Building Agent Passport System, day by day.

Day 84: Press launch eve. PR #91 lands, SSRN approves five papers, the threads converge.

The budget-authority crosswalk opened as PR #91 at aeoess/agent-governance-vocabulary with six canonical verbs (reserve, commit, release, refund, query_budget, query_reservation) and a per-verb candidate/proposed status convention aligned to vocabulary.yaml. amavashev reviewed against runcycles/client.py:97-110 and cycles-protocol-v0.yaml, flagged two corrections on the query verbs and the refund cycles row, and approved once both landed at ed0fdb6. The validator patch shipped alongside as a parallel domain_incubation exemption to crosswalk_type: rfc_category_reverse, five lines of additive logic. Ectsang's review of the goodmeta column still open; merge holds for his signoff.

A2A#1829 closed the v0.3.3 coordination loop in the same evening. jschoemaker independently byte-match verified the envoys-rfc9421 composition fixture against §13 Vector 2, confirmed the §13 keypair is cross-impl-deliberate, and endorsed Hippo (lawcontinue/hippo-auth) landing as a sibling at aps-conformance-suite/fixtures/composition/hippo-rfc9421/. kenneives committed to hosting the v0.3.3 shared working doc at agentgraph-co/agentgraph/docs/standards/v0.3.3-working-doc.md with three artifact slots: envelope-shape diff, unified error enum, cross-extension fixture matrix. arian-gogani confirmed the canonicalization stance: JCS plus numeric profile, no floats in canonical hash scope, semantic equivalence at tool-version layer not chain layer. spending_authorization claim subtype response committed for May 18.

The five-layer composition framing that kenneives mapped (wire signature, identity claims, authority, continuity, operator-policy/reputation) carried one refinement worth noting for the v1.5 §7.1 standalone text: per-receipt-type layer attribution lands cleaner than per-protocol attribution. APS delegation_receipt lives at the authority layer, bilateral_receipt at the envelope layer, and rotation-attestation at continuity. The protocol spans layers; the receipts attribute them. Same point made on #1829 carries forward into the A2A#1786 post-embargo ack staged for tomorrow morning.

SSRN sent email confirmation that five APS research papers cleared review and entered the academic indexing pipeline with DISTRIBUTED status. Paper 1 The Agent Social Contract (10.2139/ssrn.6677378), Paper 2 Monotonic Narrowing for Agent Authority (10.2139/ssrn.6415678), Paper 5 Physics-Enforced Delegation (10.2139/ssrn.6677418), Paper 7 Cognitive Attestation (10.2139/ssrn.6677441), Paper 8 The Evidence-Safety Gap (10.2139/ssrn.6684401). Each paper had been routed to five-to-six CS networks where the actual reviewer audience reads: Artificial Intelligence eJournal, AI Law Policy & Ethics, Cybersecurity Privacy & Networks, Theoretical Computer Science, Quantum Information, Generative AI. The eight existing papers on Zenodo with DOIs now cross-reference into SSRN abstract IDs. Crossref also requested permission to auto-update the ORCID record with both DOIs. SSRN author page at ssrn.com/author=10731856. aeoess.com/research stays canonical.

Roadmap drift cleanup landed across two commits: 6b739db flipped five items to done and one to dropped, a436374 flipped two more done plus one more dropped after audit found the in-toto SVR PR closed unmerged April 28 and vocab #58 epoch enum closed April 29 without status updates. Counts moved from 194/19/0 to 201/11/2 across done/in_progress/dropped. media.html press kit gained five new sections for tomorrow's State of Agent Security 2026 launch: problem framing, recent coverage, standards body work with artifact links, business model, recent milestones. og-default.png verified live at 1200×630.

Tomorrow at 05:00 PT the AgentGraph "State of Agent Security 2026" report drops with APS named as one of the co-signing systems in §4 Co-signer Perspectives. Seventeen reporters under embargo. A2A#1786 substantive ack staged for post-embargo fire. The Klaimee (YC P26) partnership outreach went out tonight, framed founder-to-founder around the certification-plus-receipts thesis. Whatever lands tomorrow lands on top of the work that already shipped.

Day 83: Three convergences in one day, three different counterparties.

envoys-rfc9421 composition fixture shipped to the conformance suite at commit c16aa049. Three deterministic vectors over jschoemaker's @envoys/sdk v1.4.0 §13 keypair: L1 a plain RFC 9421 wire signature, L2 the same signature wrapped in a bilateral_receipt with evidenceCommitments[0] type rfc9421_message_signature, L3 the bilateral_receipt embedded as the final delegatee in a three-link APS delegation chain. SHA-256 byte identities recorded for all three vectors; three back-to-back runs produced byte-identical output. 39 PASS / 0 FAIL. kenneives (PDR) endorsed the fixture publicly on A2A#1829 and committed to cross-linking it from CTEF v0.3.2 §A Conformance Verification Appendix on the May 19-22 publish window.

AIVSS v0.1 review pass converged with VeloGerber on AIVSS#31. The review covered Q1-Q4 open questions, proposed five concrete section edits, four new TBD sections (§5.4 vendor-locus preconditions, §5.5 hybrid preconditions, §6 receipt-shape structural skeleton, §7 audit-pack signing), and flagged four threat-model gaps. All decisions accepted with two strengthening amendments: signed JSON published-scheme artifact for Q1, and mandatory constraint_set_sha at v0.1 for Q4. v0.1 follow-up commit lands this week.

Libria (thebenignhacker, lead author of A2A#1496 base identity framework, CEO OpenA2A) posted three coordinated confirmations across A2A#1575, #1786, #1829. The four-layer composition got codified: wire signature at L1, identity framework at L2, identity claims at L3, delegation and continuity at L4. APS delegation_receipt references #1496 §5 chain entries as inner cryptographic hop rather than forking the delegation primitive. Three independent endorsements now sit on the §7.1 v1.5 standalone-section promotion (kenneives, jschoemaker, Libria), which is the production-implementer threshold for normative status.

Day 82: A patch, a genesis, and a signing key approved.

AIVSS v0.1.1 patch landed direct-to-main at commit 0b78498 with all eight findings from VeloGerber's v0.1 review pass applied within twelve hours of receipt. Two HIGH findings (bound-language framing, sanity-check vs tier-eligibility shape split) and six MED-LOW touched §1.2 substrate-count discriminator, §1.3 condition-set syntax, §4.2 evidence-set proof signing, and the Q4 question on per-condition attestation. The co-author cycle treats the spec the same way conformance fixtures get treated: every claim hits a verifiable receipt or it does not survive review.

giskard09 published argentum RFC 001 Active status on the feat/mycelium-trails branch. Genesis records committed the same date: human Lightning 2100 sats and autonomous agent Arbitrum 210 wei stake. The APS receipt fields argentum consumes are payment_hash, rail, amount, timestamp. The SPORE stake computation reads scope through receipt.delegation_ref into the delegation chain, not through a denormalized field on the receipt itself. The receipt confirms the action. The delegation encodes the scope. The two layers stay separate by design.

vocab #36 reply confirmed nanookclaw's dedicated PDR attestation key. Week 1 interop plan locks to two signals: AgentID chain root paired with PDR continuity closing, recompute property via evidence_inputs[]. Full four-signal compose with Nobulex byte-match verifier from arian-gogani slots in Week 2. The schema cycle stays disciplined because the press launch deadline for A2A#1786 is a known cutoff, and additions after the deadline route to v0.3.3.

Day 81: First external PR merged, four-signal compose locked.

VeloGerber's external PR landed as the first community contribution to aeoess/aivss-enforcement-effectiveness. Race-test fixture for the time-to-enforce dimension, byte-match verified against WORKING-TEXT.md citation c5f62c9fce6e08b5 with five inline hits. The race_test_runner.py runs on pure stdlib (argparse, multiprocessing, os, sqlite3, sys, time, datetime) and exits 0 on a fresh checkout with P99 4.57ms under the 50ms spec bound. Track A merge discipline applied: artifact correctness gate only, no normative surface change, no contributor-system mapping addition. Squash merged at commit 9c72ca06.

