Adversarial decision hardening for multi-agent systems. An R0 entry gate, a mandatory adversary pass, domain-dependent score floors, a human lock, and a signed decision record — so a high-stakes decision made by agents can be audited after the fact.
Canonical repo: icohangar-ops/consensus-hardening-protocol
Profile A — deliberation engine, R0/foundation/adversary/human lock, CLI, and the normative spec + conformance harness.
pip install consensus-hardening-protocol- Package: consensus-hardening-protocol
- Requires Python 3.10+ · no required dependencies
from chp import CHPOrchestrator, DecisionRegistrychp init --applyProfile B — capital / spend gate, float-aware canonical JSON, and signed audit ledger. Lives in a sibling package so Node apps can depend on a small surface:
npm install @cubiczan/chp- Package: @cubiczan/chp
- Source: icohangar-ops/cubiczan-chp
import { evaluateGate, approveHuman } from "@cubiczan/chp";Both packages are checked against spec/CHP-v1.0.md golden vectors
(Python reference: 70/70 · TypeScript Profile B: 30/30).
| Server | Install | Role |
|---|---|---|
@cubiczan/chp-mcp |
npx -y @cubiczan/chp-mcp |
Profile B spend/HITL (evaluate_spend_gate) |
@cubiczan/agent-conductor |
npx -y @cubiczan/agent-conductor |
AGENTS.md + skills + Profile A decision_gate / decision_adversary |
@cubiczan/governed-mcp-gateway |
npx -y @cubiczan/governed-mcp-gateway |
HTTP MCP control plane (principal + vault) |
@cubiczan/codesentinel-mcp |
npx -y @cubiczan/codesentinel-mcp |
Codebase health analysis |
Both are registered under the official MCP Registry (io.github.icohangar-ops/*).
Conformance: Profile A 70/70 · Profile B 30/30 (golden vectors in spec/).
CHP is the engine. MCP servers are the transport. Clients never call the package directly unless they are libraries themselves.
MCP client (Cursor / Claude / …)
│ tools/call
▼
┌───────────────────────────┐
│ MCP server (transport) │ ← agent-conductor, codesentinel-mcp, …
│ decision_gate │
│ decision_adversary │
│ evaluate_spend_gate │
└─────────────┬─────────────┘
│ depends on
▼
┌───────────────────────────┐
│ Published CHP packages │
│ PyPI: consensus-hardening-protocol (Profile A)
│ npm: @cubiczan/chp (Profile B)
└───────────────────────────┘
| Layer | Role | Example |
|---|---|---|
| MCP client | Issues tools/call |
Cursor, Claude Code, Copilot |
| MCP server | Exposes CHP as tools | agent-conductor (decision_gate → R0, decision_adversary → triangulation) |
| Published package | Protocol implementation | this repo (PyPI) · @cubiczan/chp (npm) |
An agent that is confident and wrong is more dangerous than one that is slow. CHP puts four things in the way of a decision before it is allowed to stand:
| Stage | Rule |
|---|---|
| R0 gate | The session cannot open unless the problem is solvable, scoped, valid and worth doing. All four, or HALT. |
| Foundation | An adversary attacks the stated assumptions and scores the foundation. The score is gated against a floor that depends on the domain — 70 general, 85 blockchain, 100 finance. |
| Adversary pass | A dedicated agent argues against the emerging decision. Its findings are recorded, not summarised away. |
| Human lock | A provisional lock becomes a real one only when a third party confirms it. |
Every step lands in a DecisionCase that serialises to a signed record, so the
question "why did we do this?" has a mechanical answer.
from chp import CHPOrchestrator, DecisionRegistry, DecisionCase, Dossier
from chp.models import FoundationAttack, FoundationDisclosure
orch = CHPOrchestrator(registry=DecisionRegistry())
case = DecisionCase(
decision_id="fund-tier-1",
title="Fund the enterprise tier",
domain="capital_allocation", # floors at 100, not 70
created_at="2026-08-21T10:00:00Z",
owner="cfo",
high_stakes=True,
dossier=Dossier(
core_problem="Should we fund the tier?",
goal_state=["grow ARR"],
current_state=["18 months runway"],
constraints=["no new raise"],
scope=["this fiscal year"],
),
)
report = orch.run_initial_session(
case=case,
foundation_disclosure=FoundationDisclosure(
weakest_assumptions=["Market growth continues"],
invalidation_conditions=["Recession"],
key_vulnerability="Revenue concentration",
),
foundation_attack=FoundationAttack(
assumption_attacks=["Market may contract"],
vulnerability_strike="Single customer dependency",
foundation_score=85,
),
)
report.foundation_verdict # Verdict.REFRAME — 85 is below the floor of 100
report.initial_packet # "" — nothing is emitted on a REFRAMEAn 85 would have passed under a 70 floor. In a capital-allocation domain it does not, and that difference is the point of the library.
chp init # dry run — shows what it would write
chp init --apply # writes .chp/That drops the governance kit into .chp/ — R0_CONFIG.yaml, the adversarial
prompt set, the state machine, and the compliance checklist. It never replaces an
existing file unless you pass --force, and it is safe to re-run.
spec/CHP-v1.0.md is the normative specification. It is implementation-agnostic:
any port in any language can be checked against the golden vectors.
python spec/conformance/run_conformance.py --adapter reference
# CHP v1.0 conformance — adapter: reference
# passed 70/70
# result CONFORMANTPorts in other languages implement a line-JSON adapter (§7.2) and run against the same vectors:
python spec/conformance/run_conformance.py --adapter-cmd "node my-port.js"Exit status is 0 only when every selected vector passes, so this drops into CI.
spec/DIVERGENCES.md records what a survey of six shipped implementations found,
each item cited to a file and symbol, each with a conformance vector so it fails
CI rather than sitting in a comment.
The highest-severity finding, D-A1, was that the canonical port hardcoded a
foundation floor of 70 for every domain, so a finance decision scoring 70 cleared
a gate documented as requiring 100. That is fixed here: chp.foundation
resolves the floor from the domain, matches
spec/conformance/chp_reference.py exactly, and a test asserts the two cannot
drift apart. A domain that merely resembles a listed one — finance_adversary
against finance — still takes the default floor per spec §5.3, but logs a
warning, because reintroducing D-A1 through naming alone is too easy.
pip install "consensus-hardening-protocol[resilience]" # pulls cubiczan-resilience from PyPI
pip install "consensus-hardening-protocol[cockroachdb]" # distributed registryThe resilience extra depends on cubiczan-resilience (timeout, jittered backoff, circuit breaker). TypeScript / Rust ports: @cubiczan/resilience and resilient-call.
Without the resilience extra, the package uses a dependency-free retry with
exponential backoff that honours max_attempts but not timeout — bounding an
arbitrary call without threads is not portable.
DecisionRegistry is in-memory by default and auto-detects a CockroachDB backend
when one is reachable. The database layer ships with the Cognitive Mesh host
rather than this package.
chp.AdversaryMeshAgent is an adapter for that same host. It is exported lazily,
so the package imports fine without it.
MIT.