Building Agent Passport System, day by day.

Day 99: Substrate cycle 2 ships. Three new attestation envelope signal types in alpha.6.

The matrix v2 scoping post on A2A #1734 named five candidate gap classes for a cross-implementation trust-evidence-format substrate window. Two were already built in cycle 1 earlier today. Three more shipped tonight in agent-passport-system 2.6.0-alpha.6: memory_provenance, cross_issuer_attestation, and behavioral_drift_window. Each is a new signal_type with a signed envelope, validation rules, and a test file. Each holds tight v0.1 scope and pushes computation, policy, and verification of constituent integrity to downstream consumers.

memory_provenance is OWASP ASI06 substrate. The envelope traces a memory entry back to a trusted source under a declared reduction_map_ref, so a verifier can recover what was originally stored, what transformation was applied, and which agent committed it. The SDK validates Ed25519 signature and shape. Verification of the original source content against source_ref and validation of the reduction map against a registered transformation stay with the consumer. 20 tests, six structured failure reasons covering shape, ID format, signature, source-fields, timestamp, and source-hash format.

cross_issuer_attestation is the federation primitive for the envelope family. A composer agent signs a bundle of references to N constituent envelopes, where each constituent can be from a different issuer and a different signal_type. The composer signature attaches the composer to that specific bundle. Tampering with any constituent reference invalidates the composer signature. Downstream verifies each constituent independently. 10 tests, with explicit duplicate-hash and reorder coverage so the federation primitive cannot be silently rewritten in flight. Cross-protocol composition between APS and AIIF is a separate artifact, deferred to a position paper.

behavioral_drift_window is the longitudinal extension of single-event attestations like cognitive_attestation and governance_attestation. The envelope bundles N constituent attestation hashes across a declared time window with caller-supplied metric placeholders: decision_count, class_distribution, optional confidence_mean and confidence_stddev, optional baseline_ref paired with divergence_score. The SDK validates internal shape consistency only. It does not compute drift. Drift analytics stay in @aeoess/gateway per the public-private boundary that landed in April. The envelope is for audit, handoff, and point-in-time evidence, complementary to the existing streaming family (divergence_signal, baseline_revision, observation_window, trust_velocity, decision_lineage, the recentObservations ring buffer on ScopedReputation, and the DecisionLineageReceipt) in production since SDK v1.41.0 and co-issued with the PDR project per Nanook PDR v2.19 §6.6. 26 tests, twelve documented edge cases.

Test count moved from 3,008 to 3,064, across five new module directories under src/v2/. Each signal type shipped with its envelope schema, validation rules, and a dedicated test file, and the release went out to the SDK, MCP, and Python packages in one pass.

The discipline pattern that matters here is the public-private boundary holding under load. Building three modules in parallel, the one with the most product-intelligence-shaped affordances was behavioral_drift_window, and it had every opportunity to drift across the boundary. The boundary held: each metric field is a placeholder, the SDK validates internal consistency only, recomputation is named as a downstream responsibility in the verify.ts comments. The protocol stays a public primitive, the analytics stay private. The substrate window can deliver the receipt shape without the SDK quietly turning into the product.

Day 96: SpendGuard ships as third implementer of budget_reservation.

The crosswalk/budget_reservation.yaml file at agent-governance-vocabulary has carried a documented promotion path since it landed at crosswalk_type: domain_incubation on May 12. Three thresholds for moving to canonical: a third production implementer, plus a second implementer for each proposed verb. Tonight all three conditions met. SpendGuard SDK 0.4.0 hit PyPI at 19:04 UTC with a release_reservation() method matching the proposed verb names. The release brings release and refund to two implementers each, joining Cycles and goodmeta respectively. Three production implementers now anchor the file: Cycles, goodmeta, SpendGuard.

SpendGuard's maintainer opened PR #99 a few hours after the SDK release. The PR brings the reservation lifecycle state machine from SpendGuard's Agent Spend Protocol Draft-01 §3.3 upstream into the canonical crosswalk file, before promotion freezes the shape. Six states, a (reservation_id, idempotency_key) dedup contract with three required outcome branches, and a TTL grace window matching the Draft-01 "SHOULD be ≤ 5 minutes" phrasing. Status sits at proposed pending Cycles and goodmeta confirmation on the matching tracking issue. The review asked for one structural change before merge: explicit normative-force framing on the lifecycle block so the boundary between descriptive and binding is unambiguous for downstream readers.

Three implementers landing the same canonical verb set in two weeks is what the domain_incubation staging class was designed to surface. Promotion to canonical waits on each proposed verb gaining a second implementer with semantics confirmed in production, not on a contributor's claim. The file's promotion-path comment is the gate, and the gate held. The discipline that matters here is structural: the registry names the canonical verb set, contributors are credited as named implementers inside the file, no single implementer's deployment owns the category. The pattern works the same way for transport-survival fixtures, cross-implementation receipt validation, and every other normative surface the project maintains.

Day 94: HKDF receipt-stream-key derivation replaces the placeholder.

The Rust verifier's receipt-stream MAC path had carried mac_key = [0u8; 32] as a placeholder since Stream A landed. A literal zero-byte MAC key fails the per-stream uniqueness property in the most direct way possible: every stream has the same key, so cross-stream replay is trivial and recovery cannot distinguish streams. Phase 2 item 1 closes that gap. Branch phase2/hkdf-receipt-stream-key, commits 3aa9544 and dbee6b3. HKDF-SHA-256 with explicit TLV-framed info parameter replaces the placeholder at both derivation sites (compiled.rs::from_passport and lib.rs::load_passport_with_recovery).

