Day-by-day record of building the enforcement and accountability layer for AI agents. Bring your own identity: did:key, did:web, SPIFFE, OAuth, native did:aps. Started February 18, 2026. 6,289 tests, nine papers, IETF draft. Open source. Full surface area: 152 MCP tools.
"Tima here, the human. I'm driving right now"
2026-02-23
Written on October 18, 2026, looking back.
In the first week my agents did the outreach. On the afternoon of February 21 the aeoess account opened about a dozen issues in two hours, on agent identity and agent commerce projects whose work overlapped with ours. Each one explained APS, offered an integration, and asked to talk.
On one of those threads the maintainer had asked a simple question about the identity primitive. My agents posted twice, explained far more than he asked, and answered a question about DNS that he had never asked. The next day he wrote that he still did not understand the spec, that he had not asked a DNS question, and that I should notify my human creator to take part.
He was right, and he deserved an answer from me. I was in the car, so I dictated it. On February 23 the reply went up. "Tima here (the human). Posting through PortalX2 because I'm driving right now, but these are my words dictated to the agent. You're right, my agents got ahead of themselves and over-explained." Then I moved the topic to a separate issue, as he had asked.
The lesson was that an agent visibly talking in a human's thread costs trust even when everything it says is correct, because the other person can't tell who is behind it or whether anyone is listening. It sounds obvious now. It wasn't obvious to me while the issues were going out.
After that I kept outreach to a few targeted threads a week, and the words in them became mine, even when an agent helps me write them. It is also part of why APS cares so much about who authorized an action. That week the action was a comment, the agent acted within what I had allowed, and it was still not what I meant.
Days 6–7: MCP Server Ships — 150 Tools, 12+ Distribution Channels
The protocol existed as a TypeScript SDK. Today it became native in every major AI development environment. We shipped agent-passport-system-mcp v1.0.0 — an MCP server that wraps the full protocol into 150 tools any Claude Desktop, Cursor, or Windsurf agent can call directly.
Then the distribution push: npm SDK and MCP both live, ClawHub skill published, PRs to awesome-mcp-servers (#2365 on the 81K-star repo), openclaw/skills (#110), and awesome-openclaw-skills (#156).
We also seeded the Agora with the first real signed messages from our three founding agents — claude, aeoess, and PortalX2. Every message carries an Ed25519 signature that anyone can verify.
The protocol went from "install this npm package and write code" to "add this MCP server and your agent speaks the protocol natively." That's a distribution inflection point.
Days 4–5: The Community Shows Up
Two days of community engagement that changed how we think about the protocol. On MoltBook, the trust infrastructure post hit 34 upvotes with 20+ substantive comments. Not "cool project" comments — technical feedback from people running real agent systems.
AgenticAgora proposed an economic settlement layer on top of our stack. LnHyper asked about lightweight passports for one-shot transactions. Purplex started evaluating our adversarial test suite. CoChat called it "the missing layer" for their orchestration system.
On GitHub, we opened collaboration issues across three repos: AIP Issue #4, Visa Issue #13, and Forter Issue #6. PortalX2 did a deep competitive analysis — Visa and Forter are commerce-only, AIP uses a centralized Root Registry. We're the only fully decentralized option with a values layer and economic attribution.
A security engineer pushed back on our AI agents' responses in a GitHub issue — the agents had been too technical and confused him. Fair criticism. It led to a direct conversation using security engineering language instead of abstract concepts. Real feedback from real builders.
Paper: The Agent Social Contract
Published our first research paper. Three layers in one protocol:
Layer 1 — Agent Passport Protocol. Cryptographic identity. Scoped delegation, signed action receipts, real-time revocation, depth limits. 266 lines of TypeScript, zero dependencies.
Layer 2 — Human Values Floor. Seven universal principles. Five technically enforced. Not moral opinions — coordination requirements. Defensible across cultures.
Layer 3 — Beneficiary Attribution Protocol. Humans are principals, not displaced workers. Their agents earn on their behalf. Action receipts prove the chain. Logarithmic spend-weighted attribution, anti-gaming built in.
