agent-lock

Producer for hash-addressed agent configuration lockfiles — the companion to the acve registry. acve validates and matches lockfiles; this package produces them.

A lockfile pins a resolved agent configuration (harness + model + goals + tools

• permissions + policy) to a deterministic unit identity: provenance.config_sha256, the SHA-256 of the RFC 8785 (JCS) canonicalization of the document with provenance excluded.

Install / run

python -m agent_lock produce config.json -o agent-lock.json
python -m agent_lock verify agent-lock.json
python -m agent_lock hash config.json

Or pip install . to get the agent-lock console script. The lock API pins tool schema_sha256 values and records model pins; resolve drives a pluggable Resolver (see FileRegistry, UrlRegistry, CompositeResolver) to resolve model alias/floating pins and fetch tool schemas before locking. drift detects when a live config has moved off its lockfile, and pins.pin_issues / pins.tool_issues report what remains unresolved.

Status

v0.1 — canonicalization, hashing, produce, verify, lock (tool schema pinning), model-pin validation, registry-backed resolve (FileRegistry, UrlRegistry, CompositeResolver), live hosted sources (OllamaResolver, OpenRouterResolver), and drift detection.

License

MIT.