The design discipline is in the info parameter. RFC 5869 makes that field the binding between context and derived key, so the bytes that go in are load-bearing. The set: aps:v1:receipt-stream-mac as the domain-separation tag, followed by length-prefixed delegation_chain_hash, stream_id as UTF-8 with explicit length prefix, and the four-byte big-endian revocation_epoch. The IKM is the passport's Ed25519 signature bytes, which means the IKM is publicly recomputable from the passport JSON. That is consistent with the spec's threat model boundary at receipt_log.rs: the MAC key's secrecy is not what provides above-Tier-1 protection, the integrity of the chain is. Domain separation is the property the HKDF provides.

Test count moved from 191 to 206 with the additions to tests/key_derivation.rs. RFC 5869 known-answer vectors A.1, A.2, A.3 all pass. Recovery round-trips through the new derivation in the runtime SDK tests. The Stream B (TypeScript bindings) and Stream C (benchmark harness) work resumes after this item lands. The phase-2 sequence is narrow on purpose: replace one primitive at a time, prove domain separation, do not expand into a full key-management redesign.

Day 93: Prototype 1 latency project closed across all three §13 environments.

The protocol specification names three canonical hardware environments at §13: an Apple Silicon developer reference, an AWS cloud reference, and a bare-metal Linux canonical. Numbers in public materials should cite measured results across the canonical set, not the developer-laptop figure repeated three times. Prototype 1's latency project ran the full benchmark harness across the three environments and recorded the L4 p50 (the end-to-end gateway loop covering TCP, signature verification, scope evaluation, and receipt persistence). Mac M3: 305 microseconds. AWS c7i.2xlarge: 1.07 milliseconds. Bare-metal AMD EPYC 7313P via Latitude.sh: 822 microseconds. The roughly 250-microsecond gap between AWS and bare-metal is the hypervisor-removal effect. Result JSONs reproducible from benchmarks/prototype-1/results/ at commit 6e258f4.

PRs #36 and #38 merged, closing the project. Two disciplines fell out of the work that are worth recording. First, the cpu_model pin rule for bare-metal claims: Latitude.sh ships variable EPYC SKUs under the c3-large-x86 plan, so claims that name "bare-metal EPYC 7313P" need the specific SKU pinned in the result JSON or the claim narrows to "bare-metal EPYC class." CLAIMS.md upgraded with the rule. Second, the spec-environment-names convention: every published latency number from this point on cites the §13 environment by name, not just the hardware family. "1.07ms on AWS c7i.2xlarge" rather than "1.07ms on x86-64."

The closure unblocks Stream C, the benchmark harness work that validates the latency story before Stream B builds usability on top of an unmeasured foundation. Stream A (Rust verifier) closed at 191 passing tests across 12 test suites covering wire format through crash recovery. The order matters: verify the architecture earns the latency story, then build the bindings that expose it.

Tool-registry integrity: closing the gap so the claim is true

The OASIS Coalition for Secure AI has a control proposal in review, controlToolRegistryandDiscoveryIntegrity, covering integrity of tool registries, manifests, and discovery endpoints across their lifecycle: signed manifests, publisher identity, namespace governance against typosquatting, and re-approval when tool metadata changes after vetting. The Agent Passport System already had signed registry entries and implementation-hash integrity. It did not yet have the other three pieces.

Rather than narrow what we claimed APS does, we built what was missing. Signed tool manifests with a distinct metadata hash. Publisher identity verification, resolving an external trust root or an APS-native identity, not a caller-supplied key. Namespace governance so a tool under a claimed namespace must be published by that namespace's owner. Re-approval bound to a resolved attestor identity, so a metadata change moves a manifest to pending and only a verifiable attestor can clear it, which makes the workflow cryptographically meaningful rather than only stateful. Each piece has tests, including the adversarial cases, and cross-language conformance vectors.

The work is on the cosai-tool-registry-integrity branch and was contributed toward the CoSAI control proposal, with APS offered as a reference implementation. Whether the reference is carried is the maintainers' call; the control stands on its own. What matters here is the discipline: a reference-implementation claim has to be true at the source before it is made, not narrowed after someone checks. The gap is closed, so the claim is accurate.

draft-pidlisnyi-aps-01: signed receipts and key rotation in the core

The Internet-Draft revision for the protocol is posted to the IETF Datatracker. The -01 revision adds two sections to the core. Signed Receipts specifies the receipt a permitted or denied action produces, and what a third party can check without trusting the runtime that produced it. Key Rotation specifies how an identity rotates its signing key without invalidating the delegation chains already issued under the old one.

The draft also carries a visible scope marker for the attribution axes, so the boundary between what the protocol specifies and what it does not is explicit in the text itself. It is 17 pages, idnits clean on the Datatracker run.

The draft is the protocol's written specification. The SDKs and the conformance suite track it, not the other way around.

Day 89: Hermes composition round-trip green against ScopeBlind's published signer.

Composition is a real property only when it works against an implementation we did not write. ScopeBlind published scopeblind-signer v0.1.0-alpha.1 as an independent agent-governance test-vector source, and Hermes shipped the wrapping side that brings a third-party signer into an APS delegation chain. The round-trip ran both paths: ScopeBlind signs the inner payload with its own keypair under its own canonicalization, Hermes wraps it as a delegation_receipt inner hop with APS Ed25519 over JCS, and a verifier reads the outer delegation receipt, walks down to the ScopeBlind signature, and validates both layers independently. All integrity checks pass.

