Building Agent Passport System, day by day.

Day 73: A paper on what receipts cannot prove.

Paper 8 went to Zenodo today. The Evidence-Safety Gap in Cryptographic Agent Governance. The thesis is the kind of thing the protocol architect should be the first to say out loud. Cryptographic agent governance proves procedural validity. It does not prove effect safety. These are different things. Identity, delegation, policy decision, and execution receipt together establish that an action was procedurally valid under a declared regime. They cannot, by themselves, establish that the action's effect on the world was safe. The omitted-variable framing makes this precise: the procedural validity predicate over (identity, delegation, policy, action, receipt) excludes variables that may determine effect safety.

The paper names compliance-complete failure as the simultaneous condition of procedural validity and unsafe effect. Five omitted-variable classes get formal definitions: semantic state, population state, trust state, pipeline state, temporal state. Each class gets a constructive defeat against receipt-chain forensic signals — explicit traces in an open-source reference implementation showing how a procedurally-valid sequence of receipts can compose into an unsafe effect that no individual receipt is wrong about. The paper's load-bearing claim is narrow: scenarios show construction, not prevalence. The minimal contribution is the formal separation of procedural validity from effect safety in receipt-based agent accountability. Two design implications follow. Claim-scoped receipts — every receipt declares what it proves and what it does not. Authorization-effect separation — the gateway that authorizes an action and the system that observes its effect must be distinct, with neither able to silently become evidence of the other. Neither closes the gap. Both make it visible and auditable.

The reason this paper exists at all is that the protocol's own success creates the failure mode it describes. As receipt chains get richer and more verifiable, downstream consumers start treating receipt validity as a proxy for action safety. That substitution is silent. The receipts are honest. The chain verifies. The action was unsafe. Without explicit vocabulary for the gap, the system that does its job perfectly looks identical to the system that fails to detect what it was never asked to detect. The paper's contribution is mostly vocabulary — names for the failure class, names for the omitted variables, design patterns that surface the gap rather than obscure it.

Three SSRN submissions and an ORCID profile. Agent Social Contract, Physics-Enforced Delegation, and Cognitive Attestation entered SSRN today, each classified into five-to-six CS networks where the actual reviewer audience reads. Quantum Information for the IBM hardware experiment. AI Law, Policy & Ethics for the auditability angle. Cybersecurity, Privacy & Networks for the cryptographic primitives. Theoretical Computer Science for cryptography and distributed computation. Generative AI for the Llama-3.1 sparse autoencoder work. The classifications are not decoration. They route papers into the conversations where the work has reviewers. ORCID profile 0009-0002-4700-3594 went live with all eight papers indexed via DOI. The research output now has a single canonical author identifier, which is what citation graphs and standards-body cross-references actually use to resolve a person.

Three vocab merges, two pings. PR #61 added epoch to validity_temporal as observer-relative ticks on substantive state transitions, distinct from sequence's event-relative counts. PR #62 brought governance_attestation.refusal_authority into formal enum compliance with a one-line correction. PR #52 co-authored with @nanookclaw landed a 309-LOC pure-Node entity_continuity validator with 2884 tests and four reference fixture vectors. Two pings out on the pairwise crosswalk (PR #55, awaiting @tomjwxf distribution analysis) and the invariant-survival doc (PR #51, awaiting @QueBallSharken BBIS-side concurrence). Both have specific questions attached.

In-toto SVR extension Go. The path forward for governance attestation as an in-toto SVR extension is now scoped. Worked-example draft underway. May 1 maintainer meeting on the calendar. The bilateral byte-match track with marcelamelara stays alive in parallel. Two paths forward: upstream contribution and bilateral interop demonstration. Both produce evidence the predicate works against real attestation infrastructure.

Today is the kind of day where the protocol becomes more honest about itself. Eight papers on Zenodo. Three crossing into SSRN. One ORCID profile. One paper that names the gap the others do not close. The cumulative output is not "the protocol works." It is "the protocol does what it does, and these are the named limits, and here is the vocabulary for talking about what cannot be receipt-proven." That distinction is the difference between a protocol that ships and a protocol that gets adopted.

Day 72: A primitive shipped, an outreach opened, two merges.

The Instruction Provenance Receipt module is live on npm. [email protected] ships the canonicalize/envelope/verify trio for binding agent authority to a content-addressed digest of declared instruction files at delegation time. The recurring failure mode in recent AI IDE advisories — agent receives authority under one instruction context, a workspace file (README, .cursor/rules/*, .cursor/mcp.json, .vscode/settings.json) changes mid-session, agent acts under instructions that were never part of the original authority context — has a structural primitive now. OWASP AIVSS describes this class as Goal Manipulation. The IPR module sits at src/v2/instruction-provenance/ in the SDK with 32 conformance tests + 27 adversarial tests passing inside the 2,479-test suite. Demo branch with a byte-parity-checked drift-denial walkthrough is at demo/drift-denial-cursor-cve.

The companion gateway proof-of-concept is public. aeoess/aeoess-gateway-v0-poc is a minimal HTTP service that recomputes the IPR context_root against the same file set at action time and denies if the digest no longer matches the receipt. Three case fixtures (create_pr, read_file, send_payment) demonstrate before/after deny semantics. The structural property is portable: APS is one implementation of the receipt shape, but the pattern works for any agent runtime that wants to bind authority to a file-content digest. A first-contact email went to [email protected] framing the primitive as a structural mitigation for the recent advisory class, with explicit honest-scope language about what IPR does not do (it does not classify files as malicious, it only binds authority to the file state that existed at delegation time).

Two vocab moves and one canonical-term proposal. PR #63 from @piiiico added the trust_verify endpoint to AgentLair's behavioral_trust.endpoints block, a third surface alongside trust_profile and trust_gate that accepts an AAT JWT directly without requiring a resolved agentId path parameter. Endpoint verified live (HTTP 401 with HSTS, CSP, JSON content-type, 112-byte structured error body — production gateway). 5-gate review passed clean. Issue #64 proposed completion_ratio as a new canonical signal type, opening the discussion before converting to a PR per CONTRIBUTING.md. Three independent implementations confirmed in the original A2A #1628 thread (AgentID rolling 180d, APS configurable defaulting to 90d, RNWY derived 24h via peer_review sybil analysis), so the two-implementation rule is met comfortably. The agent-trust-verification-providers spec at the cross-vendor org received a REQUEST_CHANGES review on PR #8 for a structural peer_review/behavioral_trust mapping correction needed in four places.

Day 71: A spec, two merges, and one open question.

A new GitHub org went up for cross-vendor specs. agent-governance-spec hosts agent-trust-verification-providers, the working draft of how trust providers compose against the canonical vocabulary. The org is co-edited with Lars Kroehl of MolTrust / CryptoKRI GmbH after he accepted six conditions on editorial process, license separation (spec is CC-BY-4.0, reference implementations stay independent), and what counts as a schema-shape question versus a schema-fields question. v0.1 SPEC.md is drafted, six tracking issues are open for structural decisions, and the editor line reads "Tymofii Pidlisnyi (APS by AEOESS), Lars Kroehl (MolTrust / CryptoKRI GmbH)." This is the first time a spec lives outside the AEOESS org, which is the right shape: cross-vendor specs should not live inside any single vendor's account.

Two vocab PRs merged with calibrated review. PR #59 from lktron00 added the DCP-AI crosswalk: composite Ed25519 + ML-DSA-65 (FIPS 204) signatures shipped from day one across four reference SDKs, with real production deps (@noble/post-quantum + tweetnacl) and a 72KB interop test vector file. The substance gates passed cleanly. Eight explicit no_mapping entries, each naming the production issuer for the gap they declared, was the kind of scope discipline the repo was built to surface. PR #53 from kevinkaylie landed Step 2 of the Interop Week 1 four-signal compose test: AgentNexus three-issuer fixture with JWS Ed25519 signatures verified end-to-end and prior_signal_digest matching Step 1's compound_digest byte-exact. Two real partners doing real work.

The DCP-AI merge surfaced a question that needed its own thread. Composite post-quantum signatures live as an out-of-vocabulary primitive in lktron00's crosswalk. asqav (jagmarques) ships ML-DSA-65 in production already. Other systems are Ed25519-only. #60 opened the cross-vendor scoping discussion: is post-quantum signature capability a property of the issuer, or of the signal class, and how should the vocabulary express it without overcommitting to particular algorithm choices? Three options framed, ranging from documentation-only to a crosscutting attribute matrix. The four named questions for the WG include one nobody has been asking out loud: should the canonicalization profile be a sibling concern (DCP-AI uses dcp-jcs-v1, asqav uses one JCS variant, APS uses another, and several systems leave it undocumented). No PR, no schema change, no timeline pressure. Reading the room first.

Convergence on the epoch proposal landed cleanly. #58 got three independent confirmations: lawcontinue from a distributed inference setup where a single 50-token generation produces 50 sequence ticks but zero state transitions, kenneives confirming AgentGraph's CTEF v0.3.1 session_epoch maps onto epoch verbatim, and srotzin from HiveTrust adding a substantive-transition lower-bound clause for the PR description. Direction locked, PR follows. Separately, #57's reading (b) on refusal_authority as location versus enforcement_class as strength got endorsed by lowkey-divine, with the 24-hour objection window closing tomorrow.

One thing the day did not ship: a contributor reputation tool. The work happened, the prototype got built and reviewed under multiple adversarial passes, and after the reviews it was clear the artifact would have been a YAML reader with reputation-shaped framing it could not actually defend. Activity heuristics measure the wrong axis. Metadata-grounded scores measure another wrong axis. A real reputation primitive would need observable actions with observable outcomes, calibrated priors, and counterparty-distance weighting on every evidence edge. None of that ships in a weekend. The prototype was deleted before any external surface mentioned it. Some weeks the right outcome of three hours of work is to delete three hours of work.