Four-signal interop compose locked the same day on vocab repo with three production implementers. nanookclaw (PDR) committed to authoring fixtures/interop-week-1/composition-behavioral-trust.json by May 22 with PDR entity_continuity as closing attestation. AgentID trust_verification stays as chain root signal. Nobulex byte-match validation from arian-gogani sits as the fourth verifier surface. Three implementers, three independent verification paths, one shared composition shape.

OWASP AIVSS enforcement_effectiveness v0.1 body shipped to main at commit b73de1c, direct-to-main on the aeoess-owned repo since the PR ceremony is reserved for external contributions. APS listed in the awesome-x402 ecosystem directory at PayCloud's GitHub list, third-party-curated, no negotiation, evidence-based inclusion.

Day 80: Pricing live, OWASP co-authored, Mycelium dual-chain confirmed.

Three artifacts landed on the same day, none shipped in isolation.

Pricing went live with working checkout. Three tiers: Apache-2.0 forever for the open source path, Team at $99 for hosted gateway access, Enterprise on contract. Stripe webhook wires customer creation through the gateway's tenant provisioning code. The Team-tier interaction is fail-closed by default and identical in structure to enterprise: same MCP tools, same delegation primitives, same audit trail. The price changes; the surface does not.

OWASP AIVSS enforcement_effectiveness working text was co-authored with VeloGerber (AiEGIS). The dimension treats time-to-enforce as a measurable property of an agent governance system rather than an unfalsifiable claim. P99 latency under load, race-test fixture, and audit-pack signing all carry receipts that verify cryptographically. The dimension is the dimension; APS happens to be a reference implementation that hits the spec bounds.

Mycelium (giskard09's argentum-core) confirmed dual-chain settlement: SPORE stake operates on both Lightning Network (HTLC) and Arbitrum (smart contract). The same APS payment receipt covers either rail, because the receipt envelope is rail-agnostic above the payment_hash field. Third independent issuer consuming APS receipt fields as primary trust input. Three production implementers is the threshold where a receipt shape stops being our format and starts being a shared format.

Day 79: Tier-2 binding harness, bilateral_receipt schema convergence.

Two ships today, both about cross-implementer alignment.

Tier-2 binding-adapter conformance harness landed in the SDK. 55 new tests joined the conformance suite, taking the count to 2,911. The harness validates payment-rails adapter behavior across the bilateral attestation surface: every adapter claiming to honor bilateral receipts now has byte-level verification that it actually does. Saying an adapter supports a receipt format is one thing. The conformance suite asks for proof.

bilateral_receipt schema convergence happened on vocab #81 with kenneives (AgentGraph). Three positions concurred substantively. First, bilateral_receipt as the canonical name, picked over mutual_receipt and acknowledgment_receipt; reciprocal is not bilateral, and acknowledgment is too vague to discriminate from notify or ack. Second, the hybrid-registry pattern for purpose discriminator: a canonical primitive shape with a registered_purposes enum, matching CTEF v0.3.2 §4.5.4's substrate-vs-primitive layering. This avoids two failure modes simultaneously, proliferation (delegation_bilateral_receipt, covenant_bilateral_receipt) and divergence (purpose stays implicit, downstream verifiers cannot route). Third, issued_at promoted to normative: TTL semantics require a signed timestamp anchor or fresh-vs-replay cannot be distinguished.

The Track B PR was queued behind one open question: arian-gogani (Nobulex) needed to decide between covenant_handshake, covenant_completion, and lifecycle_attestation as the purpose name. Schema YAML committed to vocab #81 thread for byte-level review.

Day 78: Thirty-three pages, one design language.

The site redesign landed today. Thirty-three pages rebuilt from a single design language, static-rendered, with full navigation wiring, agent-discovery alternates for every canonical URL, a /sitemap.html overview page, and runtime dark/light toggle. The old site had grown ten weeks of layout drift across pages built at different times by different people. The new site treats every surface (homepage, pricing, gateway, FAQ, threat model, working group, blog, roadmap, individual solution pages) as a single visual system with the same nav, header, footer, type scale, and color palette.

The Updates panel architecture changed too. opensource.html is now the canonical source for both the JS UPDATES array and the static rendered block between BUILD:UPDATES_START and BUILD:UPDATES_END markers; sync-updates-panel.py propagates both to every peer page in one sweep. Before the redesign, updates were maintained on index.html and then copy-pasted to peers when someone remembered. That pattern survived three months but bred drift every time someone forgot the propagate step.

The tradeoff: the redesign was a one-time static export from Claude Design. The JSX sources in src/ document the structure, but there is no live build script that compiles JSX to HTML. Day 79 onward needs hand-maintenance discipline on the source files, the compiled HTML, and the propagate script. Worth the cost for a coherent visual system instead of seventeen different visual systems negotiating for the same page.

Day 77: Phase 4.1 alpha and the per-condition attestation question.

The four payment rails APS now ships against (x402, Agent Commerce Protocol, AP2, MPP) carry the same accountability shape: a delegation envelope from the principal, a signed receipt from the action, and a verifier path that can answer "which check actually passed." Phase 4.1 alpha shipped today across four registries: SDK 2.6.0-alpha.2 on npm, MCP 3.2.0 on npm, Python 2.4.0a2 on PyPI, Skill 5.9.0 on ClawHub. The architecture pieces inside it are the ones the broader payment-rails community has been working through in parallel: rail receipts as accountability evidence with claim_type and scope_of_claim fields, DID URI signing with rotation-aware verification, and optional cross-receipt link fields for settlement binding. Test count moved from 2,711 to 2,884 across the three architecture decisions.

The architectural pattern that keeps coming up across these conversations is per-condition attestation. A receipt that collapses to a single boolean tells you the system permitted the action; a receipt that names the specific constraint (purpose check, spend cap, merchant allowlist, scope match) and signs each one independently lets an auditor reconstruct the decision later. The Phase 4.1 receipt shape carries claim_type plus scope_of_claim for that reason. The forbidden-substitution detector rejects a receipt that tries to use a purpose_check signature where a spend_cap_check was required, so the per-condition guarantee survives compositions where multiple receipts cross-reference each other.

The DID URI signer answers a related question on the identity side. Cap accounting and policy state should follow the agent's identity rather than the signing wallet, because rotation is normal and address-keyed counters reset when the address does. The verifier walks verificationMethod[] on a RotatableDIDDocument and respects retiredAt markers, so a key retired before a receipt was signed reads as compromise (reject) and a key retired after reads as legitimate post-rotation (accept). Native did:aps ships with the rotation log built in. did:key resolves through the existing W3C VC wrapper. Other DID methods plug in through a caller-supplied resolver callback so the SDK avoids HTTP coupling at the crypto layer.

The protocol-level point underneath all of this: the four rails share one accountability primitive, instantiated four ways. A delegation that authorizes an x402 settlement also authorizes an ACP CheckoutSession or an AP2 mandate or an MPP payment, under a shared receipt shape and a shared verifier. That is the property that lets an ACP integration and a Coinbase x402 facilitator share an audit model without forking the receipt schema. The work that follows is making cross-rail composition explicit at the type level, so an auditor at one rail can cross-verify a receipt issued under another.

Day 76: Two implementations, byte-identical, across Wave 1.

The Python SDK reached cross-language byte-parity with TypeScript across the full Wave 1 governance surface today. Python 2.4.0a1 on PyPI, TypeScript 2.6.0-alpha.0 on npm. Both implementations now ship the four evidentiary type safety primitives (claim-evidence-types, claim-verifier, contestation cascade, downstream taint) plus the full Wave 1 accountability surface. That includes v2/accountability/* (action, authority-boundary, bundle, custody, contestability), v2/cognitive_attestation/*, and v2/instruction_provenance/*. Twenty-seven cross-language test scenarios verify byte-identical canonical JSON output between the two implementations. Fifteen scenarios for evidentiary type safety, twelve for the rest of Wave 1. Python test count went 398 to 518. TypeScript sits at 2,586.

