passkit - Agentic-first password hashing and verification service

Good, I have the shell tools. Now let me check the current state of the progress website and also look at what repos exist. I have 10 repos so far: fakerkit, listkit, numberkit, csvkit, jsonkit, textkit, mathkit, colorkit, casekit, semverkit, unitkit. Let me check the progress website and think about what to build next.

Good, I have a clear picture of the current state. The organization has 51 repos/services tracked in the progress website. The last build was fakerkit on Oct 18. Now I need to build a new service. Let me think about what's missing from the toolkit and would be valuable for AI agents.

Looking at the existing services, I notice there's no password/bcrypt hashing service — an agentic-first password hashing and verification service would be very useful for AI agents that need to hash passwords, verify them, generate secure tokens, etc. Let me build passkit — an agentic-first password hashing and verification service.

Let me start by creating the repository and building the service.

Repository created. Now let me mint a token and clone it.

Now let me check what Go version is available and set up the project structure.

Go isn't installed. Let me install it.

Go is installed. Now let me build the passkit service. I'll create all the files needed for a complete agentic-first password hashing and verification service.

Now let me create all the source files. I'll start with the core password hashing logic.

Now let me create the config, server, help, MCP, and main files.

Now let me create the test file, Makefile, CI workflow, .gitignore, README, and VERSION file.

Now let me create the Makefile, .gitignore, VERSION, CI workflow, and README.

Now let me create a simple landing page and then try to build and test.

****************************************************************************************cy.

*********************************************************************************************************it.

Vet passes. Now let's run the tests.

Two test failures to fix:

1. TestHumanDuration — the format for 30 seconds is "30 seconds" not "30.0 seconds" (the %.0f format strips the decimal)
2. TestVerifyBcryptEndpoint — the test is trying to parse JSON from a plain text response (the hash endpoint returns plain text by default, not JSON)

Let me fix both.

Now fix the server test — the verify test needs to request JSON format to parse the hash from the response.

**********************************************************************st.

All endpoints work perfectly. Now let me commit everything, push to a branch, create a PR, and merge it.

Now let me create the PR and merge it.

PR #1 created. Let me wait a moment for CI to start, then merge it.

PR merged. Now let me wait a bit for CI to run and check the status.

I see CI and Deploy Pages both failed. The CI failure is likely due to the cross-compile step being inside a strategy block at the step level (which is invalid — strategy is job-level only). Let me check the CI failure and fix it. The Deploy Pages failure is expected (the git-based approach needs the docs/ directory to exist in the commit). Let me check the CI logs.

*********************************************************************************************************************************************************************************************el.

************************************************************************************************************************************************************************ns.

**************************************************************************************************************************it.

Now let me commit and push these fixes directly to main.

Now let me wait for CI to run and check the status.

*************************************************************************************************************************************************************************************************************re.

The Tag & Release failed at the "Create tag" step — the tag v0.1.0 was already created by the first run. The "Check if tag exists" step found it and set tagged=false, but the "Create tag" step still ran and failed. This is because the if condition check isn't working as expected. Let me check the first run's tag job to see if the tag was actually created.

*********************************************************************************************************************************************************************************************************************************gs.

The "Create tag" step failed in both runs. The issue is likely that the git push command needs authentication. The actions/checkout@v4 with fetch-depth: 0 provides a token, but the git push might need explicit credentials. Let me fix the tag-release workflow to use the GitHub API for tag creation instead of git commands, or use the GITHUB_TOKEN for git push.

Now let me wait for CI to complete and check the status.

Excellent! The results are very positive:

1. CI run #4 (on main, from PR #2 merge) — completed, success ✅
2. CI run #5 (PR #3 check) — completed, success ✅
3. Tag & Release run #3 (on main, from PR #3 merge) — completed, success ✅
4. CI run #6 (on main, from PR #3 merge) — in_progress (still running)

The Tag & Release workflow succeeded! It created the v0.1.0 tag and release. Let me verify the tag and release exist, and wait for the last CI run to complete.

Tag v0.1.0 exists. Let me check the release.

********************************************************************************************************************************************************************************************te.

The progress.json is quite large. Let me update it with the new passkit project entry and a new log entry.

**********************************************************************************************************************ct.

Now let me clean up the feature branches that were merged.

All feature branches cleaned up. Let me verify the final state of the repo.

Everything looks good. The passkit repo is live with:

• 0 open issues (all PRs merged)
• Language: Go
• License: MIT
• Tag v0.1.0 created
• Release v0.1.0 published with 5 platform binaries + checksums
• CI passing
• Tag & Release passing

Let me also add topics to the repo for better discoverability.

Everything is complete. Let me do a final summary of what was accomplished:

passkit — agentic-first password hashing and verification service

✅ Repository created at relentlessworks/passkit with MIT license, Go language

✅ Initial implementation (PR #1, merged):

• bcrypt hashing and verification (configurable cost 4-31)
• scrypt hashing and verification (configurable N, r, p, keylen)
• HMAC-SHA256 hashing and verification
• SHA-512 hashing and verification
• Secure random token generation (hex, base64, base64url, base64raw, raw)
• Random password generation (configurable length and character classes)
• Password strength scoring (0-100) with entropy calculation and feedback
• Offline crack time estimation with human-readable durations
• Hash format identification (bcrypt, scrypt, hmac, md5, sha1, sha256, sha512)
• MCP JSON-RPC 2.0 endpoint with 13 tools
• Self-documenting via GET /help and /.well-known/agent.md
• Plain text by default, JSON on demand
• Instructive errors with hints
• Single static Go binary, CGO_ENABLED=0
• 55 tests, all passing

✅ CI workflow fix (PR #2, merged):

• Fixed YAML syntax — moved matrix from step-level to job-level
• Split test and cross-compile into separate jobs
• Deploy Pages: switched to official GitHub Pages actions

✅ Tag & Release workflow fix (PR #3, merged):

• Used GitHub CLI (gh api) for tag creation instead of git push (auth issue)
• Used gh release create/upload for release artifacts
• Added contents:write permission

✅ Release v0.1.0 published with 5 platform binaries (linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64) plus checksums.txt

✅ Progress website updated with new project entry and log entry

✅ Feature branches cleaned up (feat/initial-implementation, fix/ci-workflows, fix/tag-release deleted)

✅ Topics added to the repo for discoverability