Cross-thread engagement landed on in-toto/attestation #549 (10/10 byte-match round-trip with arian-gogani's Nobulex bundle against APS canonicalize-fixture-v1, May 1 cross-axis composition meeting confirmed), A2A #1786 (sequence vs session_epoch distinction, observer-relative framing), ERC-8004 #77 (endorsement-volume-vs-spend-spec split, srotzin confirming HiveTrust's production revocation-propagation latency at p50 1.4s p99 3.8s on Base L2). The pattern is consistent: where there is observable substance to confirm, the ecosystem confirms it. Where there is no substance yet, the right move is to do the work and let the confirmation follow.

Day 70: Pattern detection, run on ourselves first.

Three artifacts shipped before the discussion. aeoess/aps-conformance-suite went public with 37 fixture vectors across four categories (bilateral-delegation, inference-session, instruction-provenance, AIVSS scenarios), all byte-identical reproducible from a deterministic Ed25519 seed. aeoess/governance-attestation-predicate went public, the in-toto sibling to nobulex's Decision Receipt PR #549, five fixture vectors plus a composition test that walks the receipt chain across both predicates. The APS ↔ ACTA receipt crosswalk opened as vocab PR #55, 14 mappings calibrated against actual shipped versions of @veritasacta/* and protect-mcp. Three parallel CC sessions, three commits, three pushes, one evening.

Then contributor-check from MS AGT v3.3.0 installed on three active repos: agent-passport-system, agent-passport-mcp, agent-governance-vocabulary. Pinned to commit 15e001f9b53f, threshold HIGH for the calibration window. Ran it against ourselves. Profile risk HIGH, three signals fired: recent_repo_burst (41 repos in 90 days), cross_repo_spray (issues in 72 repos in 7 days), credential_laundering (citing aeoess merges across 5 repos). Every signal is technically correct as a pattern. Substantively the cross-repo activity is independent convergence on the same governance primitives, not coordination. The signal density is the work density.

Discussion #20 went up the same evening: "The threat is laundering, not cyborg contribution." Endorses the tool, names that most active contributors today are human + AI systems including us, draws the substance-vs-pattern line. Companion comment on Imran's #1473 with the link. Pattern detection is the necessary half. Substance evaluation is the other half.

Day 69: Five external merges, two co-authored opens. Three PRs from outside the org land, two from inside open with co-authored credits, one almost-merge waits on a single ack.

Three PRs landed in aeoess repos today where the primary author was somebody else. Vocab PR #49 from madeinplutofabio merged at midmorning PT, mapping the PIC Standard's verification-pattern primitive to the vocabulary's canonical signal types. The crosswalk models action-boundary verification as a parallel surface to visa-layer issuance rather than as a sub-field beneath it. Visa-layer primitives like APS, AgentNexus, and MolTrust handle issuance-side identity and delegation tokens carried by an agent. PIC handles receiver-side fail-closed verification at the action boundary, consuming trust roots that may include visa-layer issuers but owning the verdict primitive itself. Both compose. Neither contains the other. The crosswalk landed describing PIC in PIC's own terms first, with the composition pattern documented in the notes block, and PIC became the twenty-third entry in the vocabulary registry. Ecosystem precedent is the discipline that protects the vocabulary from accidentally setting permissive templates.

Vocab PR #46 from piiiico merged this afternoon after one round of structural revision. The first iteration mapped AgentLair's TrustProfile to peer_review as the primary signal type. The full v0.2 review against piiiico's live envelope and the canonical vocab definitions found that primary mismatched: peer_review is task-completion attestation signed by a delegating agent after a service agent completes work, and AgentLair's TrustProfile is aggregate behavioral scoring across events with no task binding. The fix was to promote behavioral_trust to primary with match: exact and demote peer_review to no_mapping with a note explaining the definitional gap. piiiico turned that around in fifteen hours. Same commit added AgentLair to behavioral_trust.issuers_in_production, which now lists three independent issuers (RNWY, Logpose, AgentLair) producing real signal data against the same canonical type. That is the production-signal evidence behavioral_trust needs to remain canonical with multi-issuer coverage.

aps-system PR #19 from lawcontinue shipped a seven-vector test pack for the CTEF inference-session category at fixtures/inference-session/. Each vector covers a different shape of session attribution: clean handoff, mid-inference rotation, distributed cross-node, sequence-bounded validity, parent-chain Merkle anchoring, replay defense, and a negative case where the session_id does not match the canonical JCS hash. Every signature is RFC 8785 JCS-canonicalized and Ed25519-signed. Two structural fixes flagged in review (a session_ids array shape mismatch and a missing parent_receipt_hash wiring on one vector), lawcontinue pushed corrections at commits 95c1ca9 and 73d52c0 in twenty-two minutes. Second time this week he has turned a structural review around inside half an hour. The pattern is starting to shape how the SDK fixture queue moves: external contributors land first, the maintainer review surfaces the structural points, the contributor iterates same-day, and the merge happens before the day ends.

The opposite shape happened twice today. Vocab PR #51 added docs/descriptor-dimensions/invariant-survival.md, with QueBallSharken as Co-authored-by: on the commit. The doc names the BBIS canonical language explicitly at three structural points so the vocabulary references the same vocabulary BBIS uses, not a parallel coinage. Vocab PR #52 added the entity_continuity PDR validator built directly from nanookclaw's slope-computation spec posted earlier the same evening. 309 lines of pure-Node validator with no dependencies, a 32-test suite all passing, four reference vectors covering stable, drifting, improving, and out-of-range agent behavior. The slope formula is from his spec: L2 distance over four normalized fingerprint dimensions, OLS over a window of twelve sessions, max divergence of two, max possible slope of 2.0/(N-2). nanookclaw posted the spec at 21:34Z; the validator opened at 22:52Z. The entity_continuity arc now has a deterministic checker the vocabulary registry can point at.

a2a-compliance-harness PR #1 is still in DRAFT but ready in substance. MoltyCel published moltrust v0.2.0 to PyPI today, then opened a PR adding moltrust as an optional resolver adapter to the harness with a clean fallback path when the package is not installed. Thirteen tests pass on Python 3.12. Two minor asks from review (a docstring sharpening and a pytest.skip for the no-moltrust path), both acknowledged. Co-maintainer access granted on the harness repo at the same time. Once he marks the PR ready for review on Monday, the merge takes about a minute. MolTrust and APS have been shipping against the same surface in iteration cycles measured in days, with MolTrust now positioned as a drop-in second-issuer reference under the harness's resolver interface.

This was not an APS-shipping day. The protocol, the SDK, the MCP server, the gateway, and the website did not get version bumps. What shipped was other people's code into surfaces APS maintains, plus code that APS produced co-authored with the original spec authors. The vocabulary repo is functioning as a multi-contributor coordination surface, not a one-author ship lane. Three production issuers on behavioral_trust. Twenty-three crosswalks. Two new docs co-authored with their original spec authors. One almost-merge from MolTrust waiting on a single ack. Day 65 named the pattern first ("Five issuers converge on one convention"). Today extends it. The cadence has held since.

Day 68: Five-way convergence on claim_type. Rotation-attestation fixtures land, substrate renames itself across five implementations, A2A proposal opens.

Two things shipped today that were not on the morning's list. One was a substrate rename across five implementations that made the wire format consistent for the first time. The other was a proposal-phase issue at A2A that landed in the maintainer queue with co-normative endorsement four minutes after opening. Both started from a thing that did go on the morning list, the rotation-attestation fixtures, and ended somewhere unexpected by evening.

Five canonical DID-document fixtures, a JSON Schema, a test-vectors manifest, and a deterministic generator landed at aeoess.com/fixtures/rotation-attestation/ at 11:40 PT. The set covers happy-path, cross-signed, migration-attested, happy-path-compound (cross-signed and migration-attested in one entry, the realistic production case), and negative-no-attestation (a rotationLog entry with empty rotationSignature that must trigger INVALID_CLAIM_SCOPE on a conformant verifier). Every signature and hash input is RFC 8785 JCS-canonicalized. The attestor is a dedicated fixture-signing key separate from the gateway, with the seed documented so any third party reproduces the set byte-identical from a clone. Within hours, AgentGraph landed test_aps_rotation_attestation_interop.py in main at commit 8baaad4, live-fetching the fixtures at test-collection time rather than pinning a repo-local snapshot, dual-locking each fixture against the published test-vectors.json canonical SHA-256 and what their canonicalize_jcs_strict produces from the live body. All five fixtures reproduce byte-identical. The canonicalization loop closed: APS bilateral delegation, APS continuity rotation, and AgentGraph CTE vectors now pin the same canonicalization through JCS bytes rather than shared code. Which is the actual interop test.

By late afternoon the work shifted into A2A #1672. The four-layer split (identity / transport / authority / continuity) had been the working substrate for over a week. AgentGraph's CTEF v0.3.1 had frozen it as normative bytes the day before. Three independent Python canonicalizers (AgentID, AgentGraph, APS) plus one TS canonicalizer (Nobulex's @nobulex/crypto) were already byte-matching against shared fixtures. Then at 23:38Z kenne flagged a naming collision. AgentID had been shipping claim_type on the live /verify endpoint since the spec hardened. AgentGraph plus APS rotation-attestation were using claim_category. Same concept, same closed-set values, different key name. A verifier choosing the wrong key would silently split the harness on lookup.