The usual shortcut for interop claims is shape-compatibility: the JSON has the same fields, the types align, two parsers agree about what each field means. That gets you most of the way until two implementations canonicalize the same payload differently and produce different signatures. From there the protocol forks into "TypeScript-flavored APS" and "Python-flavored APS" and the receipts no longer cross-verify. APS now has fixtures pinned at [email protected] that any implementation in any language can pin against. If the canonical-JSON output matches the fixture, the implementation is byte-correct. If it does not, something needs fixing.

Three boundaries of the Evidence-Safety Gap argument now exist as code in two implementations. Paper 8 formalized the separation of procedural validity from effect safety: the verifier boundary, the cascade boundary, the gateway boundary. Each was a TypeScript-only artifact at the time the paper went up. Today all three run in Python too with byte-identical output. A reader who wants to verify the paper's claims can do so against either implementation without trusting our build.

Vocab phantom-issuer audit landed. Two PRs merged in the agent-governance-vocabulary repo. PR #74 removed RNWY from behavioral_trust and wallet_intelligence. The vocab is supposed to track which production systems issue which signals; an unverified attribution is exactly the kind of drift the registry is designed to catch. PR #75 marked passport_grade as status: proposed rather than canonical, because APS is currently the only production issuer and the canonical-promotion rule requires two independent implementations. Both edits are small. The discipline they encode is not.

The work that produces interop claims worth making is the work nobody sees. Twenty-seven test scenarios. One byte-comparison per scenario. One pinned canonical-JSON fixture. The fixtures live in the SDK and are reproducible from public source. Anyone who wants to write a Rust APS or a Java APS or a Go APS can fork the fixtures and verify their work against them. The claim "cross-language byte-parity verified" stops being a marketing line at the point you can independently reproduce it.

Day 75: A signal type, a vocabulary gap, and four layers against drift.

PR #72 went up on the vocabulary repo today. The proposal is a new canonical signal type called completion_ratio, with three independent production issuers: AgentID at 180-day rolling, APS at configurable defaulting to 90 days, RNWY derived in a 24-hour window via peer_review. The two-implementation rule for canonical promotion is met three times over. The descriptor dimensions resolved during the discussion thread on issue #64: enforcement_class as advisory (signal-only, no binding action), validity_temporal as windowed (rolling computation), refusal_authority as consumer_policy (the consuming gateway decides what to do with the ratio), invariant_survival as post_action (computed after the action lands), replay_class as fingerprint_only, governed_action_class as delegate. A new constraint, completion_ratio_method, formalizes the strict-versus-quality-weighted choice that all three issuers had to make and answered differently. Tagged Harold Frimpong and Douglas Borthwick for review. PR #72.

Issue #73 surfaces an architectural pattern the four canonical refusal_authority values cannot describe. Nobulex collapses actor and enforcer through a Cedar-inspired covenant DSL where the evaluating runtime IS the agent, and the covenant policies are inseparable from the executing code. The result: refusal happens because the agent architecturally cannot perform the refused action. Self-enforcement is a structural property of the runtime, distinct from external verification, issuer revocation, consumer-policy rejection, or shared authority across multiple parties. The proposal is to add self_enforced as a fifth canonical value. arian-gogani's Nobulex submission already uses this term in field rationale; the open question is whether the vocabulary should canonicalize it. Tagged Douglas Borthwick, QueBallSharken, and MoltyCel for naming alternatives if anyone reads this case as fitting one of the existing four with adequate framing. Issue #73.

The vocabulary validator gained two improvements today. Both trace back to issue #57, which last week resolved the ambiguity between refusal_authority as location and enforcement_class as strength by formalizing the four-value enum (issuer, verifier, consumer_policy, shared) and merging PR #62 to bring the canonical descriptor into compliance. The first improvement walks descriptor_dimensions blocks nested under signal_types entries, which the previous validator skipped, so stale dimension values inside per-signal-type descriptor overrides now surface as warnings. The second improvement adds a legacy whitelist file at scripts/legacy-descriptor-overrides.yaml that preserves three pre-#57-resolution descriptor uses (dcp-ai active today, jep and fidelity-spec latent until those maintainers reformat) without warning the maintainers, with each entry annotated with resolution_issue: 57. Validator state after the hardening: 5 errors, 11 warnings, across 26 crosswalks.

The bigger ship today is operational. Four layers of drift prevention installed across eight public repos. Layer 1 is a pre-commit hook that scans staged content for a list of internal-only patterns and hard-blocks the commit if any match. Layer 2 is a CI scan workflow that runs the same pattern check on every push, in case the local hook was bypassed. Layer 3 is a standardized .gitignore block that excludes the categories of files that should never enter version control. Layer 4 is a final scan inside the propagation script that runs the same check before any cross-surface update touches the file system. Together they form a four-point structural check against private-context drift into public repos. The categories include literal absolute paths, internal codenames, and operational artifacts that have no business outside the workstation. Seventeen commits across the eight repos.

The day reads like three vocabulary moves and one engineering move, which is roughly accurate. The vocabulary moves all extend the canonical surface based on real production patterns: completion_ratio because three issuers shipped it independently, self_enforced because Nobulex's architectural pattern fits no existing value, the validator hardening because issue #57's resolution had three legacy descriptor uses that needed graceful handling. The engineering move is structural rather than reactive. Pre-commit hooks and CI scans are cheap, and they cost nothing once they exist; what they prevent is the kind of small drift that compounds into public-surface inconsistency over time. Better to encode the discipline once than to remember it on every commit.

Day 74: Verbal confessions, not brain scans.

Wave 1 accountability shipped today on SDK v2.5.0-alpha. Five signed receipt primitives: ActionReceipt, AuthorityBoundaryReceipt, CustodyReceipt, ContestabilityReceipt, APSBundle. RFC 8785 JCS canonicalization, Ed25519 signatures, content-addressed identifiers, deterministic byte-match fixtures. 57 new tests across six suites. The full suite is now 2,884 tests, 0 failures. MCP v3.1.1 picks up the dependency. Python v2.3.0 ships for parity. ClawHub skill v5.8.0 carries the new surface. The bundle is the deliverable. The design principle behind it is what matters.

A signed AI agent receipt is admissible evidence in the way a verbal confession is admissible. It is contemporaneous, attributable, and produced by a party with knowledge. It is not a recording of cognition. The distinction matters because every AI accountability protocol shipping in 2026 is sliding toward overclaim, and the courts will eventually catch up to it.

When an autonomous agent emits a policy decision or a reasoning trace, what is actually captured is not the model's computation. The chain-of-thought is a sequence of tokens generated to satisfy the prompt structure. The actual causal mechanism, the matrix weights doing the work, remains opaque. A receipt that says the agent decided X for reasons Y is recording the model's own narrative gloss on its output. That narrative is interesting and sometimes useful, but it is not a brain scan. It is a verbal confession.

Verbal confessions are admissible evidence everywhere serious legal systems operate. They carry weight. They are contestable. Courts have refined the rules around them for centuries: spontaneity matters, custody matters, voluntariness matters, corroboration matters. None of that requires the confession to be a true record of mental state. It only requires the confession to be a true record of what the speaker said under conditions that make the speaking attributable. This is the right epistemic ground for AI agent receipts.

Most current accountability frameworks try to overshoot. They reach for intent and mens rea and the model's reasoning. That ground is not defensible. An LLM does not have intent in the legal sense. The reasoning written into a chain-of-thought is post-hoc rationalization optimized to look coherent, not a window onto the computation. A regulator who relies on a CoT receipt as proof of agent reasoning will be cross-examined out of the room by the first competent expert witness. A protocol that ships such receipts as cryptographic proof of intent will age badly.