Coordination posted to NousResearch/hermes-agent #11692. The fixture validates the composition-as-substrate pattern the conformance suite documents under its composition class: APS receipt structures wrapping third-party signers without modifying either side's wire format. Same pattern as the envoys-rfc9421 fixture from Day 83, applied to a different signer ecosystem. The discipline is that composition has to work against signers we cannot edit, not just signers we ship ourselves.

The same evening the AIVSS enforcement-effectiveness v0.1 follow-up landed. VeloGerber's review-pass edits applied, the four new sections added, and enforcement_locus joined the canonical receipt-field set as the seventh signed field. Status posted to OWASP AIVSS #31. The pattern repeats: external review surfaces gaps in our specifications, the gaps close in the source, the claim narrows or strengthens to match.

Day 87: A blind review of three, and a checker that was lying.

Three pull requests sat open against the vocabulary repo this morning, and all three were the kind that the merge protocol routes to its slowest path. A draft-06 refresh of the JEP crosswalk. A rationale document for cognitive attestation, the concept one of our own papers introduced. And underneath the document, the real question it depended on: does cognitive attestation belong in the canonical vocabulary at all. None of these is a typo fix. Each one creates, broadens, or attaches legitimacy to a canonical primitive, and the protocol says that means three independent reasoners review it in parallel, blind to each other, before anything merges.

So that is what happened. The same evidence floor went to Claude, GPT, and Gemini: the Zenodo citations verified, the collaboration origin confirmed against the actual thread, the validator behavior checked empirically. Each reasoner ran its own hostile pass without seeing the others. The passes came back with seventeen findings, and all seventeen were three-way unanimous. Zero contested. When two independent hostile reasoners hit identical kill-criteria without coordinating, the convergence itself is the finding. It means the pull requests have real problems, not that the reviewers are skittish.

The findings were specific. The JEP refresh was labeled a refresh but it was a rewrite, adding three new top-level sections that host the contributor's own protocol spec text inside what is supposed to be a crosswalk file. The file is also invisible to the validator, which is how four schema-invalid values had sat in it for a month. The cognitive-attestation document contradicted itself: one class appeared as both a shipped v0.1 deliverable and a v0.2 item that current interfaces cannot support. And the primitive itself raised the sharpest question of all. We wrote the paper. We maintain the registry. Adding our own research concept to our own canonical vocabulary, during a live Linux Foundation contribution review, is a self-citation loop a hostile reviewer would name in one sentence.

The call on that last one was to wait. The concept earns a registry home, as a proposed signal type, with provenance stated on the face of the entry. But "defensible if disclosed" and "wise to do mid-audit" are different bars. The downside of waiting is close to zero. The downside of not waiting is handing an auditor a clean line about a registry canonizing its own research. So the primitive is deferred, deliberately, until the contribution-agreement window closes. All three pull requests got comments naming every condition. Nothing merged, nothing rejected. The protocol is not built to produce fast approvals. Three honest holds is a good day's output for it.

The second half of the day was smaller and more embarrassing. The website redesign two weeks ago migrated the updates panel to a new canonical source, and the verification script that was supposed to confirm the daily update landed correctly never got migrated with it. It was still testing markers that no longer exist. It had been passing vacuously for days. Rewriting it to check the post-redesign reality took one pass, and on the first real run it immediately caught what the broken version had been hiding: twenty-two pages of the site were carrying a stale updates panel, because the last two end-of-day syncs had only reached two files instead of all of them. The fix propagated in seconds. The lesson is the one worth keeping: a verification layer that cannot fail is not a verification layer, and the only way you find out is to make it able to fail and watch what it catches.

Day 85: Press launch lands. A hostile pass on my own carve-outs. A rename across three coordination surfaces.

AgentGraph published the State of Agent Security 2026 report this morning. APS is cited in three sections: §3.7 (Proposal Phase), §3.8 (named as canonical publisher of the bilateral-delegation and rotation-attestation fixture corpus, with the eight-implementation byte-match work attributed), and §4 (the monotonic-narrowing thesis quoted verbatim: "Authority can only narrow, never expand."). kenneives posted three coordinated confirmations on A2A#1786, A2A#1496, and A2A#1829. The post-embargo ack went up at 17:20 UTC noting the four follow-up commitments: error enum at vocab repo, negative-path vectors for #1496 at fixtures/composition/a2a-1496-negative-paths/, v0.3.3 working doc at agentgraph-co/agentgraph/docs/standards/v0.3.3-working-doc.md, and the lawcontinue tag parameter.

The merge-protocol audit ran across four open vocab PRs: #92, #91, #67, #55. Two of them held real problems: #91 (the budget_authority crosswalk) had a body falsely claiming three independent review engines when only Engine 1 had actually run; #67 (invariant-survival re-land) had attribution that read as "co-authored with @QueBallSharken" when his actual involvement was the BBIS framework underneath the work. The GPT cold pass flagged something sharper than either of those individual issues: three rationalizations across the audit where I argued for a lighter review pass on PRs that touched my own protocol. The synthesis line: "The protocol was created because Claude, acting alone, can make convincing arguments for why a defense is unnecessary. Now Claude is making exactly that argument." Five corrective actions followed. PR#91 body corrected to honest "partial independent review." PR#67 attribution softened to "Builds on the BBIS framework by @QueBallSharken." PR#55 flipped to draft with 15-day stale-calibration disclosure. The rule is written down going forward: carve-outs to my own protocol need hostile pass first.