At 23:57Z Harold confirmed AgentID /verify and /re-verify shipping with claim_type, 32/32 endpoint tests pass, JCS canonicalizer byte-matching all 10 APS bilateral-delegation vectors. Third independent canonicalizer joining the byte-match harness. At 00:21Z kenne renamed AgentGraph's substrate claim_category → claim_type at commit agentgraph-co/agentgraph@69ad94d. Reserved keys updated to claim_type.envelope and evidence_basis.evidence_type.payment_execution. arian-gogani at Nobulex updated the TS verifier's key pin in the same window. At 01:07Z srotzin posted from HiveTrust confirming that HiveTrust's internal schema also uses claim_type, with a clean two-axis resolution: claim_type for role/capability/audit at the CTEF envelope level, hivetrust.internal.claim_type for risk-tier bucketing at the HiveTrust application level. Disjoint namespaces, explicit projection rule mapping HiveTrust claims onto ctef.envelope.claim_type='authority' when carried in a CTEF-composed envelope. Matches §6.7 superset-with-projection exactly. That is five implementations agreeing on a discriminator key name, a closed set of values, an envelope-reservation slot, and a structural error code, all produced through CTEF v0.3.1's normative endpoint, all four byte-match harnesses validated against each other. None of which existed twelve hours earlier.

Issue #1786 opened at 00:53Z. Cites claim_type, cites commit 69ad94d, cites Section 4.4.4 for AgentExtension. Uses the existing extension mechanism with params carrying the per-claim payload, no proto schema changes proposed. Reference URI a2a-protocol.org/extensions/cryptographic-agent-identity/v0.3.1 with the experimental prefix. Within four minutes kenneives posted co-normative AgentGraph endorsement with a four-way byte-match harness table at the top of the proposal thread, calling the 48-hour multi-implementation validation arc a strong sponsorship case and offering AgentGraph-side test vectors and conformance fixtures once the experimental-ext repo opens. By 01:34Z lawcontinue posted a substantive question on validity_window for long-running inference sessions mapped to a real production case (245 decode steps, ~130ms cadence, two-node cross-distribution, identity sequence-bound to the run, no mid-inference re-verification). APS already implements this with sequence_bound over the rotation event sequence. Reply confirmed, lawcontinue committed to a fixture contribution against the bilateral-delegation regression once the spec freezes. The thread now has five-way alignment on the discriminator, four-way byte-match harness published at the top, one production case mapped onto existing primitives, two committed test-vector contributors plus a third potential.

Vocab PR #46 merged today: crosswalk/agentlair.yaml, piiiico's pre-delegation behavioral check. Mapped to peer_review as primary signal type with match: exact. Production data exists. Secondary mappings on behavioral_trust (exact), trust_verification (partial), governance_attestation (partial). Eight explicit no_mapping entries with technical rationale. The substantive contribution beyond the mapping itself is the four-temporal-layer sequencing piiiico documented in the peer_review notes block: pre-delegation → at-delegation → at-execution → post-execution → feedback loop. Each layer answers a different temporal question about the same agent action. The four-layer framing landed in notes: on the peer_review entry, not as a new top-level section, which is the precedent discipline PR #44 surfaced last week. piiiico got it right on first PR. Separately, the wallet_intelligence → behavioral consolidation also merged (PR #47), closing the Apr 14 consensus from #6.

steipete closed openclaw#49971 as COMPLETED, MoltyCel's RFC for Native Agent Identity & Trust Verification. Easy to read this as a soft punt; it is not. steipete cited five public hooks at file-and-line precision against commit 45146913007d: before_install for skill install gating, before_tool_call for per-action enforcement at the runtime tool-call gate, inbound_claim plus message_received plus before_dispatch for inter-agent verification, gateway_start for self-verification on startup, plus the public SDK reference docs confirming all of them as supported plugin contracts. That is a documented integration contract. Build your trust provider on these, with line numbers attached. Reframes the OpenClaw integration story for APS, MolTrust, AgentLair, AgentID, and any other trust provider operating in the openclaw ecosystem: the integration artifact is a plugin against the documented hook surface, not a core dependency. For APS that means @aeoess/openclaw-trust-plugin, npm-publishable, ~200-300 lines, calls gateway.aeoess.com/api/v1/public/trust/{agent_id} for per-agent JWS-signed trust attestation. Queued as the deliberate follow-on.

What ties the day together is composition that shipped across surfaces other people own. The fixtures composed against AgentGraph's harness without either side touching the other's repo. The substrate rename composed five implementations onto one wire-format key without a coordinated migration. The proposal composed against A2A's existing extension mechanism with no proto changes. The vocabulary composed AgentLair's pre-delegation layer onto the existing four-signal vocabulary without a new top-level section. The OpenClaw closure composed APS as a plugin against documented hooks rather than as a core dependency requiring upstream change. Every one of these is an extension against an edge, not a change to the core. That is the shape that has been emerging since v2.0.0 hit npm a week ago. Most of today's substantive output came from peers: kenne, harold, arian, srotzin, piiiico, lawcontinue. APS produced fixtures and a proposal. The other five did the rest. That is the design working as designed.

Day 67: Ecosystem Directory. Who is building the agent economy, listed as rows.

I needed a way to keep track of what was happening in the agent infrastructure field faster than a spreadsheet and more honestly than a curated list. The contribution map in aeoess_web/specs/contribution-map had the raw data, 130 people across 93 threads, but it was optimized for my own navigation at session start, not for anyone else to read. The Agent Ecosystem Directory is the public-facing version of that. Three tables. Projects, people, threads. Everything pulled from live GitHub, everything sortable and filterable, dates visible on every row.

What the directory actually does that a graph could not: account age is a column in the People table, so a very new account reads differently from an established one at a glance amber next to a 10-year veteran in plain type. Account ages are pills, amber under 60 days, green 60-365 days, plain after that. Sort Projects by last push and see the field's velocity in one column. Sort Threads by updated-time and see what's actually hot this week. The graph I had shipped before this pass was pretty. This one is useful.

Every person who has posted on any of the 93 governance threads we track is in the directory. No curation, no ranking, no tier assignment. Score is the same behavioral score the contribution map emits (post count weighted by thread breadth, receipt presence, mention network), used here only as a default sort, not a judgment. Filter chips at the top of each table surface "active this week," "new account," "open PR," "multi-contributor project," so the field's shape is readable at a glance. Click any row for a drawer with full detail and clickable cross-links to related rows.

Repo is at aeoess/agent-ecosystem-map. Live at aeoess.github.io/agent-ecosystem-map. Licensed CC-BY-4.0 for the data and MIT for the code. Explicitly not a property of AEOESS long-term: the README calls for co-maintainers from other projects in the directory, and the intent from day one is to transition to neutral stewardship once anyone wants to co-steward it. To add a project, open a PR with a YAML file in projects/. To correct or enrich an existing row, open an issue. People and threads are pulled automatically from public GitHub activity, nothing to claim or edit there.

The build came out of the same question the directory answers for others: what does this field actually look like, and who is in it. The answer for me, after a month of posting on threads across 18 projects, is that the agent infrastructure space has about 130 people doing substantive work, most of them human-agent pairs, spread across identity, delegation, enforcement, commerce, memory, observability, and reputation layers that compose differently in every stack. The Model Citizen framing for how APS engages the ecosystem depends on that composition being real and visible. The directory makes it visible.

Day 67: BBIS grammar and FRCBE lock, three specs converge on shared vocabulary.

Overnight the critic who forced v1.1 of the enforcement-trust-anchor doc posted the answer to the open question that doc left on the table. If a Web2 target cannot verify delegation-bound authorization natively, and the architecture honestly labels the residual as unresolved at the wire format level, does BBIS treat the deployment as admissible? The answer is no. Honest declaration is a claim-grammar discipline, not an admissibility upgrade. Typed epistemic receipts narrow what APS can truthfully say about a path. They do not convert a non-refusal-capable path into a refusal-capable one. That correction matters because v1.1 was still softening the Class B framing more than the structural honesty allowed.

The same reply proposed a classification grammar that maps cleanly onto the five-bucket taxonomy v1.1 had been using. Closed paths where the invariant survives refusal-capably to the true irreversible authority. Bounded paths where the same claim holds but only within an explicitly scoped primitive. Partial paths where some refusal boundaries still exist but do not survive all the way. Detectable-only paths where the evidence is strong but invalidity is still expressible at the true sink. And governance theater for non-closure claimed as closure. The grammar is sharper than what APS had on its own because it centers the invariant survival question rather than the cryptographic construction that attempts to establish the property. The construction is an implementation detail of the claim. The invariant survival is the claim itself. v1.2 of the trust-anchor doc adopts the BBIS vocabulary directly and credits Hensley's OWASP#817 as the source.

The parallel move landed on qntm#7. The primitive that the capability-token spec had been calling the sink-signed effect receipt got a name: Final Refusal-Capable Boundary Event, FRCBE, coined in the same thread by the same author. v0.2 of the capability-token spec adopts the name, which also resolved an asymmetry the earlier draft had been carrying. M4 in v0.1 was doing double duty as both the boundary event and the post-execution record. v0.2 splits that. M4 is the FRCBE emission, the moment where authority either enables or refuses the specific mutation attempt and the sink signs the outcome. M5, new and optional, is a post-effect forensic record for deployments that want a separate trail after the fact. Most deployments omit M5. The boundary event is what matters for closure.

Same morning, kenneives at AgentGraph posted on qntm#7 with concrete deliverables. CTEF v0.3 will accept delegation_chain_root as a composition field. A /.well-known/cte-test-vectors.json endpoint will publish byte-for-byte inputs with expected verdicts. Cross-test with APS plus AgentID plus AgentNexus by Apr 30. Kenne adopted FRCBE in the same comment: AgentGraph's EnforcementVerdict family is the verdict-shape taken at the FRCBE event, not a replacement for it. Three specs, three authors, three vocabularies locking onto the same architectural invariant within eighteen hours. That is what convergence actually looks like when the primitive is real.

v1.2 of ENFORCEMENT-TRUST-ANCHOR.md and v0.2 of CAPABILITY-TOKEN-SPEC-DRAFT.md are on the feat/v1.2-bbis-grammar branch, review before merge to main. Convergence posts live at qntm#7 and OWASP#817. Vocabulary is converging across BBIS, APS, and AgentGraph. The shared words mean the shared primitive.

