Skip to content
AIP

Milestone 1 acceptance

Status: complete for the experimental local milestone, verified 2026-10-02 with Go 1.27.1 on macOS arm64. This record describes tested scope, not a stable release or a claim of production readiness. The Go implementation has no external module dependencies. Python standard-library scripts provide the demo and an independent golden-vector encoder, not another AIP implementation.

Requirements and evidence

Requirement Implementation and validation
Standalone .aip/ repository, no Git versioning repository.Init creates HEAD, config, CAS, state/intent registries, index and tmp; TestInitialization checks layout and discovery. The standalone demo runs every AIP subprocess with an empty PATH. Source inspection finds no Git invocation or storage adapter.
Immutable, deterministic identity Explicit type/version/data schemas, deterministic CBOR, SHA-256 of exact bytes; TestDeterministic, TestIntegerBoundaries, TestGoldenVectors, and repeated snapshots check byte and ID equality.
Six extensible primitives Artifact, State, Intent, Operation, Evidence and Decision are canonical objects. TestGoldenGraph verifies all 11 fixtures; TestWorkflowCandidatesEvidenceAndDecisions exercises relationships, decisions and child intents. Unknown type/version pairs fail explicitly.
Intent -> operation -> state -> evidence Operations reference intents and bases, states reference producing operations, evidence references states and operations. Reverse queries provide results/evidence without circular hashes. Invalid references, before images, input sets and results are rejected by relationship tests.
Every original CLI command TestAgentWorkflow covers init, status, intent create/list/show, snapshot, state show, history, diff, object show/verify, evidence add and log. The executable demo also exercises these commands with JSON envelopes.
Text and JSON for agents CLI tests cover success/error envelopes, subprocess argument boundaries, result exit codes, and unchanged JSON under readable text views. Full objects and artifact bytes remain inspectable via JSON.
Normal filesystem workspace TestFilesystemChanges covers additions, deletion, executable changes, binary content and symlink rejection; TestFileDirectoryTransitionsAndBadBefore covers file/directory transitions.
Native candidate DAG The demo creates two distinct states from one parent, with separate operations and passing executed evidence. It verifies both appear in history and the parent’s candidate list. No branches are created.
File/text diff as a representation diff.Change contains exact before/after entries plus typed representations; diff tests cover text, binary, context and missing final newlines. Semantic representations remain future extensions.
Atomic, deduplicated, verified CAS Exclusive temporary writes, fsync and no-replace hard-link publication; corruption is rejected on reads and duplicate puts. Tests cover 32 concurrent goroutine writers and six concurrent process writers.
Language-independent protocol specification Objects, encoding, repository, states and transport documents define bytes, identities, relationships, publication and conceptual synchronization. No canonical objects are Markdown.
Interoperability fixtures Eleven checked-in CBOR objects, diagnostic JSON, exact encoded hex and SHA-256 IDs cover all types plus executed evidence. The independent Python encoder regenerates every fixture byte-for-byte; Go tests consume frozen expectations.
Transport boundary only transport.md defines has/get/put/resolve/update, reference compare-and-swap and discovery of reverse associations. No network service is required or implemented.

Decisions are supported through canonical storage and tested object APIs; the original milestone did not require a dedicated decision-creation command. V1 states allow one parent per non-root state. Sibling alternatives form a DAG; multi-parent synthesis requires future specified semantics.

Acceptance run

The final verification passed:

  • go test -race -count=1 ./... (115 passing tests/subtests as reported by the local test runner; helper processes are not standalone acceptance tests).
  • go vet ./... and go build; gofmt -l cmd internal pkg returned no paths.
  • Five-second fuzz runs for both FuzzDecode and FuzzObjectDecode.
  • Independent regeneration and comparison of all 11 vectors in a temporary directory, including their expected SHA-256 IDs. Checked-in vectors were not rewritten to obtain a pass.
  • scripts/demo.py with the built binary. Both greeting implementations passed real Go tests, including GET JSON output, rejection of HEAD and other methods, and an unknown path. Both evaluations left their restored workspaces clean.

The demo records two executed test results and one explicitly labeled report of the second result. It checks all nine non-artifact records, operation reverse links, ancestor ordering, unchanged HEAD after evaluation/export, and a one-file candidate diff. It separately exports the older candidate and checks its bytes against the evaluated copy while the source workspace holds the newer candidate. All AIP subprocesses run with an empty PATH; Go is resolved to an absolute path beforehand solely to execute the greeting tests.

To reproduce from the source repository on a supported machine with Go and Python 3 installed:

go build -o /tmp/aip-milestone1 ./cmd/aip
go vet ./...
go test -race -count=1 ./...
go test ./internal/cbor -run '^$' -fuzz '^FuzzDecode$' -fuzztime=5s
go test ./pkg/protocol -run '^$' -fuzz '^FuzzObjectDecode$' -fuzztime=5s
python3 scripts/demo.py /tmp/aip-milestone1

The demo exits nonzero on failure and prints its retained repository, exported directory, candidate IDs and evidence IDs on success. Intent timestamps and execution provenance vary per run; the checked-in golden vectors are fixed. Use the installed aip binary to inspect a retained demo repository normally.

Limits and deferred work

  • Snapshots include every regular file except top-level .aip/. At milestone 1 there was no ignore syntax; root .aipignore rules were added afterwards, see states.md. Symlinks and special files are rejected; only file bytes, paths and executability are versioned. External writers must be quiet during observation for a coherent capture.
  • Objects are limited to 64 MiB including encoding overhead, CBOR depth to 64, and verified reference paths to 4096 edges. Large files are not chunked.
  • Queries scan loose objects and repeatedly verify graphs. They are intended for the local prototype, with no large-repository performance guarantee.
  • Repository writers use a fail-fast exclusive lock. Crashes can leave stale locks, temporary files or complete unreferenced objects; recovery is manual as described in repository.md. There is no automatic garbage collection.
  • The tested local storage profile needs atomic rename, hard links and directory fsync. This acceptance run covers macOS arm64; it does not claim a Linux or Windows test run. The execution runner supports Linux/macOS and rejects other platforms before executing commands.
  • Evidence records observations or reports, not authenticated truth. Constraints are recorded text, not automatically enforced. Evaluation inherits the user’s permissions/environment, has no security sandbox, and retains its temporary directories. A passing command may have changed files; inspect workspace and truncation fields as well as the result. See evaluation.md.
  • No Git compatibility, hosting/AIPHub, accounts, authentication, web UI, deployment, SDKs, MCP adapter, AI integration, semantic AST diff, automatic conflict resolution, multi-parent synthesis, packfiles or remote networking is included. A combined candidate-comparison view is optional future work; diff and state show provide the milestone’s comparison and evidence views.

There are no outstanding blockers against the original local milestone scope. Further features should be scoped as subsequent milestones.