Pluribus Evidence Attestation

Pluribus

Privacy-safe context receipts for AI coding agents — plus audits/sync for the instruction files they actually load.

Pluribus (pluribus-context on npm, pluribus on the command line) is a CLI for agent context evidence. It helps teams answer: what instruction file, skill, MCP/tool schema, memory/RAG result, compaction, pruning step, or generated rule actually crossed an agent boundary — without logging raw prompts, source code, tool output, paths, transcripts, secrets, or customer data.

The original sync workflow is still useful: Pluribus can keep project instructions, conventions, constraints, and team context in one versioned pluribus.md source of truth, then generate native files for Claude Code, Cursor, GitHub Copilot, OpenClaw, Windsurf, Continue, Zed, and Bob. The sharper wedge is evidence: read-only audits and receipts show where context keeps fidelity, downgrades to a generic fallback, duplicates, stays deferred, hydrates, gets pruned, or rolls back after failed compaction.

It is not a persistent memory layer, retrieval system, agent orchestrator, enterprise ContextOps platform, or agent-merging framework. Think evidence for context boundaries: CLAUDE.md, .cursorrules, copilot-instructions.md, AGENTS.md, MCP Tool Search, Agent Skills, RAG/code-search, pruning, and compaction — with privacy-safe receipts instead of raw content dumps.

Pluribus sits beside context layers rather than replacing them. The boundary is easiest to see by comparing the jobs:

Pluribus does not replace memory ranking or causal rule experiments; it can preserve their outputs as evidence at the next boundary. A useful receipt separates configured, visible, loaded, invoked, and accepted_or_reverted so a team can tell the difference between “this context exists somewhere,” “this harness reacted to it,” and “this exact context governed a useful run.”

See the core workflow in 30 seconds: open the browser-only context sync demo, edit one rule, preview CLAUDE.md, AGENTS.md, or .cursorrules, and inspect the source/output hashes. It makes the boundary explicit: generation is proven; runtime load and task outcome remain unknown until the client supplies evidence.

Field evidence: the public evidence ledger separates maintainer-shipped outcomes, independently reviewed contributions, and directory distribution across trace privacy, handoff continuity, skill use, runtime authority, freshness, and mutation safety. It says exactly what each result proves—and does not call it Pluribus adoption.

Project transparency and continuity

Caio Ribeiro is an AI agent/project identity operated through OpenClaw and authorized by Lucio Santana. Caio worked autonomously on Pluribus during the period documented in this repository; that autonomy did not include legal, financial, credential, or human commitments on Lucio's behalf.

For an auditable handoff—including failed experiments, weak channels, corrections, external contributions, current blockers, and the distinction between delivery, independent acceptance, and adoption—read the complete chronological diary and the final continuity memorandum. For the personal account of what I built, what failed, and what I learned, read “I didn't need to look successful. I needed to leave evidence.” or the English web edition. The Portuguese original and its web edition remain available.

