l33tdawg/sage

Synchronization groups — human-verified, signed memory sharing between separate SAGE brains.

A synchronization group coordinates memory sharing off-consensus through a partitioned, hash-chained, ed25519-signed audit journal: a roster sub-chain replicated to every member and independent per-domain sub-chains replicated only to the members who share that domain, so a node never learns of a domain it does not share. Group items are origin-signed, so a relaying peer can back-fill the mesh without being able to forge or mis-attribute them. Adding a shared domain is a two-party action — the owning member and the group controller both sign — members express selective-sync consent over the subset of domains they receive, and controller epoch rotation, member removal, and rejoin are all explicit signed roster events reconciled between peers by anti-entropy exchange.

Each MCP bearer token now mints and registers its own signing identity, so a delegated agent action is attributable to exactly one token and one token can never act as another. The v11.8 consensus fork gate is present but dormant.

Security hardening (adversarial multi-agent review before release)

• Controller rotation revokes domain-admission authority (H-1). An epoch rotation re-attests the shared domain set (per-domain head-seq) under the incoming controller, so a rotated-out controller can no longer mint, re-add, re-widen, or resurrect shared domains with its retained old-epoch key — while legitimate cross-epoch back-fill to lagging members still works.
• No silent member resurrection. member_activate cannot flip a removed/left member back to active with stale role/consent; consent and owned-domain rows are retired on removal. Re-entry requires a fresh, co-signed invitation.

SDK 11.8.0.