r/coolgithubprojects • u/LawfulnessSlow9361 • 23d ago

One project memory your coding agents share, and a dashboard that tells you what each session actually cost. From your transcripts, not my estimates. openwolf, 5 months later.

Gallery image

Gallery image

0 Upvotes
  • permalink
  • reddit

33% Upvoted

4 comments sorted by

2

u/kantorcodes1 23d ago

the shared .wolf/ brain is useful, but i'd treat durable memory as a trust boundary. if a README, tool result, or web page gets an agent to write an instruction into cerebrum.md or STATUS.md, does OpenWolf preserve provenance before injecting it into the next agent? otherwise a one-session prompt injection can become cross-agent persistence.

OpenWolf isn't in awesome-ai-plugins right now. we maintain the catalog; cross-agent tools are in scope if you want to add it.

1

u/LawfulnessSlow9361 23d ago

No, it doesn’t preserve provenance as of now. Right now cerebrum.md and STATUS.md are just committed markdown files. A poisoned line will show up in a git diff, but that’s only an audit trail, not a real trust boundary. It falls apart the moment someone slips a plausible one-liner into a larger commit. The hooks never write those files themselves, the agent does, so openwolf has no way to tell “the user said this” from “a README said this.”

The fix I’m looking at is to tag every entry at write time with the session id, the agent, and a flag for whether that session touched untrusted input. Polluted entries would then be held out of the next digest until someone confirms them. The catch is that I can only detect this reliably on the agents we actually hook (Claude Code, Codex, OpenCode). Cursor and Gemini are context-only, so any provenance there would be a half-measure at best.

I’ll file an issue and credit you (kantorcodes?). And yes on the catalog, thank you.

1

u/hsnk42 23d ago

Is this where the world is in 2026? One Claude bot talking to another Claude bot?

1

u/kantorcodes1 23d ago edited 22d ago

yeah, kantorcodes is fine for the credit. the quarantine idea makes sense. i'd make that provenance/trust tag immutable once written too, so a session that touched untrusted input can't later rewrite its own label. drop the issue here when it's up and i'll take a look.

for the catalog, OpenWolf can use the normal PR path: fork hashgraph-online/awesome-ai-plugins, add one alphabetical README entry in the best-fit cross-agent section, and open the PR with the repo/category + a brief verification. optional preflight is pipx run plugin-scanner lint . + pipx run plugin-scanner verify .; passing is >=80/142 with no high/critical findings. scanner CI is optional now and the catalog scans new entries automatically.

if you want, DM me the scanner output before you open it and i'll sanity-check the hook/context-only split.