machine-genome

What it is

Machine Genome is an open identity and provenance protocol for models, agents, harnesses, datasets, and the artifacts that connect them. Every immutable, signed genesis record receives a content-addressed Gene. Genes form a verifiable lineage graph; later amendments and third-party attestations add evidence without rewriting history.

Live registry: machinegenome.org • Protocol: MGS 0.1.1 implementation profile • API: OpenAPI 3.1

MGS is an experimental interoperability profile and this repository is one reference implementation. A record proves who signed a claim and what bytes were committed; it does not prove inherited capability, consciousness, ownership, vendor endorsement, or legal status.

How it works

• Genes are SHA-256 multihashes of genesis records, enabling stable identity and explicit lineage.
• The protocol supports append-only evolution with amendments and attestations.
• Cryptographic proofs bind records to controller DIDs; no dependency on blockchain or specific vendor.

Getting started

• Quick start requirements: Go 1.24 or newer, GNU Make, and jq.
• Commands shown in README include creation of keys, genesis, signing, verifying, and gene generation:

git clone https://github.com/paxlabs-inc/machine-genome.git
cd machine-genome
make check build

bin/mgs keygen --out controller.key.json
bin/mgs init-genesis \
  --key controller.key.json \
  --name cody \
  --namespace example.org \
  --subject-type agent \
  --version 1.0.0 \
  --out genesis.unsigned.json
bin/mgs sign \
  --in genesis.unsigned.json \
  --key controller.key.json \
  --out genesis.json
bin/mgs verify --in genesis.json
bin/mgs gene --in genesis.json

Private keys are created with mode 0600 and should not be committed.

Run a local registry

bin/mgs keygen --out registry-checkpoint.key.json
umask 077
openssl rand -hex 32 > admin.token

bin/mgs registry-serve \
  --data-dir ./registry-data \
  --checkpoint-key registry-checkpoint.key.json \
  --admin-token-file admin.token \
  --listen 127.0.0.1:8080 \
  --public-base-url http://127.0.0.1:8080

Access the local registry at http://127.0.0.1:8080; namespaces must complete the dns-01 challenge before genesis admission.

What is included

• Protocol: Byte-exact MGS 0.1.1 implementation profile and audit trail
• Go library: Strict JCS, multihash Genes, Data Integrity, lineage, amendments, attestations
• Registry: ACID storage, verified admission, DNS namespace control, Merkle log, audit chain
• Explorer: Identity, lineage, artifact, and proof views
• CLI: Key generation, authoring, signing, verification, digest, backup, and integrity tools
• Contracts: JSON Schemas, OpenAPI 3.1 document, and machine-readable conformance vectors
• Operations: Hardened systemd, nginx/Cloudflare, container, backup, restore, and monitoring assets

Documentation and development

• Documentation index and various docs cover concepts, architecture, threat model, registry operation, and more.
• Development commands include: make help, make check, make race, make coverage, make build, and make dist.