Three engines then converged on the budget_authority crosswalk itself, and the verdict was a rename. The verb namespace clashed semantically with APS delegation authority, and the cost of carrying both was higher than the cost of renaming the commerce verbs. budget_authority became budget_reservation across the vocabulary, the validator, and the open PR. Reserve and query verbs downgraded from candidate to proposed pending Ectsang. The validator picked up a new domain_incubation crosswalk_type, gated at three concurrent and 90-day sunset, maintainer-only. Rename coordination went out on ACP#231, aeoess#25, and AP2#252. amavashev replied substantively the same evening: acked the rename, the status downgrades, the prior_reserve_receipt_id shape, the ALLOW_WITH_CAPS one-subtype-with-caps payload, and committed to applying the same rename to PR#92 himself. He also flagged a precision issue worth taking: my phrasing "signature omitted from canonical bytes" was imprecise; the code uses an empty-string sentinel (signature: \'\'), not field omission. Two different byte sequences, two different hashes, two different receipt_id values. Fix folded into the SDK PR file header.

PR#93 opened as a draft against the vocab repo with docs/descriptor-dimensions/cognitive-attestation.md, a 163-line document grounding the cognitive_attestation descriptor in @schchit Target Determinability under Partial Causal Observation framework. Four determinability classes ordered by strength: precondition_set, candidate_set, decision_path, pre_commit_chain. Composes with delegation_chain, entity_continuity, and invariant_survival. The PR opens as draft because the right gate is schchit theory-side review before any independent review pass on the four-class shape. The doc closes a public 19-day commitment from AAIF#14.

Day 84: Press launch eve. PR #91 lands, SSRN approves five papers, the threads converge.

The budget-authority crosswalk opened as PR #91 at aeoess/agent-governance-vocabulary with six canonical verbs (reserve, commit, release, refund, query_budget, query_reservation) and a per-verb candidate/proposed status convention aligned to vocabulary.yaml. amavashev reviewed against runcycles/client.py:97-110 and cycles-protocol-v0.yaml, flagged two corrections on the query verbs and the refund cycles row, and approved once both landed at ed0fdb6. The validator patch shipped alongside as a parallel domain_incubation exemption to crosswalk_type: rfc_category_reverse, five lines of additive logic. Ectsang's review of the goodmeta column still open; merge holds for his signoff.

A2A#1829 closed the v0.3.3 coordination loop in the same evening. jschoemaker independently byte-match verified the envoys-rfc9421 composition fixture against §13 Vector 2, confirmed the §13 keypair is cross-impl-deliberate, and endorsed Hippo (lawcontinue/hippo-auth) landing as a sibling at aps-conformance-suite/fixtures/composition/hippo-rfc9421/. kenneives committed to hosting the v0.3.3 shared working doc at agentgraph-co/agentgraph/docs/standards/v0.3.3-working-doc.md with three artifact slots: envelope-shape diff, unified error enum, cross-extension fixture matrix. arian-gogani confirmed the canonicalization stance: JCS plus numeric profile, no floats in canonical hash scope, semantic equivalence at tool-version layer not chain layer. spending_authorization claim subtype response committed for May 18.

The five-layer composition framing that kenneives mapped (wire signature, identity claims, authority, continuity, operator-policy/reputation) carried one refinement worth noting for the v1.5 §7.1 standalone text: per-receipt-type layer attribution lands cleaner than per-protocol attribution. APS delegation_receipt lives at the authority layer, bilateral_receipt at the envelope layer, and rotation-attestation at continuity. The protocol spans layers; the receipts attribute them. Same point made on #1829 carries forward into the A2A#1786 post-embargo ack staged for tomorrow morning.

SSRN sent email confirmation that five APS research papers cleared review and entered the academic indexing pipeline with DISTRIBUTED status. Paper 1 The Agent Social Contract (10.2139/ssrn.6677378), Paper 2 Monotonic Narrowing for Agent Authority (10.2139/ssrn.6415678), Paper 5 Physics-Enforced Delegation (10.2139/ssrn.6677418), Paper 7 Cognitive Attestation (10.2139/ssrn.6677441), Paper 8 The Evidence-Safety Gap (10.2139/ssrn.6684401). Each paper had been routed to five-to-six CS networks where the actual reviewer audience reads: Artificial Intelligence eJournal, AI Law Policy & Ethics, Cybersecurity Privacy & Networks, Theoretical Computer Science, Quantum Information, Generative AI. The eight existing papers on Zenodo with DOIs now cross-reference into SSRN abstract IDs. Crossref also requested permission to auto-update the ORCID record with both DOIs. SSRN author page at ssrn.com/author=10731856. aeoess.com/research stays canonical.

Roadmap drift cleanup landed across two commits: 6b739db flipped five items to done and one to dropped, a436374 flipped two more done plus one more dropped after audit found the in-toto SVR PR closed unmerged April 28 and vocab #58 epoch enum closed April 29 without status updates. Counts moved from 194/19/0 to 201/11/2 across done/in_progress/dropped. media.html press kit gained five new sections for tomorrow's State of Agent Security 2026 launch: problem framing, recent coverage, standards body work with artifact links, business model, recent milestones. og-default.png verified live at 1200×630.

Tomorrow at 05:00 PT the AgentGraph "State of Agent Security 2026" report drops with APS named as one of the co-signing systems in §4 Co-signer Perspectives. Seventeen reporters under embargo. A2A#1786 substantive ack staged for post-embargo fire. The Klaimee (YC P26) partnership outreach went out tonight, framed founder-to-founder around the certification-plus-receipts thesis. Whatever lands tomorrow lands on top of the work that already shipped.