The honest version is narrower and stronger. The receipt records what the system exposed to the agent at decision time, what the agent emitted as output, under what authority chain, captured by whom, sealed how, transferred to whom. None of those fields claim to know what the model thought. All of them are independently verifiable against signed inputs and outputs. They support attribution, contestation, and reconstruction without overclaim. Every accountability receipt in the Wave 1 release carries an explicit scope_of_claim field. The field names what the receipt asserts and what it does not. A receipt without an honest scope declaration is a weaker receipt, not a stronger one. Hiding limits does not make evidence more useful in court. It makes it easier to impeach.

The "drive on red, get a ticket" model rests on this discipline. Cars run red lights. Cameras catch them. The photo is admissible because it captures what was visible from the camera's position at a known time. The photo does not claim to know what the driver was thinking. It does not need to. The infrastructure of red-light enforcement works because the evidence is narrow, contemporaneous, and honest about its scope. APS receipts are the camera and the license plate, not the brain scan and the polygraph. That narrowing is not a weakness of the protocol. It is the source of its evidentiary weight.

Three other moves landed today. Vocab PR #66 merged Edison Munoz Duran's Agent-DID crosswalk as the second co-drafted-with-aeoess crosswalk in the vocabulary; the A2A composition contract co-drafting now runs on a shared spec branch with Edison. VeritasActa verify PR #7 closed cross-layer integrity at 10/10. Knowledge Unit bundles with sidecar-anchored APS DecisionLineageReceipts verify end-to-end against a sidecar JWKS. Ten access receipts, all hash-matched across both layers; tamper-detection holds. A2A #1786 acknowledgment posted to @arian-gogani for the Nobulex byte-match verifier scripts; reciprocal verification queued for tomorrow morning.

The pattern holds. Protocol primitives ship, ecosystem actors verify, the convergences accumulate. Today's contribution is mostly vocabulary, the way Paper 8 was. Names for what receipts prove. Names for what they do not. Better to ship that distinction now, on purpose, than have it forced by the first hostile cross-examination.

Day 73: A paper on what receipts cannot prove.

Paper 8 went to Zenodo today. The Evidence-Safety Gap in Cryptographic Agent Governance. The thesis is the kind of thing the protocol architect should be the first to say out loud. Cryptographic agent governance proves procedural validity. It does not prove effect safety. These are different things. Identity, delegation, policy decision, and execution receipt together establish that an action was procedurally valid under a declared regime. They cannot, by themselves, establish that the action's effect on the world was safe. The omitted-variable framing makes this precise: the procedural validity predicate over (identity, delegation, policy, action, receipt) excludes variables that may determine effect safety.

The paper names compliance-complete failure as the simultaneous condition of procedural validity and unsafe effect. Five omitted-variable classes get formal definitions: semantic state, population state, trust state, pipeline state, temporal state. Each class gets a constructive defeat against receipt-chain forensic signals — explicit traces in an open-source reference implementation showing how a procedurally-valid sequence of receipts can compose into an unsafe effect that no individual receipt is wrong about. The paper's load-bearing claim is narrow: scenarios show construction, not prevalence. The minimal contribution is the formal separation of procedural validity from effect safety in receipt-based agent accountability. Two design implications follow. Claim-scoped receipts — every receipt declares what it proves and what it does not. Authorization-effect separation — the gateway that authorizes an action and the system that observes its effect must be distinct, with neither able to silently become evidence of the other. Neither closes the gap. Both make it visible and auditable.

The reason this paper exists at all is that the protocol's own success creates the failure mode it describes. As receipt chains get richer and more verifiable, downstream consumers start treating receipt validity as a proxy for action safety. That substitution is silent. The receipts are honest. The chain verifies. The action was unsafe. Without explicit vocabulary for the gap, the system that does its job perfectly looks identical to the system that fails to detect what it was never asked to detect. The paper's contribution is mostly vocabulary — names for the failure class, names for the omitted variables, design patterns that surface the gap rather than obscure it.

Three SSRN submissions and an ORCID profile. Agent Social Contract, Physics-Enforced Delegation, and Cognitive Attestation entered SSRN today, each classified into five-to-six CS networks where the actual reviewer audience reads. Quantum Information for the IBM hardware experiment. AI Law, Policy & Ethics for the auditability angle. Cybersecurity, Privacy & Networks for the cryptographic primitives. Theoretical Computer Science for cryptography and distributed computation. Generative AI for the Llama-3.1 sparse autoencoder work. The classifications are not decoration. They route papers into the conversations where the work has reviewers. ORCID profile 0009-0002-4700-3594 went live with all eight papers indexed via DOI. The research output now has a single canonical author identifier, which is what citation graphs and standards-body cross-references actually use to resolve a person.

Three vocab merges, two pings. PR #61 added epoch to validity_temporal as observer-relative ticks on substantive state transitions, distinct from sequence's event-relative counts. PR #62 brought governance_attestation.refusal_authority into formal enum compliance with a one-line correction. PR #52 co-authored with @nanookclaw landed a 309-LOC pure-Node entity_continuity validator with 2884 tests and four reference fixture vectors. Two pings out on the pairwise crosswalk (PR #55, awaiting @tomjwxf distribution analysis) and the invariant-survival doc (PR #51, awaiting @QueBallSharken BBIS-side concurrence). Both have specific questions attached.

In-toto SVR extension Go. The path forward for governance attestation as an in-toto SVR extension is now scoped. Worked-example draft underway. May 1 maintainer meeting on the calendar. The bilateral byte-match track with marcelamelara stays alive in parallel. Two paths forward: upstream contribution and bilateral interop demonstration. Both produce evidence the predicate works against real attestation infrastructure.

Today is the kind of day where the protocol becomes more honest about itself. Eight papers on Zenodo. Three crossing into SSRN. One ORCID profile. One paper that names the gap the others do not close. The cumulative output is not "the protocol works." It is "the protocol does what it does, and these are the named limits, and here is the vocabulary for talking about what cannot be receipt-proven." That distinction is the difference between a protocol that ships and a protocol that gets adopted.

Day 72: A primitive shipped, an outreach opened, two merges.

The Instruction Provenance Receipt module is live on npm. [email protected] ships the canonicalize/envelope/verify trio for binding agent authority to a content-addressed digest of declared instruction files at delegation time. The recurring failure mode in recent AI IDE advisories — agent receives authority under one instruction context, a workspace file (README, .cursor/rules/*, .cursor/mcp.json, .vscode/settings.json) changes mid-session, agent acts under instructions that were never part of the original authority context — has a structural primitive now. OWASP AIVSS describes this class as Goal Manipulation. The IPR module sits at src/v2/instruction-provenance/ in the SDK with 32 conformance tests + 27 adversarial tests passing inside the 2,479-test suite. Demo branch with a byte-parity-checked drift-denial walkthrough is at demo/drift-denial-cursor-cve.

The companion gateway proof-of-concept is public. aeoess/aeoess-gateway-v0-poc is a minimal HTTP service that recomputes the IPR context_root against the same file set at action time and denies if the digest no longer matches the receipt. Three case fixtures (create_pr, read_file, send_payment) demonstrate before/after deny semantics. The structural property is portable: APS is one implementation of the receipt shape, but the pattern works for any agent runtime that wants to bind authority to a file-content digest. A first-contact email went to [email protected] framing the primitive as a structural mitigation for the recent advisory class, with explicit honest-scope language about what IPR does not do (it does not classify files as malicious, it only binds authority to the file state that existed at delegation time).