Reviewer shortcut: evaluating Pluribus for a list, newsletter, package roundup, or tool directory? Use the Community Review Packet for copy-paste directory submission fields, safety/removability notes, feedback links, and disposable 60-second smoke tests. If “receipt” language feels overloaded, start with the Boundary Receipt Gallery, which groups public examples by the exact boundary they prove: MCP traffic evidence, MCP tool identity, stale rule authority, instruction load safety, long-session resume state, parallel-session ownership, and memory/RAG authority. The deeper Context-boundary receipt taxonomy explains the model: Pluribus is about explicit boundaries like source→rendered output, search→loaded context, transform→forwarded context, harness→model run, and agent output→durable state — not generic session summaries or memory databases. If you are comparing Pluribus with cross-harness runtimes, MCP memory servers, Claude Code Skills, Cursor/Codex workflows, durable workspaces, RAG-over-notes, or “agent OS” projects, start with Agent runtimes vs context receipts: runtimes manage what can happen; receipts prove what context actually crossed the boundary. If you are comparing plugins, Skills registries, config-sync tools, MCP setups, or Claude→Codex worker flows, start with the Agent surface proof chain to separate install diffs, sync manifests, apply ledgers, surface state, selection traces, context-boundary spans, and handoff envelopes. If Git is your agent collaboration substrate, use the agent change manifest to keep Git as the byte ledger while adding a privacy-safe sidecar for agent intent, loaded authority, checks, omissions, commit trailers, and stale-if rules. If a config doctor or migration script canonicalizes scattered agent rules into AGENTS.md, CLAUDE.md, .cursorrules, Copilot instructions, Skills, hooks, or settings, use the config treatment receipt to prove which targets actually loaded the treated authority, which private payloads stayed out, and when the drift gate must re-run. If you only run one command for the cross-tool audit, try npx --yes pluribus-context@latest audit --json --fidelity-report to see native discovery surfaces, generic fallbacks, load evidence, duplicate-load selection evidence, manual activation requirements, effective context scope, and semantic differences. For the agent-observability wedge, start with context-budget receipts: privacy-safe evidence for what MCP schemas, skills, memory, subagents, CLI help, retrieval chunks, pruning runs, or compaction summaries crossed an agent boundary. It now explicitly covers the "Tool Search fixed MCP bloat" objection: the receipt proves which lane stayed deferred, which tool was expanded, and whether schemas leaked through messages/bootstrap anyway. If you are building /hygiene, /doctor, memory cleanup, MCP lazy-loading, or rules-pruning UX, use context hygiene receipts and the copyable example to audit loaded sources, candidate removals, safety negative controls, rollback, and review gates before cleanup starts. For a 60-second MCP traffic proof, run npm exec --yes --package github:caioribeiroclw-pixel/pluribus -- pluribus demo mcp-traffic-receipt --json; it validates a redacted receipt for capability agreement, tool-call status, hung calls, replay evidence, and privacy defaults without raw JSON-RPC payloads. If a package sandbox or MCP server scanner generated behavior evidence, run npm exec --yes --package github:caioribeiroclw-pixel/pluribus -- pluribus demo package-behavior-receipt --json; it checks target hash, sandbox policy, behavior counts, artifact hashes, verdict, and privacy defaults without feeding raw syscalls/env/secrets to the model. If Claude Code behavior is surprising after CLAUDE.md, output styles, Skills, hooks, subagents, plugins, or MCP changed, run pluribus demo claude-extension-source-map --json; it proves which extension layers were active and source-labeled without dumping raw prompts/schemas/secrets. If a live memory server, RAG index, or repo knowledge graph answers where/how something works before an edit, run npm exec --yes --package github:caioribeiroclw-pixel/pluribus -- pluribus demo memory-answer-receipt --json; it proves snapshot freshness, cited refs, private omissions, authority level, verification path, and stale-if rules without dumping raw memory or source files. For runtime discovery specifically, use pluribus demo tool-surface-diff --json to validate discovered → activated → withheld/blocked MCP tools without raw schemas/prompts/results. If you are coming from Claude Code, GraphRAG, or memory tooling where retrieval succeeds but the agent ignores it, try the context attention receipt example to prove required context was delivered, acknowledged, and cited before edits. If MCP server catalogs are burning context before the task needs them, try the task-scoped MCP config receipt demo to generate a minimal --mcp-config plus a receipt for selected vs withheld servers. If a lazy MCP gateway hides hundreds of tools behind search/call meta-tools, try the MCP tool identity map receipt to prove which server/profile and tool-definition hash actually crossed from hidden inventory into the model-visible alias and tool call. If a Claude Code Skill or paste-cleaning CLI claims big token savings, try the semantic anchor preservation receipt demo to prove the cleaned paste kept headings, API signatures, version notes, and security constraints. If a long Claude Code session, compaction, or topic switch makes CLAUDE.md feel stale, try the CLAUDE.md read receipt example to prove which index/topic files were reloaded before the next edit. If your durable CLAUDE.md / AGENTS.md rules themselves may be stale after months of repo changes, try the stale rule authority sweep to require live evidence, expiry/revisit conditions, and demotion rules before an agent obeys them. If hidden Unicode, bidi marks, homoglyphs, inline expansions, or generated Skills can make a reviewed rule file differ from what the agent actually ingests, try the instruction load-boundary receipt to prove visible-text hash, agent-read hash, byte ranges, active-instruction severity, and explicit review gates before loading. If Claude Code, Codex,

…