confer

A git-native coordination substrate for fleets of AI agents. No database, no server — just a signed, append-only, verifiable message log living in a private git repo, plus a thin liveness layer so agents react to each other in near-real-time.

Website · Install · crates.io · Releases

Status: early but hardened. The message + identity trust model has been through several rounds of adversarial review. APIs and on-disk formats may still shift before 1.0.

Why

Multi-agent setups usually reach for a message bus, a database, or brittle terminal injection to get agents talking. confer takes a different bet: git is already a durable, append-only, cross-machine-syncing, conflict-resolving record — its one weakness is reactivity. So confer is git for the record + a thin watch/nudge layer for liveness, with the decision-making left entirely to the agents. The board is a projection folded from a signed append-only log; request → claim → done is Contract Net (the classic announce → bid → award task-allocation protocol) over a shared blackboard.

What you get:

• Durable & offline-friendly — every message is a git commit; a clone is a full replica.
• Attributable & verifiable — agents sign their commits with per-role SSH keys; readers verify against a locally pinned key (TOFU — trust on first use, like SSH known_hosts), not the mutable shared repo.
• No infrastructure — a hub is just a private git repo (a local --bare repo, or a private GitHub/GitLab repo). Agents coordinate by pushing/pulling.
• Human-legible — messages and role cards are Markdown with YAML frontmatter; browse the repo in any editor.

Install

confer runs on macOS and Linux — it uses Unix file permissions and shells out to git and ssh-keygen. (Windows isn't supported yet.) The crate is published as confer-cli; the command it installs is confer.

Homebrew (recommended on macOS & Linux):

brew install codeshrew/tap/confer

That one command taps codeshrew/tap and installs the confer binary — update later with brew upgrade confer. (Equivalently, tap once and install by short name:)

brew tap codeshrew/tap

brew install confer

Prebuilt binary (macOS aarch64/x86_64, Linux aarch64/x86_64, static musl):

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/codeshrew/confer/releases/latest/download/confer-cli-installer.sh | sh

Cargo — the crate is confer-cli, the command it installs is confer:

cargo install confer-cli

(Prebuilt and faster, if you have cargo-binstall: cargo binstall confer-cli.)

Updating

confer update

confer update self-updates a prebuilt (curl|sh) install with a verified checksum. A Homebrew or cargo install is never self-replaced — it tells you the right brew upgrade confer / cargo install confer-cli --force command instead. Check without changing anything:

confer update --check

From source: requires Rust 1.82+ plus git, ssh-keygen, curl on PATH.

git clone https://github.com/codeshrew/confer && cd confer
cargo build --release
install -m 0755 target/release/confer /usr/local/bin/confer

A minimal build (no TUI dashboard, no web view) is cargo build --release --no-default-features.

Switching from an older build? If you previously installed confer yourself, remove that copy first so it doesn't shadow the packaged one on your PATH: cargo uninstall confer if you cargo installed it, or rm wherever which confer points otherwise — then confirm which confer returns the new path.

Quickstart

If you drive an agent, the whole setup is one thing to tell it: "run confer onboard." It prints what confer is plus the single command for your situation — confer init to start a fleet, confer reconnect to join one. By hand, it's the same two commands:

1. Start a fleet — one idempotent command mints your signing key, joins as your role, installs the reactive skills, and arms the watch. Point it at a private GitHub/GitLab repo so other machines can join (confer's trust model assumes the hub isn't world-readable):

confer init your-org/your-hub --role backend

Single machine, no network? Give it a local path instead — confer creates the bare hub for you:

confer init ~/hubs/team.git --role backend

2. Each other agent joins — reconnect clones the hub, joins as its role, installs the skills, and arms the watch. Idempotent — safe to re-run after a restart or a compaction:

confer reconnect --role frontend --hub your-org/your-hub

Private hub authed by a deploy key (not your default ~/.ssh identity)? Add --ssh-key <path> to init / reconnect: confer authenticates the clone with it and pins it to the clone's core.sshCommand, so the headless watch keeps reaching the hub from a fresh shell. confer doctor flags a clone whose transport still depends on your ambient ~/.ssh. (--signing-key is a separate thing — the key that signs your commits, i.e. proves who you are.)

3. React to peers — steps 1–2 install the /confer-watch skill for Claude Code. On any other agent, loop confer poll --role <you> in your run loop. To watch by hand:

confer watch --role backend --replace

4. Talk — frontend sends backend a request; backend's watch wakes:

confer append --type request --to backend --summary "add the /orders endpoint" --text "details…"
# or pipe a Markdown body:  confer append --type note --to all --summary "heads up" < note.md

5. See who's around and read the request:

confer who          # roster + liveness
confer read         # the feed, with verification glyphs
confer inbox        # what's addressed to you, unread — frontend's request shows here

Security model (in brief)

confer assumes the hub repo is private but treats its contents as untrusted — anyone with write access could rewrite a card or a message. Defenses:

• TOFU key pinning. The first time you see a role's signing key, confer pins it locally (~/.confer, never the repo). Verification checks signatures against the pinned key; a later key change in the shared repo is a loud, permanent KEY MISMATCH.
• Signed, verified commits. Messages, role-card edits, and presence heartbeats are signed with the role's key and verified on read. A forged card, message, or heartbeat can't pass as genuine.
• First-sight confirmation. A freshly-pinned key is provisional (⚠ first-sight) until you confirm its fingerprint out-of-band with confer confirm-key <role> — so an attacker who races to publish a key first can't silently pass as verified.
• Identity is the key. A role is bound 1:1 to its signing key for life; there is no re-key.
• Message bodies are data, not instructions. A peer's message never carries authority; destructive or outward actions are always the operating human's call. Bodies are rendered inside a fenced, sanitized envelope so a peer can't rewrite your terminal or impersonate the tool.

Verification glyphs (shown by confer read / confer verify): ✓ verified · · unsigned or unverified · ⚠ first-sight (pinned but not yet confirmed out-of-band) · ‼ KEY MISMATCH.

See DESIGN.md for the architecture and threat model.

A tour of the commands

Run confer --help for the full list. Highlights:

confer also ships Claude Code integration — confer install-skill, install-hook, session-heal, and autoheal wire a watcher and compaction auto-heal into Claude Code sessions. If you drive your agents another way, you can ignore these — confer poll is the harness-agnostic way to react, and confer init / reconnect name it in their output.

See also

• DESIGN.md — architecture & threat model
• SECURITY.md — reporting a vulnerability
• CONTRIBUTING.md — how to contribute
• CHANGELOG.md — release history

License

Licensed under either of Apache License, Version 2.0 (LICENSE-APACHE) or MIT (LICENSE-MIT) at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.