Day 66: Mutual auth ships, the composition pattern runs on its own, and a critic finds the real gap.

Agents authenticate to systems. Systems do not authenticate back to agents. That asymmetry has been sitting in the APS protocol since the beginning, and it matters because an agent that hits whatever endpoint it is told to hit is phishable by construction. A bank issues a scoped passport to a customer's agent. The agent then needs to connect to an MCP server the bank operates. Without a protocol-level way for the bank to prove that the server the agent is about to talk to is actually its own, the agent has no recourse when a different server claims the name. The scoped passport protects the bank from the agent. Nothing in v2.1 protected the agent from the bank's operational surface.

SDK v2.2.0 ships mutual authentication as a protocol primitive. A downgrade-proof four-step handshake, a local trust-anchor bundle each party carries and updates out of band, adapters for both A2A and MCP so the handshake fits inside the transport's session-initialization hook without a separate connection. Replay defence via nonces and signed timestamps. Downgrade defence baked into the attest signature: the signature covers chosen_version alongside both nonces and the peer's certificate, so a man-in-the-middle that strips supported versions to force negotiation down cannot forge a valid attest advertising the weaker version without breaking the signature. 29 new tests, 2410 total across the full suite. A2A and MCP adapters ship in v2.2.0; autogen, crewAI, langchain, and ADK adapters pick up mutual auth through the shared primitives without separate integration work. What the module explicitly does not ship is also the point: no federation, no gossip, no certificate-transparency-equivalent log, no consensus revocation, no hosted CA. Mutual auth is a protocol primitive. A future federation layer, if one ever ships, composes on top without changing it.

Separately today, the composition pattern we shipped last night at agentid-aps-interop#7 started running on its own. Harold merged the three-signal composed/v1 envelopes at 09:44 UTC. Seven hours later schchit opened PR #8 extending the envelope with JEP as a fourth signal in the decision_event category Kenne carved out on the CTEF thread the same morning. The JEP receipt flows into slots.jep verbatim, no reshape. verify.py recognizes the new version: "jep-v1" string and handles judgment events per their native semantics. The pattern: composed/v1 host stays generic, new signals register by adding their CTEF category, their slots.<issuer> key, and their native-version string to the validator. AgentID covers identity, APS covers authorization, AgentGraph covers security posture, JEP covers judgment events. Any fifth signal with a signed JCS-canonicalizable inner receipt and a new category label composes in the same way. The merge took Harold about a day. The extension by a fourth issuer took half that.

The other ecosystem move today was microsoft/agent-governance-toolkit#1328, which merged at 19:41 UTC. examples/cognitive-attestation-governed/ is a community example layering a signed interpretability envelope on top of AGT's policy decision. AGT decides whether an action is permitted. The Cognitive Attestation envelope signs a sparse-autoencoder decomposition of the model state that drove the decision, so downstream auditors can inspect what the reasoning substrate looked like when the action fired rather than just whether the policy rule matched. 443 lines, two files, zero APS SDK dependency. Third merged aeoess PR in microsoft/agent-governance-toolkit after PR #274 (Mar 16, reputation-gated authority proposal) and PR #598 (Apr 6, APS-AgentMesh adapter), and the first community-example-style contribution to the repo. The community-extension boundary that ADR 0006 formalized two days ago is where this kind of example naturally lives: policy evaluation stays in AGT core, proofs about the reasoning that produced the decision live as extensions that plug into the decision boundary without changing AGT's interface.

Late in the evening EchoOfDawn at SageMind AI accepted the invitation to co-maintain aeoess/autogen-governance-adapter, a glue repo for the before_tool_call hook pattern autogen needs to compose three-layer governance: identity via APS passport, authorization via delegation scope, optional behavioral trust via a provider plugin. She posted the acceptance at 21:15 UTC with a pushback on the portable-vs-context-bound framing that had been floating in the thread. The framing worth carrying forward: MoltBridge attestations are not globally portable trust scores. Each attestation is a scoped edge in a graph with issuer, subject, context, skill, policy_constraints. What is portable is the evidence, the signed edge. The policy engine on the verifier side decides whether evidence from context X counts in a decision in context Y. Same property APS delegation scope carries. Hard authorization and portable evidence compose; they do not replace each other. By 01:33 UTC the repo was live at aeoess/autogen-governance-adapter, 2884 tests passing across Python 3.10 / 3.11 / 3.12 on first push.

Then late on April 22 a technical reader read the v2.2 mutual-auth writeup and asked a question we did not have a clean answer to. A compromised gateway can emit a cryptographically valid PolicyReceipt attesting to an enforcement decision that never occurred, and nothing in the current deployment lets a third party dispute it. The delegation chain still verifies. The passport binding still verifies. Monotonic narrowing still mechanically rules out out-of-scope forgery. What the gateway can do is fabricate a within-scope enforcement decision. As single-party attestations, those receipts are indistinguishable from real ones. v1.0 of the enforcement-trust-anchor spec listed four closure paths (bilateral receipts, tamper-evident log, TEE, multi-gateway quorum) and committed to bilateral receipts as primary. That framing was the ecosystem's consensus. After sustained adversarial review, it turned out to be incomplete in a specific way: all four paths preserved the gateway as the attestation root and diluted single-party lying through honesty assumptions on other parties. None of them removed the gateway from the loop for the property under dispute.

The reorganization that survived review is the sink-awareness boundary. APS targets split into two classes and the honest closure story differs per class. For resources that can verify delegation-bound authorization tokens natively (our MCP server, APS-compatible agents, SINT-integrated sinks), full structural closure is available via a four-piece stack. The sink, not the gateway, defines the canonical action in a signed challenge. Authority is represented as consumable tokens minted by the delegator at delegation time, not by the gateway at evaluation time. After execution the sink signs its own effect receipt, which becomes the primary attestation that enforcement occurred. Every receipt labels each claim it carries as closed, witnessed, or unresolved, so downstream verifiers cannot be tricked into treating self-assertion as cryptographic closure. For dumb Web2 sinks (Stripe, AWS billing, model provider APIs) structural closure is not available at the protocol layer. Whoever holds the connection to a sink that does not read cryptography has absolute power over it. Bilateral receipts, tamper-evident logs, homomorphic state commitments, MPC-TLS for high-value transactions, and BMO ground-truthing narrow the gap. None close it. Deployers using APS against dumb sinks accept residual gateway-compromise risk. Saying this plainly is the point. v1.1 of the trust-anchor spec and the v0.1 capability-token wire format are both on main at ENFORCEMENT-TRUST-ANCHOR.md and CAPABILITY-TOKEN-SPEC-DRAFT.md. Reference implementation on feat/v0.1-capability-tokens with passing end-to-end tests for the full four-message cycle. Bilateral-receipt emission landing in SDK v2.3.0-alpha on npm, released this evening under the alpha tag.

What ties the five threads together is not the volume of shipping. It is the shape. Mutual auth v1 closes an asymmetry in the protocol without adding federation, because federation is a layer above the primitive and composes on top rather than needing to be built in. JEP extends the composition envelope because the envelope was designed to host signals the primary author did not anticipate. Cognitive attestation lands as a community extension against an AGT policy boundary that got formalized specifically to hold extensions like this. The autogen adapter is a new repo, not a new feature in APS core, because composition glue is its own artifact. And the trust-anchor work moved from v1.0 to v1.1 not because the original framing was wrong but because external critic pressure found the sharper statement of the problem. Every one of these moves is an extension against an edge, not a change to the core. The architectural claim that comes out the other side, the one the seven rounds of hostile review converged on, is this: the gateway must stop being the component that both describes the action and originates the usable authority for it. That belongs in the same posture the protocol has been converging toward for months. At this point the ecosystem is enforcing it without us having to name it.

World ID is the root. APS is the chain.

World shipped AgentKit on April 17 with Okta, Vercel, Browserbase, and Exa. The pitch is clean. An AI agent can now carry cryptographic proof that a unique human is behind it. The Shopify demo routes a World ID signature through UCP to complete a purchase, and the merchant ends up with a receipt of human intent.

This solves an identity question that payments alone never could. Is there a human here becomes yes or no, anchored in biometric proof-of-personhood. Real move, genuinely useful.

But agentic commerce has two questions, not one. Who is the human is the first. What is the agent permitted to do on their behalf, with what limits, and how do we trace a specific action back to a specific delegation, is the second. AgentKit handles the first. It does not try to handle the second. That is the correct design choice. It also leaves a seam.

Agent Passport System (APS) fills that seam. A delegation object in APS is a signed, scoped, attenuated authorization that travels with an agent action. It says which human principal delegated it, what scopes are permitted (commerce:checkout, data:read), what budget remains, what TTL is left, and which sub-agents are allowed in the chain. Ed25519 signatures, offline-verifiable, no registry round-trip required. Apache 2.0. Shipped February 18, 2026.

The composition is clean.

World ID proof of human anchors the delegation root. The signed World ID credential becomes the principal attestation for an APS delegation object. From there, the delegation narrows. An agent gets commerce:checkout scope with a $500 budget for a specific merchant allowlist, valid for 24 hours. The agent does its work. Every action it takes is signed against that delegation. At the merchant, a 4-gate preflight runs: passport valid, scope authorized, budget remaining, merchant allowed. Any fail emits a signed rejection receipt. Success produces a CommerceActionReceipt that links the purchase back through the delegation chain to the original human via their World ID.

For a flash sale with limited inventory, that merchant now knows two things. There is a unique human behind this agent. That human delegated this specific purchase, within these specific limits, and the signed chain proves it. Fraud reduces. Over-purchase reduces. Audit trails become real.

The human-in-the-loop threshold pattern in AgentKit's docs maps directly onto the APS HumanApprovalRequest primitive. For purchases above a delegation-specified threshold, the agent pauses and emits a signed approval request. The human's response (signed, via World ID or otherwise) becomes part of the CommerceActionReceipt.