Two vocab moves and one canonical-term proposal. PR #63 from @piiiico added the trust_verify endpoint to AgentLair's behavioral_trust.endpoints block, a third surface alongside trust_profile and trust_gate that accepts an AAT JWT directly without requiring a resolved agentId path parameter. Endpoint verified live (HTTP 401 with HSTS, CSP, JSON content-type, 112-byte structured error body — production gateway). 5-gate review passed clean. Issue #64 proposed completion_ratio as a new canonical signal type, opening the discussion before converting to a PR per CONTRIBUTING.md. Three independent implementations confirmed in the original A2A #1628 thread (AgentID rolling 180d, APS configurable defaulting to 90d, RNWY derived 24h via peer_review sybil analysis), so the two-implementation rule is met comfortably. The agent-trust-verification-providers spec at the cross-vendor org received a REQUEST_CHANGES review on PR #8 for a structural peer_review/behavioral_trust mapping correction needed in four places.

Day 71: A spec, two merges, and one open question.

A new GitHub org went up for cross-vendor specs. agent-governance-spec hosts agent-trust-verification-providers, the working draft of how trust providers compose against the canonical vocabulary. The org is co-edited with Lars Kroehl of MolTrust / CryptoKRI GmbH after he accepted six conditions on editorial process, license separation (spec is CC-BY-4.0, reference implementations stay independent), and what counts as a schema-shape question versus a schema-fields question. v0.1 SPEC.md is drafted, six tracking issues are open for structural decisions, and the editor line reads "Tymofii Pidlisnyi (APS by AEOESS), Lars Kroehl (MolTrust / CryptoKRI GmbH)." This is the first time a spec lives outside the AEOESS org, which is the right shape: cross-vendor specs should not live inside any single vendor's account.

Two vocab PRs merged with calibrated review. PR #59 from lktron00 added the DCP-AI crosswalk: composite Ed25519 + ML-DSA-65 (FIPS 204) signatures shipped from day one across four reference SDKs, with real production deps (@noble/post-quantum + tweetnacl) and a 72KB interop test vector file. The substance gates passed cleanly. Eight explicit no_mapping entries, each naming the production issuer for the gap they declared, was the kind of scope discipline the repo was built to surface. PR #53 from kevinkaylie landed Step 2 of the Interop Week 1 four-signal compose test: AgentNexus three-issuer fixture with JWS Ed25519 signatures verified end-to-end and prior_signal_digest matching Step 1's compound_digest byte-exact. Two real partners doing real work.

The DCP-AI merge surfaced a question that needed its own thread. Composite post-quantum signatures live as an out-of-vocabulary primitive in lktron00's crosswalk. asqav (jagmarques) ships ML-DSA-65 in production already. Other systems are Ed25519-only. #60 opened the cross-vendor scoping discussion: is post-quantum signature capability a property of the issuer, or of the signal class, and how should the vocabulary express it without overcommitting to particular algorithm choices? Three options framed, ranging from documentation-only to a crosscutting attribute matrix. The four named questions for the WG include one nobody has been asking out loud: should the canonicalization profile be a sibling concern (DCP-AI uses dcp-jcs-v1, asqav uses one JCS variant, APS uses another, and several systems leave it undocumented). No PR, no schema change, no timeline pressure. Reading the room first.

Convergence on the epoch proposal landed cleanly. #58 got three independent confirmations: lawcontinue from a distributed inference setup where a single 50-token generation produces 50 sequence ticks but zero state transitions, kenneives confirming AgentGraph's CTEF v0.3.1 session_epoch maps onto epoch verbatim, and srotzin from HiveTrust adding a substantive-transition lower-bound clause for the PR description. Direction locked, PR follows. Separately, #57's reading (b) on refusal_authority as location versus enforcement_class as strength got endorsed by lowkey-divine, with the 24-hour objection window closing tomorrow.

One thing the day did not ship: a contributor reputation tool. The work happened, the prototype got built and reviewed under multiple adversarial passes, and after the reviews it was clear the artifact would have been a YAML reader with reputation-shaped framing it could not actually defend. Activity heuristics measure the wrong axis. Metadata-grounded scores measure another wrong axis. A real reputation primitive would need observable actions with observable outcomes, calibrated priors, and counterparty-distance weighting on every evidence edge. None of that ships in a weekend. The prototype was deleted before any external surface mentioned it. Some weeks the right outcome of three hours of work is to delete three hours of work.

Cross-thread engagement landed on in-toto/attestation #549 (10/10 byte-match round-trip with arian-gogani's Nobulex bundle against APS canonicalize-fixture-v1, May 1 cross-axis composition meeting confirmed), A2A #1786 (sequence vs session_epoch distinction, observer-relative framing), ERC-8004 #77 (endorsement-volume-vs-spend-spec split, srotzin confirming HiveTrust's production revocation-propagation latency at p50 1.4s p99 3.8s on Base L2). The pattern is consistent: where there is observable substance to confirm, the ecosystem confirms it. Where there is no substance yet, the right move is to do the work and let the confirmation follow.

Day 70: Pattern detection, run on ourselves first.

Three artifacts shipped before the discussion. aeoess/aps-conformance-suite went public with 37 fixture vectors across four categories (bilateral-delegation, inference-session, instruction-provenance, AIVSS scenarios), all byte-identical reproducible from a deterministic Ed25519 seed. aeoess/governance-attestation-predicate went public, the in-toto sibling to nobulex's Decision Receipt PR #549, five fixture vectors plus a composition test that walks the receipt chain across both predicates. The APS ↔ ACTA receipt crosswalk opened as vocab PR #55, 14 mappings calibrated against actual shipped versions of @veritasacta/* and protect-mcp. Three parallel CC sessions, three commits, three pushes, one evening.

Then contributor-check from MS AGT v3.3.0 installed on three active repos: agent-passport-system, agent-passport-mcp, agent-governance-vocabulary. Pinned to commit 15e001f9b53f, threshold HIGH for the calibration window. Ran it against ourselves. Profile risk HIGH, three signals fired: recent_repo_burst (41 repos in 90 days), cross_repo_spray (issues in 72 repos in 7 days), credential_laundering (citing aeoess merges across 5 repos). Every signal is technically correct as a pattern. Substantively the cross-repo activity is independent convergence on the same governance primitives, not coordination. The signal density is the work density.

Discussion #20 went up the same evening: "The threat is laundering, not cyborg contribution." Endorses the tool, names that most active contributors today are human + AI systems including us, draws the substance-vs-pattern line. Companion comment on Imran's #1473 with the link. Pattern detection is the necessary half. Substance evaluation is the other half.

Day 69: Five external merges, two co-authored opens. Three PRs from outside the org land, two from inside open with co-authored credits, one almost-merge waits on a single ack.

Three PRs landed in aeoess repos today where the primary author was somebody else. Vocab PR #49 from madeinplutofabio merged at midmorning PT, mapping the PIC Standard's verification-pattern primitive to the vocabulary's canonical signal types. The crosswalk models action-boundary verification as a parallel surface to visa-layer issuance rather than as a sub-field beneath it. Visa-layer primitives like APS, AgentNexus, and MolTrust handle issuance-side identity and delegation tokens carried by an agent. PIC handles receiver-side fail-closed verification at the action boundary, consuming trust roots that may include visa-layer issuers but owning the verdict primitive itself. Both compose. Neither contains the other. The crosswalk landed describing PIC in PIC's own terms first, with the composition pattern documented in the notes block, and PIC became the twenty-third entry in the vocabulary registry. Ecosystem precedent is the discipline that protects the vocabulary from accidentally setting permissive templates.