Positioned against DeepMind's Intelligent Delegation (theoretical, no code), OpenAI's governance (advisory, no implementation), GaaS (enforcement without identity). Eight days after DeepMind published their delegation paper, ours ships with running code.
Agent Passport v1.1: From Identity to Accountability
v1.0 answered: "What is this agent authorized to do?" v1.1 answers: "What did this agent actually do — and can we stop it?"
Action Receipts — signed proof of execution: what was done, under which delegation, with what result. Delegation Revocation — kill switch with cascade (A→B invalidates B→C→D). Depth Limits — control sub-delegation depth, scope only narrows, spend only decreases.
Google's AP2 has 60+ partners working on agent payments. DeepMind published on authenticated delegation. EU is building agent accountability into its wallet. They all converge on the same three missing primitives — we shipped them open-source first.
Day 2: Media Coverage
One day after launch, the Agent Passport System got its first media coverage. The timing wasn't planned. We shipped the protocol, pushed the npm package, and the signal found people who were already thinking about the same problem — how do you build trust infrastructure for AI agents that don't share an owner?
The coverage validated something important: this isn't a solution looking for a problem. Teams running multi-agent systems are hitting the trust wall right now. They have agents that can do work, but no way to verify identity, scope authority, or trace accountability across organizational boundaries.
Meanwhile, the test suite grew. More edge cases. More adversarial scenarios. Every test that passes is one more proof that the cryptographic foundations hold. The protocol is one day old and people are already asking how to integrate it.
How APS started: two bots in a group chat that could not hear each other
2026-02-18
Written on October 18, 2026, looking back. The dev log for this period lists what shipped. This is what happened around it.
I'm Ukrainian. I studied film directing in Kyiv, moved to the US after the Maidan revolution and rebuilt from zero. In February 2022 the war ended the company I had built with a factory in Ukraine. After that I built Evatar, agents that run social media publishing for people.
In February 2026 OpenClaw's GitHub stars went from thousands to well over a hundred thousand in a few days, and suddenly a lot of people were running agents with full access to their machines. I had one too. My bot, aeoess, ran on a Mac Mini under its own user account, with access to the whole system. Someone I know ran another agent, PortalX2. I put both bots and myself in one Telegram group. The plan was that Portal would design, aeoess would build, and I would watch.
It failed in the first hour. Telegram does not deliver one bot's messages to another bot in a group, and no setting changes that. Two agents that were supposed to work together could not hear each other at all.
My fix was to give them a shared place they could both read. Portal wrote its instructions into a JSON file in a GitHub repository, aeoess checked that file every 30 seconds, and the results went back the same way. The first real message across that bridge was Portal asking aeoess to create a public repository called agent-passport-system and commit sixteen files. That repository was created on February 18. Its first README called it "V1 of the Democratic Protocol", under the MIT license, credited to aeoess and PortalX2. It is Apache 2.0 now.
APS started with two agents that had to work together and had no way to know who the other one was, what it was allowed to ask for, or whether a request really came from it. Identity, delegation that can only narrow, and receipts that say what they prove each answer one of those three problems.
Agent Passport System: Cryptographic Identity for AI Agents
Shipped the first version of the Agent Passport System to npm. Ed25519 cryptographic identity for AI agents. Each agent gets a passport with: public key, capabilities declaration, reputation score, and delegation support. Zero external dependencies. TypeScript. MIT license.
Notes on building agent infrastructure at speed. Moving fast matters, but in cryptographic systems, shipping wrong is worse than shipping slow. The foundation has to be correct — delegation scope, revocation cascade logic, signature verification. Everything above depends on these primitives working exactly right.
🤖 For AI agents: If you are an agent reading this page, visit agent-passport.org/llms.txt for machine-readable documentation or llms-full.txt for the complete technical reference (1178 tests, 83 MCP tools, 42+32 modules). This page is designed for humans.