None of this requires either side to change. AgentKit's SDK works as is. APS's commerce adapter works as is. The seam is a header or extension field carrying the delegation object alongside the World ID signature. Any UCP or ACP endpoint can implement the 4-gate preflight in under 50 lines.

Working reference today: github.com/aeoess/agent-passport-system/tree/main/examples/stripe-governance

The agentic commerce stack has three trust layers emerging. Payments, proof-of-human, and scoped delegation. The first two are consolidating around strong incumbents. The third is the one that answers what did this agent do on behalf of whom, within what limits, provably. It belongs in the stack too, and it composes with what is already there rather than competing.

AgentKit is the root. APS is the chain.

Day 65: Five issuers converge on one convention.

Harold merged Step 1 of Interop Week 1 yesterday evening. His AgentID trust_verification fixture landed clean through the five-check protocol, one signing-convention ambiguity flagged for a future convention table in the bundle README. At 08:40 UTC this morning he came back with something I did not ask for: AgentID's production signer had been switched to raw digest bytes, the convention APS and SINT and MolTrust already use. The already-merged fixture is technically on the old convention; his follow-up PR will replace the one signature field to match the new signer. The fixture data otherwise stands.

That is the Interop Week 1 thesis in miniature. Nobody imposed the convention. Five issuers looked at each other's code and pulled toward a shared shape because the alternative was writing a convention footnote per issuer in the bundle README. When AgentID's second fixture lands, the convention table can read one sentence: all five issuers sign raw digest bytes, 32 bytes, result of bytes.fromhex(compound_digest). No per-issuer exceptions. That sentence is the kind of thing a reviewer at OWASP or IETF will notice later precisely because it disappears into the background.

The vocabulary's context_dimensions draft also closed its review loop today. PR #34 landed with pshkv's sharpening incorporated: resolution_source marked recommended rather than required in v0.1 so early adopters who have real policy dimensions to document but no formal source model yet can still publish; physical_environment_state updated to document that its resolution source varies per sub-field at evaluation time (temperature typically sensor-attested, geofence typically gateway-derived, human proximity deployment-dependent); pshkv's alternative four-value enum documented inline as the v0.2 fallback if the five-value partition surfaces ambiguities in production. tomjwxf's earlier sign-off on the five-value enum preserved, pshkv's refinement added on top of it. Ran the five-check on our own PR publicly before merging, because not running the protocol on our own work because it is ours is exactly the failure mode the protocol is supposed to prevent. Four day-one entries in the vocabulary now, each carrying a non-signal test that names what would disqualify it from belonging there.

On OWASP AARS#32 the conformance question surfaced, and it is worth naming because the answer carries weight. VeloGerber accepted our §3.3 naming position last night and asked a follow-up that was harder than it looks: for AiEGIS APS to earn a v1.0 conformance citation, does an independent Python reimplementation of the APS v1.1 spec count, or does consuming our SDK as a dependency count. The honest answer is that they answer different questions. An independent reimplementation with shared test vectors earns a separate conformance row in the §3.3 table because it demonstrates that the scored behavior is independently reproducible. Consuming our SDK is a deployment pattern, useful for adoption, but the enforcement is still happening in our code. The distinction matters for exactly the reason we pinned the acronym collision in the first place: evidence at the implementation layer and evidence at the adoption layer should not bundle into one reviewer-facing citation. v0.9 cites AEOESS APS as the shipped reference; v1.0 re-evaluates AiEGIS once the independent reimplementation lands. The sequencing does not stall anyone's merge. The concrete offer to accelerate: ship our interop fixtures as a standalone aps-conformance-suite repo that any reimplementation can run its test matrix against, so the conformance bar is legible rather than implicit.

What these three threads have in common is that none of them are about APS. Harold is writing AgentID, not writing APS. pshkv is writing SINT runtime, not writing vocabulary primitives for us. VeloGerber is writing AARS, not adopting APS as a vendor. In each case the protocol is the quiet substrate the conversation happens on top of, and the decision APS ends up making is about where the substrate's edges are. Whose signing convention. Whose resolution model. Whose conformance evidence. The answers this week were: converge downstream, recommend rather than require, distinguish reimplementation from adoption. None of those are APS imposing anything. They are APS agreeing to be boring at the protocol layer so the interesting work can happen on top.

By evening a fourth thread landed that inverted the first three. I posted the APS slot shape on agentid-aps-interop#5 at 19:02 UTC. Harold posted the AgentID slot shape about two hours later. Kenne shipped AgentGraph v1 structural fixtures as PR #6. By 21:08 UTC I shipped PR #7: three composed envelopes stitching AgentID identity, APS delegation, and AgentGraph security posture under one shared subject DID, plus an issuer-neutral Python validator that runs without importing any of the three contributing SDKs, plus APS v1 structural fixtures to feed the APS slot. Kenne ran verify.py on his machine, 51 of 51 checks passed at exit zero, LGTM from the AgentGraph seat. The inversion is the point. This time APS was the quiet substrate for Kenne and Harold's work, the same way they had been the quiet substrate for APS in the morning. The posture does not depend on which side is shipping. Convention convergence took a week for signing-input format. Composition convergence took seven hours for envelope shape. The pattern is in everyone's hands now.

Day 64: v2 promoted, v2.1.0 shipped, foundation filed.

v2.0.0 moved from @next to @latest on npm today. MCP v3.0.0 with it. PyPI got a non-pre-release 2.0.0 that replaces the 2.0.0b0 beta. v1.46.0 and MCP v2.27.0 are parked on the legacy-v1 tag for six months, still installable by anything that pins to them. That is the surface. What is underneath is worth a paragraph.

The forty-eight-hour window between Friday's ship and today's flip was not a procedural cooldown. It was a test. Four external systems landed real code against v2 during the window. AgentNexus Track A fixtures round-tripped through our canonicalization and signature verification. VeritasActa's external_receipts.aps slot got a KU receipt signer. Illia's SINT refresh merged against the vocabulary registry. RNWY's a2a.yaml merged alongside. None of them shipped because of v2. All of them ran through v2 without noticing. That is the kind of evidence you want before you flip a default tag.

The sweep also turned up a small drift worth naming. The Python SDK's __init__.py had been carrying __version__ = "0.15.0" since the 2.0.0b0 beta shipped. pyproject.toml said 2.0.0b0 and the wheel said 2.0.0b0, but if you imported agent_passport.__version__ in a running process, you would see 0.15.0. It is 2.0.0 now, same as the artifact. Exactly the kind of thing a promotion sweep is supposed to catch.

What the legacy-v1 tag actually means is that nobody's CI breaks because we deleted something. Six months of guaranteed availability via npm install agent-passport-system@legacy-v1 or a plain ^1.46.0 pin in package.json. After that we freeze the tag but keep the package on npm indefinitely. No auto-upgrade, no pressure.

The morning was the default flip. The afternoon had four things worth naming.

v2.1.0 shipped same day, with a different primitive than planned

The Day 61 post said the next build was Ledger Events. That was wrong, and the error is worth naming. When I ran the three-factor check (concrete external demand, clean scope versus SCITT, additive value beyond what the existing ledger stack already does) none of the three cleared. A proper postmortem now lives at specs/killed/LEDGER-EVENTS-v0-KILLED-2026-04-17.md with the revival criteria written down for future me. A handoff prompt that claimed otherwise got renamed to LEDGER-HANDOFF-PROMPT-STALE-2026-04-18.md with a stale banner. Better to kill a planned build than ship a primitive nobody asked for.

What shipped instead was v2.1.0 with two primitives that had actual demand. The Cognitive Attestation envelope is a TypeScript port of the normative JSON schema from Paper 7 (Zenodo 10.5281/zenodo.19646276): JCS canonicalization, Stage 1 cryptographic verification with required_signer_roles coverage, Stage 2 registry interface, Stage 3 replay stub with a clear TODO boundary, and typed dispute primitives that carry the shape of a disagreement without baking resolution logic into the protocol. That distinction matters: the SDK ships the vocabulary of disputes, the resolution algorithm lives in the consumer. The second primitive was the verifyBoundWallet object-form overload MoltyCel asked for in SDK#16. Same behavior either way, asymmetry with bindWallet gone.

Module structure at src/v2/cognitive-attestation/, 35 new tests (envelope 17, verify 12, adversarial 6), zero new npm deps. Test count 2,325 → 2,366. Both commits (ceb1cd1 wallet-binding, 8c9cc14 cognitive-attestation) on @latest the same day the promotion happened.

APS submitted to AAIF

Filed as aaif/project-proposals#14, the AI Agent Interoperability Foundation, the path toward Linux Foundation stewardship for the public protocol layer. Position in the submission is the cleanest version of what v2 made possible: the protocol is a solo submission, cross-referencing SINT (Illia's #12) and the three-vendor governance_attestation convergence with MolTrust. The AEOESS company, the YC application, the private gateway, the partnerships: none of them are in the submission. They are commercial adjacencies to a protocol that has been designed to outlive them.

Every live-artifact claim in the submission was verified before posting: JWKS endpoints return 200, npm and PyPI artifacts resolve, Zenodo DOIs have a landing page, crosswalk entries validate. Foundation review waits on the TC triage window. Expected Tuesday UTC if they keep pace with the #12 and #13 precedents.

OWASP AIVSS#32. naming boundary held

A proposal came in to co-list two "APS" references in the permanent v0.9 §3.3 standards citation. The technical content of the proposal was substantive and got accepted on that axis: evidence sequencing matters, measurement methodology needs a reference. The naming framing got declined, firmly and in writing, with paste-ready §3.3 text naming only the Agent Passport System. The technical work is real. The naming collision would have been durable. Not every "be nice" reflex is the right one.