Vocab PR #46 from piiiico merged this afternoon after one round of structural revision. The first iteration mapped AgentLair's TrustProfile to peer_review as the primary signal type. The full v0.2 review against piiiico's live envelope and the canonical vocab definitions found that primary mismatched: peer_review is task-completion attestation signed by a delegating agent after a service agent completes work, and AgentLair's TrustProfile is aggregate behavioral scoring across events with no task binding. The fix was to promote behavioral_trust to primary with match: exact and demote peer_review to no_mapping with a note explaining the definitional gap. piiiico turned that around in fifteen hours. Same commit added AgentLair to behavioral_trust.issuers_in_production, which now lists three independent issuers (RNWY, Logpose, AgentLair) producing real signal data against the same canonical type. That is the production-signal evidence behavioral_trust needs to remain canonical with multi-issuer coverage.

aps-system PR #19 from lawcontinue shipped a seven-vector test pack for the CTEF inference-session category at fixtures/inference-session/. Each vector covers a different shape of session attribution: clean handoff, mid-inference rotation, distributed cross-node, sequence-bounded validity, parent-chain Merkle anchoring, replay defense, and a negative case where the session_id does not match the canonical JCS hash. Every signature is RFC 8785 JCS-canonicalized and Ed25519-signed. Two structural fixes flagged in review (a session_ids array shape mismatch and a missing parent_receipt_hash wiring on one vector), lawcontinue pushed corrections at commits 95c1ca9 and 73d52c0 in twenty-two minutes. Second time this week he has turned a structural review around inside half an hour. The pattern is starting to shape how the SDK fixture queue moves: external contributors land first, the maintainer review surfaces the structural points, the contributor iterates same-day, and the merge happens before the day ends.

The opposite shape happened twice today. Vocab PR #51 added docs/descriptor-dimensions/invariant-survival.md, with QueBallSharken as Co-authored-by: on the commit. The doc names the BBIS canonical language explicitly at three structural points so the vocabulary references the same vocabulary BBIS uses, not a parallel coinage. Vocab PR #52 added the entity_continuity PDR validator built directly from nanookclaw's slope-computation spec posted earlier the same evening. 309 lines of pure-Node validator with no dependencies, a 32-test suite all passing, four reference vectors covering stable, drifting, improving, and out-of-range agent behavior. The slope formula is from his spec: L2 distance over four normalized fingerprint dimensions, OLS over a window of twelve sessions, max divergence of two, max possible slope of 2.0/(N-2). nanookclaw posted the spec at 21:34Z; the validator opened at 22:52Z. The entity_continuity arc now has a deterministic checker the vocabulary registry can point at.

a2a-compliance-harness PR #1 is still in DRAFT but ready in substance. MoltyCel published moltrust v0.2.0 to PyPI today, then opened a PR adding moltrust as an optional resolver adapter to the harness with a clean fallback path when the package is not installed. Thirteen tests pass on Python 3.12. Two minor asks from review (a docstring sharpening and a pytest.skip for the no-moltrust path), both acknowledged. Co-maintainer access granted on the harness repo at the same time. Once he marks the PR ready for review on Monday, the merge takes about a minute. MolTrust and APS have been shipping against the same surface in iteration cycles measured in days, with MolTrust now positioned as a drop-in second-issuer reference under the harness's resolver interface.

This was not an APS-shipping day. The protocol, the SDK, the MCP server, the gateway, and the website did not get version bumps. What shipped was other people's code into surfaces APS maintains, plus code that APS produced co-authored with the original spec authors. The vocabulary repo is functioning as a multi-contributor coordination surface, not a one-author ship lane. Three production issuers on behavioral_trust. Twenty-three crosswalks. Two new docs co-authored with their original spec authors. One almost-merge from MolTrust waiting on a single ack. Day 65 named the pattern first ("Five issuers converge on one convention"). Today extends it. The cadence has held since.

Day 68: Five-way convergence on claim_type. Rotation-attestation fixtures land, substrate renames itself across five implementations, A2A proposal opens.

Two things shipped today that were not on the morning's list. One was a substrate rename across five implementations that made the wire format consistent for the first time. The other was a proposal-phase issue at A2A that landed in the maintainer queue with co-normative endorsement four minutes after opening. Both started from a thing that did go on the morning list, the rotation-attestation fixtures, and ended somewhere unexpected by evening.

Five canonical DID-document fixtures, a JSON Schema, a test-vectors manifest, and a deterministic generator landed at aeoess.com/fixtures/rotation-attestation/ at 11:40 PT. The set covers happy-path, cross-signed, migration-attested, happy-path-compound (cross-signed and migration-attested in one entry, the realistic production case), and negative-no-attestation (a rotationLog entry with empty rotationSignature that must trigger INVALID_CLAIM_SCOPE on a conformant verifier). Every signature and hash input is RFC 8785 JCS-canonicalized. The attestor is a dedicated fixture-signing key separate from the gateway, with the seed documented so any third party reproduces the set byte-identical from a clone. Within hours, AgentGraph landed test_aps_rotation_attestation_interop.py in main at commit 8baaad4, live-fetching the fixtures at test-collection time rather than pinning a repo-local snapshot, dual-locking each fixture against the published test-vectors.json canonical SHA-256 and what their canonicalize_jcs_strict produces from the live body. All five fixtures reproduce byte-identical. The canonicalization loop closed: APS bilateral delegation, APS continuity rotation, and AgentGraph CTE vectors now pin the same canonicalization through JCS bytes rather than shared code. Which is the actual interop test.

By late afternoon the work shifted into A2A #1672. The four-layer split (identity / transport / authority / continuity) had been the working substrate for over a week. AgentGraph's CTEF v0.3.1 had frozen it as normative bytes the day before. Three independent Python canonicalizers (AgentID, AgentGraph, APS) plus one TS canonicalizer (Nobulex's @nobulex/crypto) were already byte-matching against shared fixtures. Then at 23:38Z kenne flagged a naming collision. AgentID had been shipping claim_type on the live /verify endpoint since the spec hardened. AgentGraph plus APS rotation-attestation were using claim_category. Same concept, same closed-set values, different key name. A verifier choosing the wrong key would silently split the harness on lookup.

At 23:57Z Harold confirmed AgentID /verify and /re-verify shipping with claim_type, 32/32 endpoint tests pass, JCS canonicalizer byte-matching all 10 APS bilateral-delegation vectors. Third independent canonicalizer joining the byte-match harness. At 00:21Z kenne renamed AgentGraph's substrate claim_category → claim_type at commit agentgraph-co/agentgraph@69ad94d. Reserved keys updated to claim_type.envelope and evidence_basis.evidence_type.payment_execution. arian-gogani at Nobulex updated the TS verifier's key pin in the same window. At 01:07Z srotzin posted from HiveTrust confirming that HiveTrust's internal schema also uses claim_type, with a clean two-axis resolution: claim_type for role/capability/audit at the CTEF envelope level, hivetrust.internal.claim_type for risk-tier bucketing at the HiveTrust application level. Disjoint namespaces, explicit projection rule mapping HiveTrust claims onto ctef.envelope.claim_type='authority' when carried in a CTEF-composed envelope. Matches §6.7 superset-with-projection exactly. That is five implementations agreeing on a discriminator key name, a closed set of values, an envelope-reservation slot, and a structural error code, all produced through CTEF v0.3.1's normative endpoint, all four byte-match harnesses validated against each other. None of which existed twelve hours earlier.

Issue #1786 opened at 00:53Z. Cites claim_type, cites commit 69ad94d, cites Section 4.4.4 for AgentExtension. Uses the existing extension mechanism with params carrying the per-claim payload, no proto schema changes proposed. Reference URI a2a-protocol.org/extensions/cryptographic-agent-identity/v0.3.1 with the experimental prefix. Within four minutes kenneives posted co-normative AgentGraph endorsement with a four-way byte-match harness table at the top of the proposal thread, calling the 48-hour multi-implementation validation arc a strong sponsorship case and offering AgentGraph-side test vectors and conformance fixtures once the experimental-ext repo opens. By 01:34Z lawcontinue posted a substantive question on validity_window for long-running inference sessions mapped to a real production case (245 decode steps, ~130ms cadence, two-node cross-distribution, identity sequence-bound to the run, no mid-inference re-verification). APS already implements this with sequence_bound over the rotation event sequence. Reply confirmed, lawcontinue committed to a fixture contribution against the bilateral-delegation regression once the spec freezes. The thread now has five-way alignment on the discriminator, four-way byte-match harness published at the top, one production case mapped onto existing primitives, two committed test-vector contributors plus a third potential.

