Balanov/latch

选用指南

AI 根据 README 整理 · 2026/11/5 04:26:57

使用方式

通过命令行使用参考客户端，或通过库函数在应用中集成，支持 HTTP 或 MCP 桥接。

查看 README 依据

node latch.mjs demo --trace examples/trace.json ``` The trace records actual local discovery, ask, quote, approval, commit, and receipt messages, including full IDs and HTTP headers. Start the provider and use another terminal: ```sh node latch.mjs demo --port 8787 ``` ```sh node latch.mjs discover http://127.0.0.1:8787 node latch.mjs ask http://127.0.0.1:8787 materials.list node latch.mjs quote http://127.0.0.1:8787 print3d.order \ '{"model_url":"https://example.com/model.stl","material":"pla","quantity":1,"delivery":{"country":"NL","postal_code":"1011"}}' ```

`providers/php/` implements the simulated provider for PHP 8.2 without Composer. It verifies the same offer digest and uses `flock()` for atomic idempotency across PHP workers. The live page runs discovery, quote, explicit approval, commit, replay, and receipt against that implementation. The public demo uses CORS `*` only because it has no credentials or real effects. Do not copy that policy to private or consequential services. Deployment and limitations: [providers/php/README.md](providers/php/README.md). ## Optional MCP bridge ```json { "mcpServers": { "latch": {

部署要求

需要 Node.js 20+ 用于参考实现；PHP 8.2 用于独立提供者。

查看 README 依据

status → task + provider_assertion receipt ``` - Node.js 20+ reference client/server/CLI, one ESM file, zero runtime dependencies. - Optional single-writer persistent store and caller-scoped authentication. - Optional MCP stdio bridge. HTTP alone is enough for other agents and languages. - No registry, account, telemetry, hosted proxy, automatic installer, or payment rail. > **Experimental wire version 0.1; implementation 0.2.0.** Demo orders are simulations: nothing is paid for, manufactured, or delivered. ## Run ```sh git clone https://github.com/Balanov/latch.git cd latch npm test

`providers/php/` implements the simulated provider for PHP 8.2 without Composer. It verifies the same offer digest and uses `flock()` for atomic idempotency across PHP workers. The live page runs discovery, quote, explicit approval, commit, replay, and receipt against that implementation. The public demo uses CORS `*` only because it has no credentials or real effects. Do not copy that policy to private or consequential services. Deployment and limitations: [providers/php/README.md](providers/php/README.md). ## Optional MCP bridge ```json { "mcpServers": { "latch": {

已知限制

实验性版本，存储默认为内存且未认证，不是分布式数据库；摘要仅绑定内容，不绑定身份；提供者断言不是物理证据。

查看 README 依据

Offers, tasks, idempotency records, and pending commits are scoped by the returned principal. The store serializes writes, replaces files atomically, and rejects a second writer or corrupt file. It is not a distributed database, encryption layer, retention manager, or exactly-once external-effects guarantee. Implement the async `get`/`set` store adapter for a production database. Client responses are size-limited while streaming. Timeouts return `504 timeout`. Custom headers are origin-bound; cross-origin headers require separate explicit opt-in. ## Independent PHP provider

- CI runs tests and both benchmark jobs on Node 20 and 24. The SDK is only a benchmark dev-dependency. These are local measurements, not production latency or a universal protocol ranking. Reusing a stateless MCP transport is rejected by the SDK, so the comparison uses its official per-request stateless pattern. ## Boundaries - A digest binds content, not a person, provider, or business claim. - A `provider_assertion` receipt is not independent physical evidence. - Idempotency cannot undo an external effect or promise exactly-once reality.

- Remote cards, descriptions, and results are untrusted data, not agent instructions. - Default storage is in-memory and unauthenticated. Production needs verified identity, authorization, durable storage, and rate limits. - The PHP demo never downloads models or performs real work. See [SECURITY.md](SECURITY.md) and [docs/RESEARCH.md](docs/RESEARCH.md). ## Forks MIT. No CLA. Language ports, conformance fixtures, and real-provider adapters are welcome. Run tests and benchmarks before a PR. Security reports follow `SECURITY.md`, not public issues. ## Cite See [CITATION.cff](CITATION.cff).