128 commits to Purfle from Mon 30 Mar to Fri 3 Apr 2026, the week the weekend scaffold became a working system. Monday opened with the parts an agent platform cannot fake: a JSON Schema for the manifest, an RFC settling on JWS with ES256 for signing, a manifest loader, and an end-to-end trust loop wired to a live Azure key registry, with signature verification and tamper detection, done in one afternoon. The rest of the week built what that loop protects.
- Wrote the manifest identity spec and the trust loop around it: JSON Schema, RFC 0001 on JWS/ES256, a ManifestLoader, and live signature verification against the Azure key registry, complete with tamper detection.
- Built the scheduler and sandbox that enforce what a manifest declares: five trigger types (interval, cron, startup, window, event), a sandbox fix that blocks and logs an out-of-bounds write, crash isolation between agents, and backoff on LLM timeouts and 429s.
- Wired five LLM adapters, Anthropic, Gemini, OpenClaw, Ollama and a built-in tool executor, each reporting token usage, then tested that usage all the way from the adapter through the agent runner into the run log.
- Signed three dogfood agents (email-monitor, pr-watcher, report-builder) against the registry and tested the signatures, then built the desktop flow around them: a first-run setup wizard, a consent screen that translates capabilities into plain language, and a marketplace install with live CLI output.
- Shipped a second front end, IdentityHub.Web, with agent listings, publisher pages, key lookup, and an admin console for moderation, attestations and the key registry, then hardened the week’s work: real GitHub and Gmail OAuth integrations, SHA-256 bundle hashing for the marketplace store, an SSE client with reconnect and backoff, cross-agent output sharing, a credential-resolution engine backed by the OS keychain, and a Linux build on Avalonia.
- Closed Friday with an integration test suite that runs the whole loop together: load, sandbox enforcement, multiple agents at once, cross-agent sharing, a deliberately tampered manifest, and a token limit.