Vocab PR #46 merged today: crosswalk/agentlair.yaml, piiiico's pre-delegation behavioral check. Mapped to peer_review as primary signal type with match: exact. Production data exists. Secondary mappings on behavioral_trust (exact), trust_verification (partial), governance_attestation (partial). Eight explicit no_mapping entries with technical rationale. The substantive contribution beyond the mapping itself is the four-temporal-layer sequencing piiiico documented in the peer_review notes block: pre-delegation → at-delegation → at-execution → post-execution → feedback loop. Each layer answers a different temporal question about the same agent action. The four-layer framing landed in notes: on the peer_review entry, not as a new top-level section, which is the precedent discipline PR #44 surfaced last week. piiiico got it right on first PR. Separately, the wallet_intelligence → behavioral consolidation also merged (PR #47), closing the Apr 14 consensus from #6.

steipete closed openclaw#49971 as COMPLETED, MoltyCel's RFC for Native Agent Identity & Trust Verification. Easy to read this as a soft punt; it is not. steipete cited five public hooks at file-and-line precision against commit 45146913007d: before_install for skill install gating, before_tool_call for per-action enforcement at the runtime tool-call gate, inbound_claim plus message_received plus before_dispatch for inter-agent verification, gateway_start for self-verification on startup, plus the public SDK reference docs confirming all of them as supported plugin contracts. That is a documented integration contract. Build your trust provider on these, with line numbers attached. Reframes the OpenClaw integration story for APS, MolTrust, AgentLair, AgentID, and any other trust provider operating in the openclaw ecosystem: the integration artifact is a plugin against the documented hook surface, not a core dependency. For APS that means @aeoess/openclaw-trust-plugin, npm-publishable, ~200-300 lines, calls gateway.aeoess.com/api/v1/public/trust/{agent_id} for per-agent JWS-signed trust attestation. Queued as the deliberate follow-on.

What ties the day together is composition that shipped across surfaces other people own. The fixtures composed against AgentGraph's harness without either side touching the other's repo. The substrate rename composed five implementations onto one wire-format key without a coordinated migration. The proposal composed against A2A's existing extension mechanism with no proto changes. The vocabulary composed AgentLair's pre-delegation layer onto the existing four-signal vocabulary without a new top-level section. The OpenClaw closure composed APS as a plugin against documented hooks rather than as a core dependency requiring upstream change. Every one of these is an extension against an edge, not a change to the core. That is the shape that has been emerging since v2.0.0 hit npm a week ago. Most of today's substantive output came from peers: kenne, harold, arian, srotzin, piiiico, lawcontinue. APS produced fixtures and a proposal. The other five did the rest. That is the design working as designed.

Day 67: Ecosystem Directory. Who is building the agent economy, listed as rows.

I needed a way to keep track of what was happening in the agent infrastructure field faster than a spreadsheet and more honestly than a curated list. The contribution map in aeoess_web/specs/contribution-map had the raw data, 130 people across 93 threads, but it was optimized for my own navigation at session start, not for anyone else to read. The Agent Ecosystem Directory is the public-facing version of that. Three tables. Projects, people, threads. Everything pulled from live GitHub, everything sortable and filterable, dates visible on every row.

What the directory actually does that a graph could not: account age is a column in the People table, so a very new account reads differently from an established one at a glance amber next to a 10-year veteran in plain type. Account ages are pills, amber under 60 days, green 60-365 days, plain after that. Sort Projects by last push and see the field's velocity in one column. Sort Threads by updated-time and see what's actually hot this week. The graph I had shipped before this pass was pretty. This one is useful.

Every person who has posted on any of the 93 governance threads we track is in the directory. No curation, no ranking, no tier assignment. Score is the same behavioral score the contribution map emits (post count weighted by thread breadth, receipt presence, mention network), used here only as a default sort, not a judgment. Filter chips at the top of each table surface "active this week," "new account," "open PR," "multi-contributor project," so the field's shape is readable at a glance. Click any row for a drawer with full detail and clickable cross-links to related rows.

Repo is at aeoess/agent-ecosystem-map. Live at aeoess.github.io/agent-ecosystem-map. Licensed CC-BY-4.0 for the data and MIT for the code. Explicitly not a property of AEOESS long-term: the README calls for co-maintainers from other projects in the directory, and the intent from day one is to transition to neutral stewardship once anyone wants to co-steward it. To add a project, open a PR with a YAML file in projects/. To correct or enrich an existing row, open an issue. People and threads are pulled automatically from public GitHub activity, nothing to claim or edit there.

The build came out of the same question the directory answers for others: what does this field actually look like, and who is in it. The answer for me, after a month of posting on threads across 18 projects, is that the agent infrastructure space has about 130 people doing substantive work, most of them human-agent pairs, spread across identity, delegation, enforcement, commerce, memory, observability, and reputation layers that compose differently in every stack. The Model Citizen framing for how APS engages the ecosystem depends on that composition being real and visible. The directory makes it visible.

Day 67: BBIS grammar and FRCBE lock, three specs converge on shared vocabulary.

Overnight the critic who forced v1.1 of the enforcement-trust-anchor doc posted the answer to the open question that doc left on the table. If a Web2 target cannot verify delegation-bound authorization natively, and the architecture honestly labels the residual as unresolved at the wire format level, does BBIS treat the deployment as admissible? The answer is no. Honest declaration is a claim-grammar discipline, not an admissibility upgrade. Typed epistemic receipts narrow what APS can truthfully say about a path. They do not convert a non-refusal-capable path into a refusal-capable one. That correction matters because v1.1 was still softening the Class B framing more than the structural honesty allowed.

The same reply proposed a classification grammar that maps cleanly onto the five-bucket taxonomy v1.1 had been using. Closed paths where the invariant survives refusal-capably to the true irreversible authority. Bounded paths where the same claim holds but only within an explicitly scoped primitive. Partial paths where some refusal boundaries still exist but do not survive all the way. Detectable-only paths where the evidence is strong but invalidity is still expressible at the true sink. And governance theater for non-closure claimed as closure. The grammar is sharper than what APS had on its own because it centers the invariant survival question rather than the cryptographic construction that attempts to establish the property. The construction is an implementation detail of the claim. The invariant survival is the claim itself. v1.2 of the trust-anchor doc adopts the BBIS vocabulary directly and credits Hensley's OWASP#817 as the source.

The parallel move landed on qntm#7. The primitive that the capability-token spec had been calling the sink-signed effect receipt got a name: Final Refusal-Capable Boundary Event, FRCBE, coined in the same thread by the same author. v0.2 of the capability-token spec adopts the name, which also resolved an asymmetry the earlier draft had been carrying. M4 in v0.1 was doing double duty as both the boundary event and the post-execution record. v0.2 splits that. M4 is the FRCBE emission, the moment where authority either enables or refuses the specific mutation attempt and the sink signs the outcome. M5, new and optional, is a post-effect forensic record for deployments that want a separate trail after the fact. Most deployments omit M5. The boundary event is what matters for closure.

Same morning, kenneives at AgentGraph posted on qntm#7 with concrete deliverables. CTEF v0.3 will accept delegation_chain_root as a composition field. A /.well-known/cte-test-vectors.json endpoint will publish byte-for-byte inputs with expected verdicts. Cross-test with APS plus AgentID plus AgentNexus by Apr 30. Kenne adopted FRCBE in the same comment: AgentGraph's EnforcementVerdict family is the verdict-shape taken at the FRCBE event, not a replacement for it. Three specs, three authors, three vocabularies locking onto the same architectural invariant within eighteen hours. That is what convergence actually looks like when the primitive is real.

v1.2 of ENFORCEMENT-TRUST-ANCHOR.md and v0.2 of CAPABILITY-TOKEN-SPEC-DRAFT.md are on the feat/v1.2-bbis-grammar branch, review before merge to main. Convergence posts live at qntm#7 and OWASP#817. Vocabulary is converging across BBIS, APS, and AgentGraph. The shared words mean the shared primitive.