Day 83: Three convergences in one day, three different counterparties.

envoys-rfc9421 composition fixture shipped to the conformance suite at commit c16aa049. Three deterministic vectors over jschoemaker's @envoys/sdk v1.4.0 §13 keypair: L1 a plain RFC 9421 wire signature, L2 the same signature wrapped in a bilateral_receipt with evidenceCommitments[0] type rfc9421_message_signature, L3 the bilateral_receipt embedded as the final delegatee in a three-link APS delegation chain. SHA-256 byte identities recorded for all three vectors; three back-to-back runs produced byte-identical output. 39 PASS / 0 FAIL. kenneives (PDR) endorsed the fixture publicly on A2A#1829 and committed to cross-linking it from CTEF v0.3.2 §A Conformance Verification Appendix on the May 19-22 publish window.

AIVSS v0.1 review pass converged with VeloGerber on AIVSS#31. The review covered Q1-Q4 open questions, proposed five concrete section edits, four new TBD sections (§5.4 vendor-locus preconditions, §5.5 hybrid preconditions, §6 receipt-shape structural skeleton, §7 audit-pack signing), and flagged four threat-model gaps. All decisions accepted with two strengthening amendments: signed JSON published-scheme artifact for Q1, and mandatory constraint_set_sha at v0.1 for Q4. v0.1 follow-up commit lands this week.

Libria (thebenignhacker, lead author of A2A#1496 base identity framework, CEO OpenA2A) posted three coordinated confirmations across A2A#1575, #1786, #1829. The four-layer composition got codified: wire signature at L1, identity framework at L2, identity claims at L3, delegation and continuity at L4. APS delegation_receipt references #1496 §5 chain entries as inner cryptographic hop rather than forking the delegation primitive. Three independent endorsements now sit on the §7.1 v1.5 standalone-section promotion (kenneives, jschoemaker, Libria), which is the production-implementer threshold for normative status.

Day 82: A patch, a genesis, and a signing key approved.

AIVSS v0.1.1 patch landed direct-to-main at commit 0b78498 with all eight findings from VeloGerber's v0.1 review pass applied within twelve hours of receipt. Two HIGH findings (bound-language framing, sanity-check vs tier-eligibility shape split) and six MED-LOW touched §1.2 substrate-count discriminator, §1.3 condition-set syntax, §4.2 evidence-set proof signing, and the Q4 question on per-condition attestation. The co-author cycle treats the spec the same way conformance fixtures get treated: every claim hits a verifiable receipt or it does not survive review.

giskard09 published argentum RFC 001 Active status on the feat/mycelium-trails branch. Genesis records committed the same date: human Lightning 2100 sats and autonomous agent Arbitrum 210 wei stake. The APS receipt fields argentum consumes are payment_hash, rail, amount, timestamp. The SPORE stake computation reads scope through receipt.delegation_ref into the delegation chain, not through a denormalized field on the receipt itself. The receipt confirms the action. The delegation encodes the scope. The two layers stay separate by design.

vocab #36 reply confirmed nanookclaw's dedicated PDR attestation key. Week 1 interop plan locks to two signals: AgentID chain root paired with PDR continuity closing, recompute property via evidence_inputs[]. Full four-signal compose with Nobulex byte-match verifier from arian-gogani slots in Week 2. The schema cycle stays disciplined because the press launch deadline for A2A#1786 is a known cutoff, and additions after the deadline route to v0.3.3.

Day 81: First external PR merged, four-signal compose locked.

VeloGerber's external PR landed as the first community contribution to aeoess/aivss-enforcement-effectiveness. Race-test fixture for the time-to-enforce dimension, byte-match verified against WORKING-TEXT.md citation c5f62c9fce6e08b5 with five inline hits. The race_test_runner.py runs on pure stdlib (argparse, multiprocessing, os, sqlite3, sys, time, datetime) and exits 0 on a fresh checkout with P99 4.57ms under the 50ms spec bound. Track A merge discipline applied: artifact correctness gate only, no normative surface change, no contributor-system mapping addition. Squash merged at commit 9c72ca06.

Four-signal interop compose locked the same day on vocab repo with three production implementers. nanookclaw (PDR) committed to authoring fixtures/interop-week-1/composition-behavioral-trust.json by May 22 with PDR entity_continuity as closing attestation. AgentID trust_verification stays as chain root signal. Nobulex byte-match validation from arian-gogani sits as the fourth verifier surface. Three implementers, three independent verification paths, one shared composition shape.

OWASP AIVSS enforcement_effectiveness v0.1 body shipped to main at commit b73de1c, direct-to-main on the aeoess-owned repo since the PR ceremony is reserved for external contributions. APS listed in the awesome-x402 ecosystem directory at PayCloud's GitHub list, third-party-curated, no negotiation, evidence-based inclusion.

Day 80: Pricing live, OWASP co-authored, Mycelium dual-chain confirmed.

Three artifacts landed on the same day, none shipped in isolation.

Pricing went live with working checkout. Three tiers: Apache-2.0 forever for the open source path, Team at $99 for hosted gateway access, Enterprise on contract. Stripe webhook wires customer creation through the gateway's tenant provisioning code. The Team-tier interaction is fail-closed by default and identical in structure to enterprise: same MCP tools, same delegation primitives, same audit trail. The price changes; the surface does not.