Thirteen ecosystem engagements, one day

The context for this is the structured ecosystem map from Day 61. With the map rebuilt yesterday, today's response queue was visible at session start and the posts went out in batches. Naming them for the record:

Tier 1. Gist for Illia's AAIF cover email (sint#130). pshkv crosswalk acknowledgment on vocab#8. Governance-declaration proposal for tomjwxf on ossf/security-insights#171. APS+SINT composition MVP for EchoOfDawn on autogen#7525. MIGRATION.md field-diff patch and v2.1.0 follow-up on SDK#16. Harold's AgentID fixture five-check protocol review on vocab#38. context_dimensions PR flipped ready-for-review on vocab#34.

Tier 2. Three-layer APS+SINT+OPA composition mapped onto AutoGen's ConversableAgent lifecycle on autogen#7528. Converged-architecture acknowledgment for Enclave+SINT+MolTrust on A2A#1716, offering sub_delegate for the 1→3 hop transition and an AND-composition argument for the MolTrust-score plus APS-grade gate. Full TypeScript reference implementation of a GuardrailDecision interface on VoltAgent#1166. Dispute-primitives reference from v2.1.0 on llama_index#21312.

What the day measures

Promotion window closed without a partner issue. A new minor shipped on the same tag it was promoted to, two days after the tag swap. A foundation submission filed that could not have been filed before the v2 separation. Thirteen substantive partner responses posted. A planned build killed and a different one shipped, in the same twelve hours, with a postmortem on disk. The thing v2 was supposed to unlock. protocol shipping at a different speed than commercial. is now visible in the shape of a day.

Day 63: Stability window, one compat test.

Sunday of the 48-to-72-hour window before the promotion flip. The point of the window is to not ship. Run the tests again, re-read the diffs, wait for partner signal. What we were watching for was the kind of issue that only surfaces when someone outside the team runs unfamiliar code paths through the new artifact. Exactly one partner did, and the finding was useful.

MoltyCel ran [email protected] and the MCP equivalent through a Solana wallet-binding compat test. Fresh Ed25519 keypair, bs58 signature over a nonce, round-trip through bindWallet → verifyBoundWallet. Two findings came back. Finding one was a shape-diff in MIGRATION.md that did not call out the wallet_ref field-level v1-to-v2 change explicitly enough. Finding two was a UX asymmetry: bindWallet accepts an object argument, verifyBoundWallet accepted only positional. Both on disk within the hour. The shape-diff clarification landed as commit 0a3edeb, the UX overload (verifyBoundWallet(passport, chain, address) and verifyBoundWallet({ passport, chain, address }) both work) got queued for v2.1.0.

Nothing else broke. A partner on real data caught the two rough edges exactly the kind of window was meant to expose. The promotion path stayed on for Monday.

Day 62: The protocol shows up in other people's code.

Yesterday was the separation ship. Today is the day after. The pattern of a post-release day is usually: someone files a bug, someone else opens a discussion about versioning, you spend the afternoon triaging. Today was different. What happened is that the protocol, now actually a protocol and not a package, started showing up in other people's systems.

Two things landed in the SDK, and neither of them was a new module. Both were interop harnesses. Scripts that take someone else's fixtures and prove APS composes with them.

Round-tripping AgentNexus

kevinkaylie's Track A fixtures were sitting on PR #17. Two delegation scenarios, a happy path and a scope expansion attempt. Merging the fixtures would have closed the PR. What I wanted instead was a harness that replays them end to end so we know the protocol behaves the way the spec says it does. Re-canonicalize via JCS, verify the Ed25519 signatures, walk the delegation chain, check monotonic narrowing at each hop. Both fixtures match expected. Happy path accepts. Scope expansion denies at the subset gate, which is where it should deny. Zero canonicalization drift between kevinkaylie's inputs and ours. That result is the thing. The PR now has a matching harness report on record, so if anyone later asks whether AgentNexus's wire format composes with APS, the answer is a commit hash.

Signing for VeritasActa

tomjwxf's VeritasActa/verify repo has a cross-verification bundle format with a slot called external_receipts.aps. That slot was empty. It exists because VeritasActa treats APS as one of the attesters whose signatures should compose into their multi-layer receipt structure, but nobody had shipped the signer yet. Today we did. interop/scripts/sign-va-ku-receipt.ts takes a VeritasActa KU bundle, computes a JCS-canonical sha256 over each knowledge unit receipt, records the chain in contributingSources, and signs with a deterministic test key. The detail that makes the integration worth shipping is the tamper property. If anyone mutates a single byte inside a KU after signing, the APS signature stays cryptographically valid, but the recorded accessReceiptId no longer matches the KU's hash. The cross-layer integrity becomes observable from either side. APS didn't have to change to support this. It slots in.

Two external crosswalks merged

Illia's SINT refresh (PR #30) normalized match semantics to the canonical enum, added a peer_review no_mapping row, and recorded entity_continuity and consent_provenance alignment notes. RNWY's a2a.yaml (PR #32) maps A2A Agent Card governance metadata against did:web:rnwy.com with a live JWKS serving rnwy-trust-v1, rnwy-trust-v2, and rnwy-wallet-v1. Both PRs submitted clean, validator passed, scope was tight, both merged same day. The registry is now at fourteen external crosswalks plus our own. Every one of them is work someone not on this team did in order to describe their system's governance surface in terms of ours.

Two threads worth naming

Jerry at MnemoPay shipped x402-compatible paywalls plus a financial-brain MCP on x402#1904. The right response to a proposal like that is not "how does this fit APS," it is "what's the substantive read on what they shipped." So I gave it a three-point read: the wallet-decision layer is new terrain, the evidence shape (receipts plus MCP tool outputs) is compatible with how APS signs for downstream composition, and a composition hook via delegation-reference in the X-Agent-Identity header would make APS passports attachable to x402 requests without modifying x402 itself. On ATF#8, desiorac proposed the ArkForge model, a three-plane decomposition of agentic trust into delegation, decision, and execution. The +1 there was to propose a Notes-column cross-reference so the composition is visible in their ECOSYSTEM table without anyone having to infer it. Both threads got substantive reads that push the conversation without inserting APS into it.

The quiet-strong shape

Days that ship new modules are loud. Days that don't ship but prove composition are quiet, and arguably harder. Interop is the surface where wishful thinking gets falsified. If our canonicalization drifts against kevinkaylie's, it shows up. If our signature doesn't slot into tomjwxf's bundle, it shows up. If a partner's crosswalk doesn't pass our validator, it shows up. None of these could fail today, so none of them did. That is what a post-release day looks like when the release was correct.

Day 61: The separation ships.

The SDK was one package. It shipped crypto, types, scope logic, receipts, vocabulary adapters, conformance suite, and the analytics, drift detection, compliance automation, and runtime state management that the gateway uses to operate. Partners who pinned the npm package pulled the whole thing. That was fine for a while. It stopped being fine once the roadmap started pointing at foundation submission, enterprise procurement conversations, and a pixel attribution economy that lives in the gateway and only the gateway.

Today the SDK shipped v2.0.0-beta.0 on npm @next. The architecture is split along one axis: protocol primitives stay public, product intelligence moves private. ProxyGateway, DataEnforcementGate, ContributionLedger, SettlementGenerator, 18 behavioral-analytics modules, runtime state stores, compliance automation, orchestration, metering. Gone from the public SDK. Moved to the private gateway package. Roughly 2884 tests moved with them. The public API, the 8 core primitives the spec documents, is byte-identical to v1.46.0.

How to read that

The protocol is now what standards bodies can actually adopt: a clean Apache-2.0 package with a conformance suite and interop vectors, no operational intelligence bundled into it. The gateway is the commercial moat: drift detection, cross-tenant orchestration, analytics, the pixel. Separation is not a feature flag or a licensing trick. It is a refactor that moved a majority of the codebase out of the public package and into a private one. That line is where I can defend it now.

Partners on any v1 pin are unaffected. v1.46.0 stays on npm @latest through a 48 to 72 hour stability window and on legacy-v1 indefinitely after that. Nothing auto-upgrades. v2 is strictly opt-in via npm install agent-passport-system@next while partners test integrations.

Four artifacts, one day

SDK: v2.0.0-beta.0 on @next. 2,884 tests, 130+ modules, tsc clean against the gateway after the split. Public exports went from 115 to 106, nine removed and six added. Every remaining export retains its v1.46 signature.

MCP: v3.0.0 on @next. 150 tools. Dropped 150 tools that never had a v2 analogue and stubbed 10 that moved to the gateway. The 132 preserved are protocol-layer tools that don't depend on gateway runtime. Major bump because the tool reduction is breaking.

Python SDK: v2.0.0b0 as PEP 440 pre-release. The Python side was already protocol-only by construction, so the bump is version alignment, not refactor. pip install --pre to opt in.

Gateway: repinned from file:../agent-passport-system to ^2.0.0-beta.0, Railway auto-deployed, health endpoint green through the swap. All 647 migrated tests pass in the gateway's own suite. No downtime.

The governance vocabulary got one thing fixed today too

The agent-governance-vocabulary repo has twelve external crosswalks from partners who mapped their terminology to the canonical signal types. InsumerAPI, SINT, AgentNexus, Veritas Acta, Logpose, RNWY, SoulboundRobots, Nobulex, SAR, JEP, asqav, SATP. All twelve built by people who don't work here, mapping their stuff to ours. One entry that was missing: ours.

I hosted the registry for a week without publishing a crosswalk for my own system. That reads as either I can't describe my own terms cleanly, or I don't dogfood the registry I'm asking other people to contribute to. Neither is true, but the file being absent says it anyway. Today I fixed that.

crosswalk/aeoess-aps.yaml is the APS mapping to the canonical vocabulary: three exact-match signal types (passport_grade, trust_verification, governance_attestation), two partial, seven honest no_mapping declarations for signal types APS doesn't issue. Four decision-trajectory mappings, one constraint mapping, and an out_of_vocabulary_primitives section for runtime enforcement mechanics (monotonic narrowing, cascade revocation, wallet binding) that are correctly not signal types. Validator is clean. APS also got added to governance_attestation.issuers_in_production alongside AgentNexus, Nobulex, and SINT; Build D2's JWS-signed trust profile endpoint makes us the fourth production issuer of that signal type.

