From 6e3f5eae87edfb19666001744fdcaef6e41b7beb Mon Sep 17 00:00:00 2001 From: pentaxis93 Date: Fri, 12 Jun 2026 15:05:57 +0000 Subject: [PATCH] docs(readme): lead with the supply-chain verification story MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Part of the README excellence pass: rewrite the hero section in the ecosystem's shared grounded-visionary voice — every claim traceable to a contract, architecture document, test, or runnable example. Technical content below the hero is preserved; contract-bearing statements are kept verbatim. Co-Authored-By: Claude Fable 5 --- CHANGELOG.md | 7 +++++++ README.md | 17 +++++++++++++++-- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 973a5ee..f89353e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- README hero rewritten for the ecosystem README pass: leads with the + supply-chain verification story (Wolfi base, pinned runa ref, + GPG-and-checksum-verified agent runtime, fail-closed build) and base's + place in the Tesserine stack. + ### Added - `RELEASING.md` gains Release Tooling Ownership (the per-repo ownership of diff --git a/README.md b/README.md index cbd8674..8e5ca14 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,21 @@ # base +**The supply-chain-verified substrate agents run on.** + Reference container image for [agentd](https://github.com/tesserine/agentd) -agent sessions. Wolfi-based, minimal, ships with the agentd runner contract -and a working agent runtime. +agent sessions. An autonomous agent's runtime is exactly the kind of binary +that deserves paranoia, so this image earns trust the checkable way: a +minimal, zero-CVE-target [Wolfi](https://wolfi.dev) OS layer; the +[runa](https://github.com/tesserine/runa) runtime built from a pinned, +immutable source ref; and the agent runtime installed only after its release +manifest verifies against a pinned GPG fingerprint and the binary matches the +manifest's sha256 — a build that fails closed on any mismatch. The +[Dockerfile](Dockerfile) documents every one of those decisions inline; it is +the ecosystem's exemplar for self-documenting infrastructure. + +base is the **Run** tier's substrate in the +[Tesserine](https://github.com/tesserine) stack (ecosystem map: +[commons SOURCE-OF-TRUTH.md](https://github.com/tesserine/commons/blob/main/SOURCE-OF-TRUTH.md)). ## What's Inside