awnest

Docs · Source · pip install awnest · The Aither World

The Aither World is an operating system for agents — a Linux you can hand to one, the runtimes it works in, and the tools it works with. awnix is the Linux underneath it; awnest is one of its 67 bricks — each installs on its own, runs offline, and needs no account.

Start here: Gate one action behind a human check and watch an automated caller fail it.

Prove there is a human before you let them into the nest.

```bash
pip install awnest

```python
from awnest import Nest, HmacKey, Policy

nest = Nest("action:checkout", key=HmacKey(SECRET), policy=Policy(min_score=70))
nest.require(token=attestation, subject=user_id)      # raises NotAdmitted

A nest is not a wall. It is a place with doors, and the job is knowing who came through which one.

The one thing this is built around

Every human check ever written fails open. Not by decision — by arithmetic. "We could not tell" and "it is fine" reach the caller as the same thing: an empty result, a None, a score of 0, a 500 somebody catches. The gate then denies nobody, and it passes every test written for it, because the tests assert that a bot is refused — and a bot is refused, right up until the evaluator has a bad afternoon.

So the verdict type here has no member meaning "ok":

```python
Verdict.HUMAN      # earned it
Verdict.AGENT      # declared it
Verdict.UNKNOWN    # everything else, including "the check did not run"

UNKNOWN is what you get from an absent evaluator, an unparseable reply, a stale attestation, an empty evidence list, and a policy nobody configured. Admission is granted by naming a verdict, never by failing to reach one.

Two more rules fall out of the same idea:

• Scored zero is not unscored. Evidence(score=None) means nobody judged it. It counts toward nothing and it is reported as nothing — never as a zero, which would turn a judge outage into a permanent accusation against real people.
• A presented-but-invalid credential is not an absent one. A token that does not verify refuses there; it never falls through to whatever weaker evidence came with it. Forgery is the one event you want to be loud.

"Human or bot" is the wrong question

If the only way through a door is to be human, every legitimate automation is taught to imitate one, and you have spent your budget training the thing you are trying to detect.

```python
from awnest import Evidence, DECLARED_AGENT, assess

assess([Evidence(DECLARED_AGENT, source="nightly-sync")]).verdict   # Verdict.AGENT

A caller that declares itself is believed, and a declaration cannot be outvoted by a good score presented alongside it. Honesty has to be the cheaper path or nobody takes it. Whether the agent door is open is one flag — Policy(allow_agents=True) — decided per door, never inherited.

Not a CAPTCHA

CAPTCHA asks a machine-solvable question and charges the cost to the human. It is worst for the people it should serve most, and the machines beat it, so the only party reliably filtered is the customer.

The bundled challenges ask instead for something a person has and a model does not: a particular life — an embodied sensation, felt time, a real reaction to being asked. Scoring is somebody else's job (a model, a person, a service), and this package refuses to pretend otherwise.

```python
from awnest import select, judge_prompt
from awnest.judge import score_answers

issued = select(3)                    # one per category, never the same twice
evidence, judgement = score_answers("http://127.0.0.1:8080", issued, answers,
                                    model="whatever-you-run")

This is not proof, and the honest framing is cost. A determined operator can pay a person, or feed a model a real diary. What it does is move a fake account from free to about a human-minute, which is the entire game for spam economics. Need more? Stack another signal — the verdict plane takes several and reports the weakest, so adding one can never weaken the answer.

The judge sees the most personal thing a stranger will ever type into your product. base_url has no default on purpose: nobody should make that decision by inheriting one.

Attestations: bound, offline-verifiable, one-use

The check and the door are rarely the same process. Calling back to the verifier makes every gated action depend on it being up; a boolean in a session is a fact with no provenance. So: a small signed statement.

```python
token = nest.issue(user_id, assessment, ttl_s=3600, method="challenges")

The format is shaped by replay, which is the real attack — not "bots solve the puzzle" but "a human solves it once, cheaply, and the result is reused":

ctx is symmetric and unforgiving: a token carrying a context is refused by any verifier that does not name the same one, and a verifier that names a context refuses a token that carries none. A binding either side may decline to check is not a binding, and forgetting to check is what actually happens.