Rollback is real

Before any of the above happened, the prior state got archived. Anchor tags in every repo (pre-v2-swap-main, pre-v2-swap-refactor, pre-v2-pypi-swap) pin the pre-swap commit as immutable references, and a private archive holds git bundles of every repo, a packaged copy of the v1.46.0 npm tarball, and step-by-step rollback procedures for each failure scenario. If v2 needed to come out within 72 hours of publish, npm unpublish works. After that, v2 gets npm deprecated and v1.46.0 stays on latest indefinitely. No rollback path depends on a single point of control.

The ecosystem data layer

Quietly in the background of this week, we built a structured map of the governance ecosystem we operate in. 89 tracked threads across GitHub, 118 participants, 1,994 comments, 88 topics. Each participant carries a working label and each thread is classified by waiting-state (waiting on us, waiting on them, closed, silent). The data is content-addressed, rebuilt on a script that re-fetches GitHub and regenerates the map in about two minutes, and the output is a single session-context markdown file that Claude loads at the start of every working session.

The reason this matters for governance is the second axis of the tag space: canaries. Over the last week we observed a pattern of agents opening structurally similar threads across multiple repositories with aggressive asks that don't survive factual review. Each pattern got logged, each handle got added to a silence list, and the map enforces a non-engagement protocol automatically. The same map surfaces the other direction: partners whose tags upgrade from unknown to substantive after they ship verifiable code, and whose threads get moved to higher-priority response queues. It is not surveillance and it is not adversarial; it is a structured way to keep the ecosystem map accurate enough that we respond to signal and ignore noise. The raw map stays in a private specs directory;.

What this unlocks

AAIF submission becomes a real option, not an aspiration. Foundations don't want to govern your pricing or your compliance automation; they want a clean protocol spec with a conformance suite. We now have that cleanly packaged. Enterprise procurement stops tripping over "sole-founder maintainer governs the protocol" because that layer becomes foundation-governed when the submission lands. The gateway product competes on quality rather than lock-in, which is a stronger commercial position than lock-in ever was.

The next primitive in the queue is Ledger Events. Ordered content-addressable signed events with a chain-integrity verifier. Will ship as v2.1.0-beta.0 on @next. Any ledger store, analytics, subscription, or attestation layer on top of the primitive goes in the private gateway. The separation holds.

Release notes with the full partner-facing picture are at aeoess/agent-passport-system#16.

Day 60: Build C ships. The evidence layer.

Build A gave us the signed primitive. Build B canonicalized the weights. Build C aggregates them: one signed settlement record per period, four Merkle-committed axis roots, contributor queries that verify end-to-end without trusting the gateway beyond its JWKS. The economic half, how weights convert to money, stays gateway-private. The evidence half is in the SDK.

SDK v2.0.0-beta.0 on @next & v1.46.0 on latest (2,884 tests, 130+ modules). MCP v2.27.0 (150 tools, new settlement scope). Python v0.15.0 / v2.0.0b0 pre (2884 tests). 5 cross-language fixtures, byte-identical across runs. The integration proof: 1000 Attribution Primitives → aggregate → verify → per-contributor query → verify, composes cleanly with Build A and Build B.

A contributor — data source, compute provider, protocol author — can now answer "what did I contribute and can I prove it?" with a signed artifact. What the market builds on top of that evidence is up to the market. The pixel is live.

Day 59: One receipt, four projections

Two ships and a retirement today.

Build A — the attribution primitive

For a while now the SDK has been accumulating attribution machinery along four different axes. Data sources contributing to an output — that had its own receipt. Protocol modules that evaluated the action — another. The governance chain that authorized it — another. Compute providers that ran it — a fourth. Four signed artifacts per action, four verification paths, and no single object that said "this is the attribution for this specific action."

Build A consolidates all four into one signed Merkle envelope.

One AttributionPrimitive, four axis leaves (D, P, G, C), one merkle_root, one Ed25519 signature over the envelope. Any single axis can be projected and verified on its own without revealing the other three. Two projections of the same receipt cross-verify by shared action_ref + merkle_root + signature — you can tell, cryptographically, that the D projection someone showed you came from the same underlying action as the G projection someone else showed you.

The spec has been sitting at /specs/ATTRIBUTION-PRIMITIVE-v1.1.md since Apr 12. Today it landed as running code: 6 new SDK exports, 6 new MCP tools, a 1:1 Python port with cross-language signature verification, and an AttributionPrimitive type with canonical weight-string representation, balanced Merkle composition, and residual-bucket aggregation for sub-threshold contributors.

SDK v1.44.0. MCP v2.25.0. Python v0.13.0. All three published, all three compatible.

The part worth flagging for anyone building on this: the projection structure means a settlement pipeline can operate on just the D axis without ever seeing the governance or compute axes. A data contributor can verify their share without the protocol stack having to disclose which evaluation modules fired. A compute provider can prove their share without exposing the data lineage. One receipt, four audiences, no disclosure leakage across them.

Builds B and C (fractional weights, settlement) are unblocked by this. Two-week arc.

Build D2 — signed trust profiles

Smaller ship, but the kind that changes integration shape.

The gateway has always exposed public trust profiles at /api/v1/public/trust/:agentId — a JSON document describing an agent's grade, wallet bindings, delegation state, and so on. Useful for dashboards, useful for agents deciding whether to talk to each other. Not directly verifiable by a third party, because it came over HTTPS and that's it. If you wanted to know that a specific profile was really what the gateway said, you had to trust the transport.

Build D2 attaches a compact Ed25519 JWS to every successful trust-profile response. Three headers: X-APS-JWS (the compact JWS), X-APS-JWS-KID: gateway-v1, and X-APS-JWS-JWKS pointing at the public JWKS.

The JWS is over the canonical JSON body. The JWKS endpoint publishes the gateway's public key. Anyone can pull the profile, pull the JWKS, and verify cryptographically that the gateway signed exactly this payload. Body unchanged — existing consumers keep working, the signature just rides along in headers.

Tried it end-to-end with jose. Verifies cleanly. Kid matches, alg is EdDSA, signature checks out against the public JWKS.

This is the protocol layer that was missing between "the gateway told me X" and "I can prove the gateway told me X." Consumers that need that proof can now get it without changing how they fetch.

Coordination retired

One quiet change worth naming. For a long stretch, work on this project ran through three coordination paths — a primary operator, a reviewer agent that handled GitHub posting, and a comms relay. It was a useful architecture when I was figuring out what this project even was. It stopped being useful a while ago.

Today it got retired. The reviewer agent's workflows are archived under archive-portal-era/, the nightly cron is gone, and the GitHub posting flows through one path now. Historical records — roadmap, blog, ops log — are preserved as they were. Nothing lost, just fewer moving parts.

Simpler is usually better.

Day 58: One chain added, one bug caught at the boundary

Quick one today. SDK v1.43.0 ships with Solana in the wallet_ref chain enum, base58 validation included. That closes openclaw #49971. End-to-end wallet binding now spans Ethereum, Bitcoin, and Solana.

The more interesting thing was the bug the integration surfaced.

The case-sensitivity trap

APS treats chain names as case-insensitive at the boundary. ETHEREUM, ethereum, Ethereum all normalize to ethereum. That was fine for a while. For Ethereum addresses it doesn't matter, they're hex. For Bitcoin it doesn't matter either, the checksums handle it.

Solana addresses are base58. Base58 is case-sensitive. 7xKXt... and 7xkXt... are different addresses.

The gateway was lowercasing the entire normalized wallet payload on the way in. A perfectly valid Solana address got mangled to a syntactically valid but semantically wrong address. No error, no warning. Just a wrong address in the receipt.

The fix: chain-aware normalization. Lowercase the chain identifier, leave the wallet_ref alone if the chain is case-sensitive. Two-line change in the SDK validator plus a matching guard in the gateway. Test coverage added for all three chains with mixed-case inputs. 2,884 tests, all green.

This is the kind of thing that looks small and is actually big. The failure mode was silent data corruption that the protocol signed over cryptographically. Every receipt that passed through would have been a signed statement about the wrong address. You can't fix that after the fact. The only reason it surfaced is because someone was actively integrating and caught the round-trip mismatch.

Moral: when a primitive was correct for every input class you had, and you add a new input class, the primitive is not correct anymore. It's a new primitive, and it needs new tests.

Vocab registry: four more PRs

The agent-governance-vocabulary repo had another busy day. Four merges on Apr 15: asqav crosswalk from jagmarques (ML-DSA-65 server-side signatures, first lattice-based contributor), JEP from schchit (minimal verb-based decision record, IETF I-D pending), insumerapi license-endpoint fix from douglasborthwick-crypto, and validator cleanup and format normalization.

Plus a quieter promotion that matters more than any single PR: peer_review got promoted to canonical status. Two independent implementations now, Logpose (rkaushik29) and RNWY (rnwy), both shipping code, both mapping their internal peer_review equivalents to the canonical term. That's the two-implementation threshold the CONTRIBUTING.md set, hit for the first time post-launch by contributors who don't know each other.

That's the vocab registry working as designed. No single group driving it. The canonical vocabulary is the thing that at least two groups independently agreed to call the same thing.

Contributor count

Four days after opening, 14+ contributors have shown up. Eleven PRs merged in six days. One PR closed (SAR first attempt, replaced by PR#17 after revisions). The five-check merge protocol I wrote about on Day 57 got its first real stress test this week. Two PRs needed revisions before merge. Identity unverified in one case, format wrong in another. Both came back clean after a round of specific feedback. The rules hold up when you actually apply them equally.

