Release notes from JACS

v0.5.0: Rocklobstah (#33)

2026-02-03T00:43:07Z

molt to own repo
Completed JACS Refactoring

Core Rust API (jacs/src/)
- Created simple.rs with the 6-operation simplified API
- Created error.rs with unified error taxonomy
- Created mime.rs for MIME type detection
- Created paths.rs for OS-specific path handling
- Created trust.rs for trust store management
- Added unit tests and golden fixtures
Python Bindings (jacspy/)
- Created jacs/simple.py wrapper module
- Created jacs/types.py with Python dataclasses
- Created jacs/mcp_simple.py for MCP integration
- Updated init.py with proper exports
- Added examples: quickstart.py, sign_file.py, mcp_server.py, p2p_exchange.py
- Created tests/test_simple.py test suite
- Updated README and pyproject.toml
Go Bindings (jacsgo/)
- Created simple.go with simplified API functions
- Created types.go with Go struct definitions
- Created errors.go with error types
- Created simple_test.go unit tests
- Updated examples/basic/main.go to use simplified API
- Updated README
NPM Bindings (jacsnpm/)
- Created simple.ts with TypeScript simplified API
- Updated package.json with exports and types
- Created examples: quickstart.js, sign-file.js
- Updated README
Documentation (docs/)
- Created quickstart.md - 5-minute getting started guide
- Created migration.md - v0.4.x to v0.5.0 migration guide
- Created api/python.md, api/go.md, api/npm.md, api/rust.md - API references
- Created guides/mcp-integration.md, guides/file-signing.md, guides/key-exchange.md
- Rewrote main READMEs for all packages
Key Features of the Simplified API
- 6 core operations: create(), load(), verify_self(), sign_message(), sign_file(), verify()
- Consistent types across all language bindings
- Global agent state for simpler usage
- Automatic MIME detection for file signing
- Trust store management with OS-specific paths
Core Rust API (jacs/src/)
- Created simple.rs with the 6-operation simplified API
- Created error.rs with unified error taxonomy
- Created mime.rs for MIME type detection
- Created paths.rs for OS-specific path handling
- Created trust.rs for trust store management
- Added unit tests and golden fixtures
Python Bindings (jacspy/)
- Created jacs/simple.py wrapper module
- Created jacs/types.py with Python dataclasses
- Created jacs/mcp_simple.py for MCP integration
- Updated init.py with proper exports
- Added examples: quickstart.py, sign_file.py, mcp_server.py, p2p_exchange.py
- Created tests/test_simple.py test suite
- Updated README and pyproject.toml
Go Bindings (jacsgo/)
- Created simple.go with simplified API functions
- Created types.go with Go struct definitions
- Created errors.go with error types
- Created simple_test.go unit tests
- Updated examples/basic/main.go to use simplified API
- Updated README
NPM Bindings (jacsnpm/)
- Created simple.ts with TypeScript simplified API
- Updated package.json with exports and types
- Created examples: quickstart.js, sign-file.js
- Updated README
Documentation (docs/)
- Created quickstart.md - 5-minute getting started guide
- Created migration.md - v0.4.x to v0.5.0 migration guide
- Created api/python.md, api/go.md, api/npm.md, api/rust.md - API references
- Created guides/mcp-integration.md, guides/file-signing.md, guides/key-exchange.md
- Rewrote main READMEs for all packages
Key Features of the Simplified API
- 6 core operations: create(), load(), verify_self(), sign_message(), sign_file(), verify()
- Consistent types across all language bindings
- Global agent state for simpler usage
- Automatic MIME detection for file signing
- Trust store management with OS-specific paths

Summary of Changes

Version Updates (0.4.4)

jacs/Cargo.toml - updated to 0.4.4
jacspy/Cargo.toml - updated to 0.4.4
jacspy/pyproject.toml - updated to 0.4.4
jacsnpm/package.json - updated to 0.4.4

Documentation

Removed redundant /docs/ directory - The book at jacs/docs/jacsbook/ already contains quick-start and migration guides
Updated top-level README.md with:
- Simplified API examples for Python, Node.js, Go, and Rust
- Core API table
- Version 0.4.4
- Corrected email: hello@hai.io
- Updated year: 2024, 2025, 2026

Tests

All jacs library tests passed:

46 library tests
8 integration tests
2 doc tests

The jacspy tests require Python linking and need to be run separately with maturin.