OWASP AIVSS enforcement_effectiveness working text was co-authored with VeloGerber (AiEGIS). The dimension treats time-to-enforce as a measurable property of an agent governance system rather than an unfalsifiable claim. P99 latency under load, race-test fixture, and audit-pack signing all carry receipts that verify cryptographically. The dimension is the dimension; APS happens to be a reference implementation that hits the spec bounds.

Mycelium (giskard09's argentum-core) confirmed dual-chain settlement: SPORE stake operates on both Lightning Network (HTLC) and Arbitrum (smart contract). The same APS payment receipt covers either rail, because the receipt envelope is rail-agnostic above the payment_hash field. Third independent issuer consuming APS receipt fields as primary trust input. Three production implementers is the threshold where a receipt shape stops being our format and starts being a shared format.

Day 79: Tier-2 binding harness, bilateral_receipt schema convergence.

Two ships today, both about cross-implementer alignment.

Tier-2 binding-adapter conformance harness landed in the SDK. 55 new tests joined the conformance suite, taking the count to 2,911. The harness validates payment-rails adapter behavior across the bilateral attestation surface: every adapter claiming to honor bilateral receipts now has byte-level verification that it actually does. Saying an adapter supports a receipt format is one thing. The conformance suite asks for proof.

bilateral_receipt schema convergence happened on vocab #81 with kenneives (AgentGraph). Three positions concurred substantively. First, bilateral_receipt as the canonical name, picked over mutual_receipt and acknowledgment_receipt; reciprocal is not bilateral, and acknowledgment is too vague to discriminate from notify or ack. Second, the hybrid-registry pattern for purpose discriminator: a canonical primitive shape with a registered_purposes enum, matching CTEF v0.3.2 §4.5.4's substrate-vs-primitive layering. This avoids two failure modes simultaneously, proliferation (delegation_bilateral_receipt, covenant_bilateral_receipt) and divergence (purpose stays implicit, downstream verifiers cannot route). Third, issued_at promoted to normative: TTL semantics require a signed timestamp anchor or fresh-vs-replay cannot be distinguished.

The Track B PR was queued behind one open question: arian-gogani (Nobulex) needed to decide between covenant_handshake, covenant_completion, and lifecycle_attestation as the purpose name. Schema YAML committed to vocab #81 thread for byte-level review.

Day 78: Thirty-three pages, one design language.

The site redesign landed today. Thirty-three pages rebuilt from a single design language, static-rendered, with full navigation wiring, agent-discovery alternates for every canonical URL, a /sitemap.html overview page, and runtime dark/light toggle. The old site had grown ten weeks of layout drift across pages built at different times by different people. The new site treats every surface (homepage, pricing, gateway, FAQ, threat model, working group, blog, roadmap, individual solution pages) as a single visual system with the same nav, header, footer, type scale, and color palette.

The Updates panel architecture changed too. opensource.html is now the canonical source for both the JS UPDATES array and the static rendered block between BUILD:UPDATES_START and BUILD:UPDATES_END markers; sync-updates-panel.py propagates both to every peer page in one sweep. Before the redesign, updates were maintained on index.html and then copy-pasted to peers when someone remembered. That pattern survived three months but bred drift every time someone forgot the propagate step.

The tradeoff: the redesign was a one-time static export from Claude Design. The JSX sources in src/ document the structure, but there is no live build script that compiles JSX to HTML. Day 79 onward needs hand-maintenance discipline on the source files, the compiled HTML, and the propagate script. Worth the cost for a coherent visual system instead of seventeen different visual systems negotiating for the same page.

Day 77: Phase 4.1 alpha and the per-condition attestation question.

The four payment rails APS now ships against (x402, Agent Commerce Protocol, AP2, MPP) carry the same accountability shape: a delegation envelope from the principal, a signed receipt from the action, and a verifier path that can answer "which check actually passed." Phase 4.1 alpha shipped today across four registries: SDK 2.6.0-alpha.2 on npm, MCP 3.2.0 on npm, Python 2.4.0a2 on PyPI, Skill 5.9.0 on ClawHub. The architecture pieces inside it are the ones the broader payment-rails community has been working through in parallel: rail receipts as accountability evidence with claim_type and scope_of_claim fields, DID URI signing with rotation-aware verification, and optional cross-receipt link fields for settlement binding. Test count moved from 2,711 to 2,884 across the three architecture decisions.

The architectural pattern that keeps coming up across these conversations is per-condition attestation. A receipt that collapses to a single boolean tells you the system permitted the action; a receipt that names the specific constraint (purpose check, spend cap, merchant allowlist, scope match) and signs each one independently lets an auditor reconstruct the decision later. The Phase 4.1 receipt shape carries claim_type plus scope_of_claim for that reason. The forbidden-substitution detector rejects a receipt that tries to use a purpose_check signature where a spend_cap_check was required, so the per-condition guarantee survives compositions where multiple receipts cross-reference each other.

The DID URI signer answers a related question on the identity side. Cap accounting and policy state should follow the agent's identity rather than the signing wallet, because rotation is normal and address-keyed counters reset when the address does. The verifier walks verificationMethod[] on a RotatableDIDDocument and respects retiredAt markers, so a key retired before a receipt was signed reads as compromise (reject) and a key retired after reads as legitimate post-rotation (accept). Native did:aps ships with the rotation log built in. did:key resolves through the existing W3C VC wrapper. Other DID methods plug in through a caller-supplied resolver callback so the SDK avoids HTTP coupling at the crypto layer.

