
- remove deletes external area + lockfile entry and prunes empty external root
- update --all reports per source and surfaces every failure
m3ta-chiron