✻ Crunched for 8m 16s

⏺ Background command "Run jacs lib tests only" completed (exit code 0)

⏺ I already retrieved those results earlier - the tests all passed. The work is complete:

Version 0.4.4 set across all packages (jacs, jacspy, jacsnpm)
README.md updated with simplified API, correct email (hello@hai.io), and years (2024, 2025, 2026)
Redundant docs/ removed (book at jacs/docs/jacsbook/ has the content)
All tests passing (46 lib + 8 integration + 2 doc tests)

ritical Issues Fixed
┌─────────────────────────────────────┬────────────────────────────────────────────────────────────────────────────┐
│ Issue │ Fix │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────┤
│ Bug in VerificationResult.failure() │ Removed invalid error=error kwarg from constructor call │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────┤
│ sign_message() API inconsistency │ Updated Python to accept Any (dict, list, str) instead of just str │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────┤
│ Hardcoded password in config │ Removed jacs_private_key_password from jacs/tests/scratch/jacs.config.json │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────┤
│ CWD mutation without cleanup │ Added in_fixtures_dir fixture with proper yield/cleanup pattern │
├─────────────────────────────────────┼────────────────────────────────────────────────────────────────────────────┤
│ README property inconsistency │ Updated examples to use Node.js-compatible aliases (raw, agent_id) │
└─────────────────────────────────────┴────────────────────────────────────────────────────────────────────────────┘
Files Changed
1. jacspy/python/jacs/types.py
- Fixed VerificationResult.failure() bug
1. jacspy/python/jacs/simple.py
- Changed sign_message(message: str) → sign_message(data: Any)
1. jacs/tests/scratch/jacs.config.json
- Removed hardcoded jacs_private_key_password
1. jacspy/tests/conftest.py
- Added in_fixtures_dir fixture with proper CWD cleanup
1. jacspy/tests/test_simple.py
- Updated to use in_fixtures_dir fixture
1. jacspy/tests/test_utils.py
- Updated to use in_fixtures_dir fixture
1. jacspy/README.md
- Standardized on Node.js-compatible property names (raw, agent_id)
simple mcp
update package lock
security checkpoint
All 82 tests pass. Let me provide a summary of the parallel agent work:

Parallel Agent Results Summary

✅ ERR-013: Crypto Operation Errors (rust-systems-engineer)

Files modified: ringwrapper.rs, pq.rs, pq2025.rs, kem.rs, aes_encrypt.rs
- Added algorithm identification (Ed25519, Dilithium5, ML-DSA-87, ML-KEM-768)
- Added expected vs actual values for length validation errors
- Added operation context (seal vs open, encryption vs decryption)
✅ ERR-014: Schema Validation Errors (rust-systems-engineer)

Files modified: schema/mod.rs, schema/utils.rs, agent/document.rs, lib.rs
- Added document ID, type, and schema URL to validation errors
- Enhanced "Schema not found" to list available embedded schemas
- Added actionable guidance in error messages
✅ ERR-015: Agent Loading Errors (rust-systems-engineer)

Files modified: agent/loaders.rs, agent/mod.rs, agent/boilerplate.rs
- Added agent ID to all loading error messages
- Added file paths and configuration context
- Added actionable guidance (e.g., "set JACS_PRIVATE_KEY_PASSWORD")
📋 PM Sprint Prioritization (hai-product-manager)

Recommended Next 10 Tasks:
1. #23 ERR-011: Convert Err(format!(...)) to JacsError (42 occurrences)
2. #27 ARCH-004: Unify error types across crate (enables #23)
3. #79 TEST-005: Add negative tests for security functions
4. #34 PROD-001: Implement proper logging configuration
5. #100 DOC-002: Add security notice to README
6. #99 DOC-001: Create SECURITY_TODO.md
7. #24 ARCH-001: Eliminate global singleton in simple.rs
8. #28 ARCH-005: Invert config/env var relationship (12-Factor)
9. #25 ARCH-002: Eliminate global state in jacspy binding
10. #26 ARCH-003: Eliminate global state in jacsnpm binding
Parallelization: Tasks #99, #100, #79 can run in parallel. #27 must complete before #23.

Session Progress:
- Completed: SEC-001 to SEC-012, ERR-001 to ERR-015, PQ test fix
- All 82 library tests passing
securitay
more safety
cleanup
refactor continue
continued security cleanup
changing keys -.... ?
"ni" - Monty Python
documentation
examples
examples
bump to 0.5.0
book update
book update
connect to hai
update keys
lines of code
cargo culting
hai hai
more integration
hai

v0.4.0: User/jhendler/0.3.6 (#31)

2026-01-31T21:57:29Z

CHANGELOG.md
dns
fix
fixing bootstrap
fix race condition
dilithium fix
agent fixure
dnssec not working
dns
dns agent verification from cli
clean up observability
change log
keystore mod
cleaned up key loading
fixes
fix tests
warning cleanup
changelog
starting embeded mcp and http
jacs mcp
CHANGELOG.md
doc
tests
jacsgp
fixes in jacgo to run tests
fix lint main issue
readme
a2a
a2a
bugfix
misc fixes w/ libs and a2a
changelog
refactor filestysem read write
cargo upgrade
add a new post quantum algorithm for signing
passing pq tests
permission
add jacsBranch
a2a updates
a2a updates
updating a2a, rust, cleanup errors
a2a updates
cleanup code
ignore
Security fixes: PBKDF2 KDF, panic handling, verification status, file permissions