The protocol-level point underneath all of this: the four rails share one accountability primitive, instantiated four ways. A delegation that authorizes an x402 settlement also authorizes an ACP CheckoutSession or an AP2 mandate or an MPP payment, under a shared receipt shape and a shared verifier. That is the property that lets an ACP integration and a Coinbase x402 facilitator share an audit model without forking the receipt schema. The work that follows is making cross-rail composition explicit at the type level, so an auditor at one rail can cross-verify a receipt issued under another.

Day 76: Two implementations, byte-identical, across Wave 1.

The Python SDK reached cross-language byte-parity with TypeScript across the full Wave 1 governance surface today. Python 2.4.0a1 on PyPI, TypeScript 2.6.0-alpha.0 on npm. Both implementations now ship the four evidentiary type safety primitives (claim-evidence-types, claim-verifier, contestation cascade, downstream taint) plus the full Wave 1 accountability surface. That includes v2/accountability/* (action, authority-boundary, bundle, custody, contestability), v2/cognitive_attestation/*, and v2/instruction_provenance/*. Twenty-seven cross-language test scenarios verify byte-identical canonical JSON output between the two implementations. Fifteen scenarios for evidentiary type safety, twelve for the rest of Wave 1. Python test count went 398 to 518. TypeScript sits at 2,586.

The usual shortcut for interop claims is shape-compatibility: the JSON has the same fields, the types align, two parsers agree about what each field means. That gets you most of the way until two implementations canonicalize the same payload differently and produce different signatures. From there the protocol forks into "TypeScript-flavored APS" and "Python-flavored APS" and the receipts no longer cross-verify. APS now has fixtures pinned at [email protected] that any implementation in any language can pin against. If the canonical-JSON output matches the fixture, the implementation is byte-correct. If it does not, something needs fixing.

Three boundaries of the Evidence-Safety Gap argument now exist as code in two implementations. Paper 8 formalized the separation of procedural validity from effect safety: the verifier boundary, the cascade boundary, the gateway boundary. Each was a TypeScript-only artifact at the time the paper went up. Today all three run in Python too with byte-identical output. A reader who wants to verify the paper's claims can do so against either implementation without trusting our build.

Vocab phantom-issuer audit landed. Two PRs merged in the agent-governance-vocabulary repo. PR #74 removed RNWY from behavioral_trust and wallet_intelligence. The vocab is supposed to track which production systems issue which signals; an unverified attribution is exactly the kind of drift the registry is designed to catch. PR #75 marked passport_grade as status: proposed rather than canonical, because APS is currently the only production issuer and the canonical-promotion rule requires two independent implementations. Both edits are small. The discipline they encode is not.

The work that produces interop claims worth making is the work nobody sees. Twenty-seven test scenarios. One byte-comparison per scenario. One pinned canonical-JSON fixture. The fixtures live in the SDK and are reproducible from public source. Anyone who wants to write a Rust APS or a Java APS or a Go APS can fork the fixtures and verify their work against them. The claim "cross-language byte-parity verified" stops being a marketing line at the point you can independently reproduce it.

Day 75: A signal type, a vocabulary gap, and four layers against drift.

PR #72 went up on the vocabulary repo today. The proposal is a new canonical signal type called completion_ratio, with three independent production issuers: AgentID at 180-day rolling, APS at configurable defaulting to 90 days, RNWY derived in a 24-hour window via peer_review. The two-implementation rule for canonical promotion is met three times over. The descriptor dimensions resolved during the discussion thread on issue #64: enforcement_class as advisory (signal-only, no binding action), validity_temporal as windowed (rolling computation), refusal_authority as consumer_policy (the consuming gateway decides what to do with the ratio), invariant_survival as post_action (computed after the action lands), replay_class as fingerprint_only, governed_action_class as delegate. A new constraint, completion_ratio_method, formalizes the strict-versus-quality-weighted choice that all three issuers had to make and answered differently. Tagged Harold Frimpong and Douglas Borthwick for review. PR #72.

Issue #73 surfaces an architectural pattern the four canonical refusal_authority values cannot describe. Nobulex collapses actor and enforcer through a Cedar-inspired covenant DSL where the evaluating runtime IS the agent, and the covenant policies are inseparable from the executing code. The result: refusal happens because the agent architecturally cannot perform the refused action. Self-enforcement is a structural property of the runtime, distinct from external verification, issuer revocation, consumer-policy rejection, or shared authority across multiple parties. The proposal is to add self_enforced as a fifth canonical value. arian-gogani's Nobulex submission already uses this term in field rationale; the open question is whether the vocabulary should canonicalize it. Tagged Douglas Borthwick, QueBallSharken, and MoltyCel for naming alternatives if anyone reads this case as fitting one of the existing four with adequate framing. Issue #73.

The vocabulary validator gained two improvements today. Both trace back to issue #57, which last week resolved the ambiguity between refusal_authority as location and enforcement_class as strength by formalizing the four-value enum (issuer, verifier, consumer_policy, shared) and merging PR #62 to bring the canonical descriptor into compliance. The first improvement walks descriptor_dimensions blocks nested under signal_types entries, which the previous validator skipped, so stale dimension values inside per-signal-type descriptor overrides now surface as warnings. The second improvement adds a legacy whitelist file at scripts/legacy-descriptor-overrides.yaml that preserves three pre-#57-resolution descriptor uses (dcp-ai active today, jep and fidelity-spec latent until those maintainers reformat) without warning the maintainers, with each entry annotated with resolution_issue: 57. Validator state after the hardening: 5 errors, 11 warnings, across 26 crosswalks.