The token names its algorithm and the key decides it — a mismatch is a refusal. Reading alg out of the token is how alg: none and HMAC/RSA confusion emptied a decade of JWT deployments.

HmacKey is stdlib and means every verifier is also an issuer: fine inside one trust domain, wrong the moment a third party verifies. pip install awnest[ed25519] for the asymmetric half.

Signing commits with it

A signed commit says a key was present. When most commits are written by agents holding the same keys as the humans who run them, that is no longer the interesting fact. The interesting fact is whether a person stood behind the change, at what strength, and which person.

```bash
awnest commit-attest --identity "$AWIAM_SUBJECT" --repo acme/widgets \
       --tree "$(git rev-parse HEAD^{tree})" --score 82 --method challenges
# -> Awnest-Attestation: awn1.…   (append it as a trailer)

awnest commit-verify --message .git/COMMIT_EDITMSG --repo acme/widgets \
       --tree "$(git rev-parse HEAD^{tree})"

The binding is the tree, not the commit sha — an attestation lives inside the message, so it cannot contain a hash of the commit that contains it. That means it survives a reword, a rebase and a cherry-pick (same content, still attested) and does not cover the parent. If you need "approved on this branch", that belongs in the audience: repo:acme/widgets@release is a different door.

verify_commit re-reads the tree in front of you and compares. A valid attestation lifted off another commit verifies perfectly; only that comparison notices.

What it composes with

Each of these is a door with a name, built rather than typed (audience("channel", "#help")) because an issuer's spelling drift mints tokens for a door nobody guards — silently, unlike a verifier's, which refuses everyone and gets fixed in minutes.

Nothing above is a dependency. awnest holds the verdict, the format and the door; who you ask and what you do with the answer stay yours.

Command line

```
awnest challenge -n 3                  issue a set of challenges (JSON)
awnest judge --url … --model … --answers a.json
awnest mint   --subject u_42 --audience action:checkout --score 80
awnest verify TOKEN --audience action:checkout
awnest gate   TOKEN --audience action:checkout --subject u_42
awnest commit-attest / commit-verify   the git trailer, above
awnest alignment quiz                  print the alignment questions
awnest alignment score --answers a.json
awnest alignment badge --answers a.json --subject u_42 --out ./badge
awnest alignment verify TOKEN --subject u_42
awnest --self-test                     prove this package can still fail

Exit codes: 0 admitted / ok · 1 refused or broke · 2 you asked wrongly.

The alignment door (the fun one)

The rest of awnest asks is there a person here. The alignment door asks which of the nine are you? — a deterministic, no-judge quiz of 18 scenarios into the classic D&D-style chart: two axes (law↔chaos, good↔evil), nine cells, and a badge that is a CLAIM, not a screenshot.

```python
from awnest import HmacKey, score_answers, mint_badge, badge_svg, verify_badge

result = score_answers({...})                 # {question_id: option_id}
token = mint_badge(HmacKey(secret), sub="u_42", result=result)
svg = badge_svg(result, subject="u_42")       # the wall badge
verify_badge(token, HmacKey(secret), subject="u_42")   # raises on anything wrong

The attestation is bound to the exact result (ctx carries the alignment id AND both axis scores), so a badge cannot be relabeled without invalidating the token; verification is offline and public — that is what attestations are for. The subject is whoever holds the identity, and the platform surface (genesis /myspace/alignment/*) takes it from the session, never from the caller. questions_public() omits the weights the way public() omits the judge's criteria: the protocol does not hand out the answer key.

Licence

Apache-2.0.

The aw family

Standalone tools that share one idea: replace something you would otherwise have to trust with something you can check.

Each installs on its own, works offline, and needs no account.

awnix is the ground floor — A Linux you can hand to an agent — immutable base, capabilities included.

The Aitherium ecosystem

Every repository here is public. Each publishes an aither-manifest.json beside its page, so any surface can read every sibling's — the network is browsable from any node in it.

Built on llama.cpp · vLLM · ComfyUI · CentOS Stream · Podman · Docker · LanceDB · WireGuard · FFmpeg · Blender + Rigify · headroom · SANA · Hunyuan3D · repowise · Playwright · Chromium · Next.js · React.