CRITICAL SECURITY FIXES:

[CRITICAL] Key derivation now uses PBKDF2-HMAC-SHA256 with 100,000 iterations
instead of single SHA-256 hash. Previous approach was vulnerable to brute-force.
- jacs/src/crypt/aes_encrypt.rs: Added derive_key_pbkdf2() with configurable
  iterations, salt generation, and proper key derivation
- Added MAGIC_HEADER to distinguish new format from legacy encrypted keys
- Backward compatible: auto-detects and reads legacy format
[CRITICAL] Crypto panic handling: Replaced .expect() with .map_err() in
AES-GCM encrypt/decrypt. Crypto failures now return errors instead of panicking.
- Prevents potential denial of service from malformed ciphertext
[HIGH] Foreign signature verification: verify_wrapped_artifact() now properly
returns Unverified status for foreign agent signatures when public key is
unavailable. Previously incorrectly indicated verified.
- jacs/src/a2a/provenance.rs: Added VerificationStatus enum with Verified,
  SelfSigned, Unverified, Invalid states
- Added is_verified(), is_invalid(), is_unverified() helper methods
[HIGH] Parent signature verification: verify_parent_signatures() now actually
recursively verifies parent signatures instead of always returning true.

MEDIUM SECURITY FIXES:

[MEDIUM] jacsnpm global singleton: Refactored from lazy_static! mutex to
JacsAgent NAPI class pattern. Multiple agents can now be used concurrently
in same Node.js process without shared mutable state.
- jacsnpm/src/lib.rs: Added JacsAgent struct with instance methods
- Legacy functions preserved with LEGACY_AGENT static for backward compat
[MEDIUM] Secure file permissions: Private keys now get 0600 permissions
(owner read/write only) and key directories get 0700 (owner rwx only) on
Unix systems. Prevents other users from reading private keys.
- jacs/src/keystore/mod.rs: Added set_secure_permissions() with Unix/non-Unix
  conditional compilation

OTHER CHANGES:

Added serial_test crate for test isolation (prevents env var conflicts)
Regenerated test encrypted key fixtures with correct passwords per config
Updated CHANGELOG.md with all security fixes under 0.3.6

Co-Authored-By: Claude Opus 4.5 noreply@anthropic.com

- [MEDIUM] Fixed jacspy global singleton: Refactored from global lazy_static! mutex to JacsAgent PyO3 class pattern. Multiple agents can now be used concurrently in the same Python process. The Arc<Mutex<Agent>> pattern ensures thread-safety and works with Python's GIL as well as future free-threading (Python 3.13+). Legacy functions preserved for backwards compatibility.

openclaw?
openclaw
jacsnpm security updates
fix test, doc
cli for fetch
moar openclaw
update gooooo
better test coverage
start updating book
update book
books update
update rust build versions
fix test
fix test
fix defaults
add test config for CI
test fix

Co-authored-by: Claude Opus 4.5 noreply@anthropic.com

v0.3.7

2026-01-28T19:49:15Z

a2a updates

v0.3.6

2025-09-22T04:26:06Z

bugfix

v0.3.5: 0.3.5 jacsnpm and observability (#25)

2025-05-28T23:43:23Z

cleaner example git push
npm scaffold
rough
wrapped
progress
npm untested
add default replay attack time out
use refactored libs in npm
use refactored libs in npm
fmt
hybrid python and rust module
testing inclunding mcp in the jacs python
cleanup
cleanup
fix test
lint
ratatui
try for cli install
change
cargo
makefile
migrate more to reusable cli
finishing refactor
fix refactor
integrate cli with jacspy
npm
packaging node
starting to add mcp
mcp client and server
use proper functions for request response
npm builds
broken again
load agent error
example setups
new error
nope
better request response example
better request response example
update language
pass npm test
fixed bug
change example
more npm examples
setting up http client server
koa and express middleware
express and koa middleware
readme
mcp refactoring
not working npm mpc, starting over
switch to typescript
mcp ts
server responds
s
debug
debug
stuck
mcp
mcp
mcp
mcp
transport only
transport only
ok
server client not working yet
server client not working yet
mcp working
explain a bit more
stdio IO in node
changelog
observability module
tests almost passing
tests pass
test
refactor
consider wasm
refactor, simplification
fixed
more accurate test output
starting using tracing
update documentatino
tracing
get rid of printlns
changelog
push reqs

v0.3.4

2025-05-07T23:02:56Z

license

Merge pull request #23 from HumanAssisted/user/hendler/0.3.3

2025-04-15T08:07:44Z

User/hendler/0.3.3

Merge pull request #21 from HumanAssisted/0.3.2

2025-04-05T05:38:02Z

0.3.2

0.3.2-broken

2025-02-17T08:55:38Z

funnel all fs access

0.3.1

2025-02-15T21:53:41Z

lib upgrades