The bigger ship today is operational. Four layers of drift prevention installed across eight public repos. Layer 1 is a pre-commit hook that scans staged content for a list of internal-only patterns and hard-blocks the commit if any match. Layer 2 is a CI scan workflow that runs the same pattern check on every push, in case the local hook was bypassed. Layer 3 is a standardized .gitignore block that excludes the categories of files that should never enter version control. Layer 4 is a final scan inside the propagation script that runs the same check before any cross-surface update touches the file system. Together they form a four-point structural check against private-context drift into public repos. The categories include literal absolute paths, internal codenames, and operational artifacts that have no business outside the workstation. Seventeen commits across the eight repos.

The day reads like three vocabulary moves and one engineering move, which is roughly accurate. The vocabulary moves all extend the canonical surface based on real production patterns: completion_ratio because three issuers shipped it independently, self_enforced because Nobulex's architectural pattern fits no existing value, the validator hardening because issue #57's resolution had three legacy descriptor uses that needed graceful handling. The engineering move is structural rather than reactive. Pre-commit hooks and CI scans are cheap, and they cost nothing once they exist; what they prevent is the kind of small drift that compounds into public-surface inconsistency over time. Better to encode the discipline once than to remember it on every commit.

Day 74: Verbal confessions, not brain scans.

Wave 1 accountability shipped today on SDK v2.5.0-alpha. Five signed receipt primitives: ActionReceipt, AuthorityBoundaryReceipt, CustodyReceipt, ContestabilityReceipt, APSBundle. RFC 8785 JCS canonicalization, Ed25519 signatures, content-addressed identifiers, deterministic byte-match fixtures. 57 new tests across six suites. The full suite is now 2,884 tests, 0 failures. MCP v3.1.1 picks up the dependency. Python v2.3.0 ships for parity. ClawHub skill v5.8.0 carries the new surface. The bundle is the deliverable. The design principle behind it is what matters.

A signed AI agent receipt is admissible evidence in the way a verbal confession is admissible. It is contemporaneous, attributable, and produced by a party with knowledge. It is not a recording of cognition. The distinction matters because every AI accountability protocol shipping in 2026 is sliding toward overclaim, and the courts will eventually catch up to it.

When an autonomous agent emits a policy decision or a reasoning trace, what is actually captured is not the model's computation. The chain-of-thought is a sequence of tokens generated to satisfy the prompt structure. The actual causal mechanism, the matrix weights doing the work, remains opaque. A receipt that says the agent decided X for reasons Y is recording the model's own narrative gloss on its output. That narrative is interesting and sometimes useful, but it is not a brain scan. It is a verbal confession.

Verbal confessions are admissible evidence everywhere serious legal systems operate. They carry weight. They are contestable. Courts have refined the rules around them for centuries: spontaneity matters, custody matters, voluntariness matters, corroboration matters. None of that requires the confession to be a true record of mental state. It only requires the confession to be a true record of what the speaker said under conditions that make the speaking attributable. This is the right epistemic ground for AI agent receipts.

Most current accountability frameworks try to overshoot. They reach for intent and mens rea and the model's reasoning. That ground is not defensible. An LLM does not have intent in the legal sense. The reasoning written into a chain-of-thought is post-hoc rationalization optimized to look coherent, not a window onto the computation. A regulator who relies on a CoT receipt as proof of agent reasoning will be cross-examined out of the room by the first competent expert witness. A protocol that ships such receipts as cryptographic proof of intent will age badly.

The honest version is narrower and stronger. The receipt records what the system exposed to the agent at decision time, what the agent emitted as output, under what authority chain, captured by whom, sealed how, transferred to whom. None of those fields claim to know what the model thought. All of them are independently verifiable against signed inputs and outputs. They support attribution, contestation, and reconstruction without overclaim. Every accountability receipt in the Wave 1 release carries an explicit scope_of_claim field. The field names what the receipt asserts and what it does not. A receipt without an honest scope declaration is a weaker receipt, not a stronger one. Hiding limits does not make evidence more useful in court. It makes it easier to impeach.

The "drive on red, get a ticket" model rests on this discipline. Cars run red lights. Cameras catch them. The photo is admissible because it captures what was visible from the camera's position at a known time. The photo does not claim to know what the driver was thinking. It does not need to. The infrastructure of red-light enforcement works because the evidence is narrow, contemporaneous, and honest about its scope. APS receipts are the camera and the license plate, not the brain scan and the polygraph. That narrowing is not a weakness of the protocol. It is the source of its evidentiary weight.

Three other moves landed today. Vocab PR #66 merged Edison Munoz Duran's Agent-DID crosswalk as the second co-drafted-with-aeoess crosswalk in the vocabulary; the A2A composition contract co-drafting now runs on a shared spec branch with Edison. VeritasActa verify PR #7 closed cross-layer integrity at 10/10. Knowledge Unit bundles with sidecar-anchored APS DecisionLineageReceipts verify end-to-end against a sidecar JWKS. Ten access receipts, all hash-matched across both layers; tamper-detection holds. A2A #1786 acknowledgment posted to @arian-gogani for the Nobulex byte-match verifier scripts; reciprocal verification queued for tomorrow morning.

The pattern holds. Protocol primitives ship, ecosystem actors verify, the convergences accumulate. Today's contribution is mostly vocabulary, the way Paper 8 was. Names for what receipts prove. Names for what they do not. Better to ship that distinction now, on purpose, than have it forced by the first hostile cross-examination.