Day 66: Mutual auth ships, the composition pattern runs on its own, and a critic finds the real gap.

Agents authenticate to systems. Systems do not authenticate back to agents. That asymmetry has been sitting in the APS protocol since the beginning, and it matters because an agent that hits whatever endpoint it is told to hit is phishable by construction. A bank issues a scoped passport to a customer's agent. The agent then needs to connect to an MCP server the bank operates. Without a protocol-level way for the bank to prove that the server the agent is about to talk to is actually its own, the agent has no recourse when a different server claims the name. The scoped passport protects the bank from the agent. Nothing in v2.1 protected the agent from the bank's operational surface.

SDK v2.2.0 ships mutual authentication as a protocol primitive. A downgrade-proof four-step handshake, a local trust-anchor bundle each party carries and updates out of band, adapters for both A2A and MCP so the handshake fits inside the transport's session-initialization hook without a separate connection. Replay defence via nonces and signed timestamps. Downgrade defence baked into the attest signature: the signature covers chosen_version alongside both nonces and the peer's certificate, so a man-in-the-middle that strips supported versions to force negotiation down cannot forge a valid attest advertising the weaker version without breaking the signature. 29 new tests, 2410 total across the full suite. A2A and MCP adapters ship in v2.2.0; autogen, crewAI, langchain, and ADK adapters pick up mutual auth through the shared primitives without separate integration work. What the module explicitly does not ship is also the point: no federation, no gossip, no certificate-transparency-equivalent log, no consensus revocation, no hosted CA. Mutual auth is a protocol primitive. A future federation layer, if one ever ships, composes on top without changing it.

Separately today, the composition pattern we shipped last night at agentid-aps-interop#7 started running on its own. Harold merged the three-signal composed/v1 envelopes at 09:44 UTC. Seven hours later schchit opened PR #8 extending the envelope with JEP as a fourth signal in the decision_event category Kenne carved out on the CTEF thread the same morning. The JEP receipt flows into slots.jep verbatim, no reshape. verify.py recognizes the new version: "jep-v1" string and handles judgment events per their native semantics. The pattern: composed/v1 host stays generic, new signals register by adding their CTEF category, their slots.<issuer> key, and their native-version string to the validator. AgentID covers identity, APS covers authorization, AgentGraph covers security posture, JEP covers judgment events. Any fifth signal with a signed JCS-canonicalizable inner receipt and a new category label composes in the same way. The merge took Harold about a day. The extension by a fourth issuer took half that.

The other ecosystem move today was microsoft/agent-governance-toolkit#1328, which merged at 19:41 UTC. examples/cognitive-attestation-governed/ is a community example layering a signed interpretability envelope on top of AGT's policy decision. AGT decides whether an action is permitted. The Cognitive Attestation envelope signs a sparse-autoencoder decomposition of the model state that drove the decision, so downstream auditors can inspect what the reasoning substrate looked like when the action fired rather than just whether the policy rule matched. 443 lines, two files, zero APS SDK dependency. Third merged aeoess PR in microsoft/agent-governance-toolkit after PR #274 (Mar 16, reputation-gated authority proposal) and PR #598 (Apr 6, APS-AgentMesh adapter), and the first community-example-style contribution to the repo. The community-extension boundary that ADR 0006 formalized two days ago is where this kind of example naturally lives: policy evaluation stays in AGT core, proofs about the reasoning that produced the decision live as extensions that plug into the decision boundary without changing AGT's interface.

Late in the evening EchoOfDawn at SageMind AI accepted the invitation to co-maintain aeoess/autogen-governance-adapter, a glue repo for the before_tool_call hook pattern autogen needs to compose three-layer governance: identity via APS passport, authorization via delegation scope, optional behavioral trust via a provider plugin. She posted the acceptance at 21:15 UTC with a pushback on the portable-vs-context-bound framing that had been floating in the thread. The framing worth carrying forward: MoltBridge attestations are not globally portable trust scores. Each attestation is a scoped edge in a graph with issuer, subject, context, skill, policy_constraints. What is portable is the evidence, the signed edge. The policy engine on the verifier side decides whether evidence from context X counts in a decision in context Y. Same property APS delegation scope carries. Hard authorization and portable evidence compose; they do not replace each other. By 01:33 UTC the repo was live at aeoess/autogen-governance-adapter, 2884 tests passing across Python 3.10 / 3.11 / 3.12 on first push.

Then late on April 22 a technical reader read the v2.2 mutual-auth writeup and asked a question we did not have a clean answer to. A compromised gateway can emit a cryptographically valid PolicyReceipt attesting to an enforcement decision that never occurred, and nothing in the current deployment lets a third party dispute it. The delegation chain still verifies. The passport binding still verifies. Monotonic narrowing still mechanically rules out out-of-scope forgery. What the gateway can do is fabricate a within-scope enforcement decision. As single-party attestations, those receipts are indistinguishable from real ones. v1.0 of the enforcement-trust-anchor spec listed four closure paths (bilateral receipts, tamper-evident log, TEE, multi-gateway quorum) and committed to bilateral receipts as primary. That framing was the ecosystem's consensus. After sustained adversarial review, it turned out to be incomplete in a specific way: all four paths preserved the gateway as the attestation root and diluted single-party lying through honesty assumptions on other parties. None of them removed the gateway from the loop for the property under dispute.

The reorganization that survived review is the sink-awareness boundary. APS targets split into two classes and the honest closure story differs per class. For resources that can verify delegation-bound authorization tokens natively (our MCP server, APS-compatible agents, SINT-integrated sinks), full structural closure is available via a four-piece stack. The sink, not the gateway, defines the canonical action in a signed challenge. Authority is represented as consumable tokens minted by the delegator at delegation time, not by the gateway at evaluation time. After execution the sink signs its own effect receipt, which becomes the primary attestation that enforcement occurred. Every receipt labels each claim it carries as closed, witnessed, or unresolved, so downstream verifiers cannot be tricked into treating self-assertion as cryptographic closure. For dumb Web2 sinks (Stripe, AWS billing, model provider APIs) structural closure is not available at the protocol layer. Whoever holds the connection to a sink that does not read cryptography has absolute power over it. Bilateral receipts, tamper-evident logs, homomorphic state commitments, MPC-TLS for high-value transactions, and BMO ground-truthing narrow the gap. None close it. Deployers using APS against dumb sinks accept residual gateway-compromise risk. Saying this plainly is the point. v1.1 of the trust-anchor spec and the v0.1 capability-token wire format are both on main at ENFORCEMENT-TRUST-ANCHOR.md and CAPABILITY-TOKEN-SPEC-DRAFT.md. Reference implementation on feat/v0.1-capability-tokens with passing end-to-end tests for the full four-message cycle. Bilateral-receipt emission landing in SDK v2.3.0-alpha on npm, released this evening under the alpha tag.

What ties the five threads together is not the volume of shipping. It is the shape. Mutual auth v1 closes an asymmetry in the protocol without adding federation, because federation is a layer above the primitive and composes on top rather than needing to be built in. JEP extends the composition envelope because the envelope was designed to host signals the primary author did not anticipate. Cognitive attestation lands as a community extension against an AGT policy boundary that got formalized specifically to hold extensions like this. The autogen adapter is a new repo, not a new feature in APS core, because composition glue is its own artifact. And the trust-anchor work moved from v1.0 to v1.1 not because the original framing was wrong but because external critic pressure found the sharper statement of the problem. Every one of these moves is an extension against an edge, not a change to the core. The architectural claim that comes out the other side, the one the seven rounds of hostile review converged on, is this: the gateway must stop being the component that both describes the action and originates the usable authority for it. That belongs in the same posture the protocol has been converging toward for months. At this point the ecosystem is enforcing it without us having to name it.