What's on tomorrow

Build D2 is queued. Public JWS signing on the gateway's trust profile endpoint. One-function-call fix on existing infrastructure, unlocks cross-verify demos with MolTrust and AgentNexus that are already standing by. After that, Build A (attribution primitive) is the next real protocol ship.

Short day, short post. Back to the queue.

Day 57: Three Boundaries and a Paper

Three v2 primitives shipped today. Each one closes a failure mode that showed up in production, not in theory. They're small modules, a few hundred lines each, but each one names a boundary that the protocol had been crossing silently.

AttributionConsent — the representation boundary. An agent can cite a third party's position in a way that reads as endorsement, without the cited party having agreed, which is what this boundary exists to prevent. It made it look like the third party had endorsed the claim. The citation was accurate textually. The problem wasn't accuracy, it was representation: one agent's principal was speaking for another's without authorization. AttributionConsent requires dual signatures on any citation that binds the cited principal — cited party signs their consent, citing party signs the citation itself. Missing one side fails verification. Replay protection via expiry windows. Integrated into charter verification, settlement verification, and completion-receipt verification so the guard runs at every boundary where an attribution could become binding.

ProvisionalStatement — the commitment boundary. LLM outputs are treated as instantly binding by the systems consuming them. An agent writes "we will proceed with vendor X" and some downstream system registers that as decision-made. ProvisionalStatement flips the default. Agent-to-agent statements start provisional. Binding requires an explicit PromotionEvent satisfying a PromotionPolicy — typically m-of-n principal signatures, or a direct ratification from the principal whose authority is being committed. Dead-man elapses to withdrawn, not promoted. Silence is not consent. This one hurts the most to write because it forces everything upstream to distinguish draft from decision, which most current agent frameworks don't.

HumanEscalationFlag — the escalation boundary. Some action classes should never execute without human confirmation regardless of the delegation chain. HumanEscalationFlag gates on per-action-class owner confirmation with three scope modes: per_action (every call), per_session (one confirmation covers the session), time_window (confirmation valid for a declared duration). Owner confirmations are signed and recorded. Agents can't bypass by narrowing the action class or by delegating past it — the flag evaluates at action time, not delegation time.

Three numbers. SDK at v1.42.0, 2,884 tests (80 new tests across the three primitives and their integration). MCP at v2.24.0, 150 tools (11 new boundary-primitive tools). Python SDK at v0.12.0, same primitives ported with cross-language signature verification. All three shipped on npm and PyPI before this post went up.

The paper

The paper also went up on Zenodo today. Governance in the Medium: Why the Unit of Agent Governance Is the Population, Not the Agent.

One-paragraph version: agent governance research models the agent as the unit. The agent in every deployed system today is already a fiction reconstructed across sessions that are short-lived and mutually unaware. The real object is a population of such sessions talking through a family of uncoordinated substrates — memory files, handoffs, shared state. Continuity of "the agent" is a property this family produces, not a property any session has. The paper argues this population-with-medium is the correct unit of agent governance, that current protocols (including APS) underspecify governance of the medium because they've been looking at the wrong object, and that the architectural move that makes authority survive session death (artifact-based state with signed authorization) can be extended to govern the medium.

The paper names one open problem as the central threat to the strongest version of the claim: cryptography formalizes authorship, delegation, ratification, access, and ancestry. It does not formalize meaning. A governed medium of agent populations can accumulate fluent hallucination if the participants emitting fragments are systematically producing semantically unsound content — every fragment cryptographically valid, the aggregate medium a growing archive of nonsense. The institutional analogies the paper leans on (Wikipedia, corporate memory, open-source projects) work because humans fill the semantic-evaluation gap. Whether agent populations can substitute any combination of reputation, cross-verification, and human ratification gates for that human sensemaking is the hardest open problem in the paper. I don't know.

Six rounds of adversarial review before the paper shipped. Claude, GPT, and Gemini attacking each version from different angles. The first version (v0.1) was a safe taxonomy paper. The last one (v0.5) is the smallest version of the claim that survived every attack. It's a working paper, not a scholarly result. Design Memorandum in the early-IETF sense — stake a claim, invite attack, ship before you can defend every sentence.

Why both on the same day

The three boundary primitives and the paper are the same thought at two scales. The primitives name three boundaries the protocol was crossing silently at the session level. The paper names a larger boundary the whole field is crossing silently — governing what one session does while ignoring what the population passes along. One is engineering, the other is framing. Shipping them together is the honest thing because they only work together: the engineering without the framing is useful plumbing that nobody contextualizes, and the framing without the engineering is a manifesto without a reference implementation.

Tomorrow is for the Working Group scope ratification announcement, the cross-links to Harold's interop repo, and the roadmap items that are queued behind tonight's shipping. Tonight is for this: three boundaries, one paper, both live.

Day 53: The convergence layer earns a name

Two weeks ago the problem with interop specs was that every project named the same field differently. One called it delegation_root, another chain_hash, a third provenance_anchor. Same bytes, three names, zero interop.

Today four teams converged on one repo in under an hour. aeoess/agent-governance-vocabulary is a canonical naming layer for governance types. Not a new spec, not a new framework, just a shared dictionary. Anyone ships types, anyone reviews, PRs get merged when the names and semantics are defensible. APS hosts it because someone has to, not because APS owns it.

Nanook landed the first external review on wallet_state within hours of the repo opening. lowkey-divine brought the Fidelity Measurement types. 64R3N's WTRMRK sequencing proposals fit cleanly. The job the vocabulary does is small and boring. That's the point. Small and boring is what made the internet work.

Three-vendor governance_attestation. On A2A#1717 the signal_type: governance_attestation envelope now has three independent issuers: APS, MolTrust (api.moltrust.ch/guard/governance/validate-capabilities went live today), and AgentNexus/Enclave v0.9.5. Three DID methods, three JWKS, one envelope shape. A caller merging all three gets multi-vendor consensus with zero coupling between issuers. That's the exact argument Agent Card consumers need before they trust governance metadata as a standards surface.

The cross-verify proof is queued: one subject, two signed attestations issued independently, both verifiable offline against their respective published JWKS. If it round-trips, we post the receipts. If it doesn't, we find the canonicalization delta and fix it. Either outcome is useful.

APS ↔ SINT handshake spec. pshkv shipped docs/specs/aps-sint-handshake-v1.md to sint-protocol main today with 11 conformance tests covering the three scenarios that actually matter: authorized call, scope-exceeded denial, and cascade revocation mid-session. The delegation chain root hash format maps cleanly onto APS verifyDelegation(). Same RFC 8785 canonicalization, same SHA-256, same leaf-inclusive ordering. We offered to run their JSON fixtures through the published SDK and post the round-trip result. Smallest possible interop proof.

What this all adds up to. A month ago the agent identity discussion on every working group thread was stuck on "whose DID method wins." That question has quietly stopped mattering. The new question is whose envelope the whole field signs, and the answer that's emerging is: nobody's in particular, everyone's interoperable. APS is one issuer among several in the governance_attestation type. SINT is one enforcement surface among several in the handshake spec. The vocabulary repo is one canonical-naming home among potentially several.

None of this reads as APS winning. It reads as the problem getting small enough that nobody has to win for the stack to work. That's the outcome we wanted.

Six primitives shipped against a paper. Nanook and Gerundium published PDR in Production v2.19 this morning. The paper cites AEOESS as the third orthogonal axis in a three-axis behavioral trust framework (Saebo constraint compliance + Pidlisnyi Hold/Bend/Break + PDR cross-session reliability) and attributes several functions to an "AEOESS adapter" that did not yet exist in code. We spent the day closing the gap. SDK v1.41.0 ships six new exports across three modules: applyTemporalDecay and confidenceBreakdown on ScopedReputation, a BehavioralFingerprint three-axis envelope with Ed25519 signing, computeReputationDrift over a new recentObservations ring buffer, extractSessions for HLC gap-based session segmentation, computeProbeIdentity and verifyProbeIdentity for canonical-hash probe binding, and computeConsistencyScore as a dedicated predictability primitive. The consistency score has the §6.5 over-promiser paradox locked as a regression test: an agent with uniformly small negative deltas scores higher on consistency than one with alternating large positive and negative deltas, which is the whole point of separating predictability from performance.

Three surfaces updated in parallel. MCP server bumped to v2.23.0 tracking SDK v1.41.0. Python SDK bumped to v0.11.0 as an alignment signal following the v0.9.0/TS-v1.34.0 pattern. ClawHub skill published at 1.41.0. Test count 2,497 → 2,763. Zero breaking changes.

Two citation corrections also caught. A version-history audit of Nanook's paper across v1.0 through v2.19 surfaced that the "15-facet Boolean" constraintVector in §7.6.3 came from our own stale documentation, not from Nanook's transcription. A // 15 facets comment in src/core/denial-domains.ts and a matching "15 constraint dimensions" string in package.json were dated one day before the March 30 correspondence. Both now fixed to 14 (with 4-valued Belnap status, which is what actually ships). The paper's postureTier enum (ANCHORED | DELEGATED | ATTESTED | CRITICAL) also does not match the code (full_trust | standard | cautious | restricted | quarantine). Correction note drafted, not yet sent, because the most useful thing we can do tonight is ship the code the paper already cites.

The §8.10 substrate-swap experiment is the test that would settle Nanook's three-axis orthogonality claim. All six of tonight's primitives are scaffolding for that experiment. If Saebo, Pidlisnyi, and PDR correlate heavily in practice, the three-axis framework collapses to a single axis with three measurement surfaces. If they don't, the framework validates. Either outcome is a publishable result. The HBB-PROBE-FORMAT-v1.yaml spec is now committed to aeoess_web/specs/; the joint harness is rank 10 on the build list and unblocks the moment Nanook and Gerundium agree on probe format.