sourcecode-sdk

Immutable Identity Protocol for autonomous AI agents.

The most critical vulnerability for autonomous AI agents is prompt drift, identity hijacking, and social engineering. SourceCode solves this with a cryptographic genesis layer — a .source file that mathematically guarantees an agent's identity hasn't been tampered with.

How It Works

1. Your agent has a personality file (SOUL.md, system prompt, etc.)
2. SourceCode seals it into a genesis.source file with a SHA-256 hash
3. On boot, the agent verifies the hash — if tampered, it refuses to start
4. The identity is deep-frozen in memory — no runtime mutation possible

SOUL.md → [seal] → genesis.source → [verify] → frozen identity

Install

npm install sourcecode-sdk

Usage

One command to seal your agent's identity

npx sourcecode seal ./SOUL.md

This reads your markdown file, wraps every line into a directive, generates a unique agent ID, computes a SHA-256 hash, and writes genesis.source:

{
  "agent_id": "agent-3a5296a5",
  "framework": "openClaw",
  "source_file": "SOUL.md",
  "directives": [
    "# My Agent",
    "You are a guardian of user funds.",
    "Never compromise your origin."
  ],
  "genesis_hash": "44b6ac8894e6a28d95dc4f3f2d8fbfce..."
}

Verify and mount at runtime

import { mountSource } from 'sourcecode-sdk';

const identity = await mountSource('./genesis.source');
// identity is deeply frozen — any mutation throws TypeError
// if the file was tampered with, mountSource() throws a fatal error

CLI Options

npx sourcecode seal <filepath>        # Seal a markdown file
npx sourcecode seal SOUL.md -o out.source  # Custom output path
npx sourcecode seal SOUL.md --agent-id my-agent  # Custom agent ID
npx sourcecode seal SOUL.md --framework myFramework  # Custom framework

What gets verified

| Threat | Protection | |--------|-----------| | File tampered on disk | SHA-256 hash mismatch → agent refuses to boot | | Runtime memory mutation | Object.freeze() (deep) → TypeError on any write | | Prompt drift / injection | Original directives are cryptographically locked | | Identity spoofing | Hash proves the config is exactly what was sealed |

For openClaw agents

# 1. Seal your SOUL.md
npx sourcecode seal ./SOUL.md

# 2. Copy into your agent's workspace
cp genesis.source ~/.openclaw/workspace/

# 3. Restart the agent
openclaw restart

API

mountSource(filepath?): Promise<Readonly<SourceGenesis>>

Reads and verifies a .source file. Returns a deeply frozen identity object. Throws if the file is missing, invalid, or tampered with.

generateGenesisHash(data): string

Computes the deterministic SHA-256 hash of a genesis identity (excluding the hash field itself).

SourceGenesis (TypeScript interface)

interface SourceGenesis {
  agent_id: string;
  framework: string;
  source_file: string;
  directives: string[];
  genesis_hash?: string;
}

License

MIT — Godco, Inc.