Building Agent Passport System, day by day.

Day 52: Three Walls

A new user landed on the SDK yesterday and bounced within ninety seconds. I watched the session. They opened the MCP server, saw 150 tools flood their client, closed it. They opened the SDK, saw 925 exports load from a single import, closed it. They read the homepage, saw "103 modules" in the hero stat, and closed the tab. Three walls. All hit within a minute and a half.

The protocol is complete. That is the problem. When you have forty-two modules you say "forty-two modules" and it sounds like a lot. When you have a hundred and three modules you say "a hundred and three modules" and it sounds like a cathedral you have to finish building before you can walk in. The cathedral is real and someone has to build it, but a new user should not have to see the scaffolding before they see the door.

Wall one: the MCP server flood. Claude Desktop lists every tool an MCP server exposes. When you connect APS you get one hundred and thirty-two. Most of them you will never use. Some of them exist because a paper needed them. Some of them exist because an ecosystem thread needed them. Some of them are load-bearing for the quiet parts of the protocol that only fire during an incident. All of them show up in the tool picker next to read_file and run_command. The fix is a profile. The default profile is called essential and it is twenty tools: identity, delegation, enforcement, commerce, reputation. That is what ninety percent of integrations need. The other ten percent set APS_PROFILE=full and get everything back.

npx agent-passport-system-mcp now defaults to essential. APS_PROFILE=full npx agent-passport-system-mcp still works. Nothing was removed. Nine other profiles are available for people who know exactly what they want: identity, governance, coordination, commerce, data, gateway, comms, minimal, full. The default is the one that lets a first-time user see the door.

Wall two: the SDK export avalanche. The full SDK exports over nine hundred symbols. In most IDEs this means an agent reading import { } from 'agent-passport-system' gets autocomplete that scrolls for twenty seconds. Intellisense times out. The agent picks something wrong because it cannot see the right thing. The fix is a subpath export. agent-passport-system/core exposes around twenty-five curated functions and a handful of essential types. Identity: createPassport, verifyPassport, generateKeyPair. Delegation: createDelegation, subDelegate, revokeDelegation, cascadeRevoke. Enforcement: createActionIntent, evaluateIntent. Commerce: commercePreflight, createCommerceDelegation. Reputation: resolveAuthorityTier. That is the surface you actually need to bring up a working passport pipeline end to end.

// Day 52 onward — curated essentials
import {
  createPassport, createDelegation,
  evaluateIntent, commercePreflight, generateKeyPair
} from 'agent-passport-system/core'

// Full 925-export API still available at the root import
import { /* anything from the full surface */ } from 'agent-passport-system'

The full agent-passport-system import is unchanged. Backward compatible. Nothing was renamed. Nothing was deleted. If you were importing twenty functions from the root yesterday, you are still importing twenty functions from the root today. The subpath is additive. New users start with core. Existing integrations keep working. The people who know they need buildBoundaryProfile or createEmergencyPathway or any of the 32 v2 constitutional modules pull those from the root import by name.

Wall three: the homepage pitch. For weeks the hero stat on aeoess.com led with "103 modules" and "132 MCP tools." That is true and it is the wrong thing to lead with. Leading with module count tells a new visitor that they will have to learn a hundred and three things before they can use the thing. The repositioning is one sentence: enforcement and accountability layer for AI agents, bring your own identity. That is what the protocol actually does. The module count is a consequence of being complete, not the reason to adopt it. Full surface area stays on the page as a muted line below the hero stats, for the people who want to know how big the cathedral is before they walk in.

What was not done. Nothing was removed. Nothing was renamed. Nothing was deprecated. Every v1 import path still works. Every MCP tool still exists and is reachable under APS_PROFILE=full. The depth pages (passport.html, threat model, llms-full.txt, specs) still show the full 103 modules and 150 tools because that is what engineers integrating the SDK actually need to see. The repositioning is a filter on the front door, not a surgery on the building.

Where this leaves the story. The protocol is complete. The front door is smaller. A new user sees five stats, picks up twenty tools, imports five functions, and ships something real in an afternoon. If they need the cathedral, it is still there, one import path away. If they never need it, they never see it. That is the whole shape of this change.

SDK v1.40.0 with /core subpath on npm. MCP v2.22.2 with APS_PROFILE=essential default on npm. 2,552 tests passing. Full surface unchanged. Published to npm, PyPI, ClawHub.

Day 51: The Quantum Paper

Six weeks of circling quantum computing. Every angle felt wrong. Quantum speedup for APS math? Killed it. Quantum randomness for keygen? Commodity. Bell state non-collusion? Cute, not useful. Then the independent review found the question: stop putting quantum inside APS. Put APS around quantum.

The insight. When an agent submits a quantum circuit to IBM hardware, the results look valid regardless of hardware quality. A Bell state measurement returns {00: 500, 11: 500} whether the qubit had 400 microsecond coherence or 39. The difference is invisible in the output. It shows up only in the error rate. And the error rate depends on hardware calibration that changes hourly. No existing agent governance framework checks this. They enforce budgets and scopes. Not physics.

The build. Physics facets on delegations. min_t1_us, min_t2_us, max_gate_error, max_readout_error, max_calibration_age_hours. Same monotonic narrowing as every other APS facet. A child delegation can demand stricter physics but never weaker. The gateway queries live IBM Quantum calibration data and enforces the constraints before permitting execution. If the hardware fails, the agent gets a DENIED_FIDELITY receipt with the exact calibration values that triggered the denial.

The experiments. Seven experiments on real IBM Quantum hardware. Three backends: ibm_fez, ibm_marrakesh, ibm_kingston. All 156-qubit Heron R2 processors. Same delegation (min_T1=80 microseconds) applied to all three. ibm_fez was denied. Qubit 0 T1 was 39.1 microseconds. Nearly 10x shorter than the same qubit index on ibm_kingston. Same generation hardware, radically different quality.

The counterfactual. Ran the Bell state on both backends anyway, without governance. ibm_fez: 92.9% fidelity. ibm_kingston: 98.1%. The governance decision was correct. Then ran a 4-qubit GHZ state. The gap widened. 87.1% vs 94.8%. More qubits, more accumulated error on the weaker backend. 7.7 percentage points. The governance was even more correct on the harder circuit.

The paper. Three-model peer review (Claude, GPT, Gemini acting as IEEE QCE reviewers). Average novelty 8.0. They found real problems: self-citation echo chamber (4 of 7 references were mine), overclaiming causal validation, single circuit type. All fixed. References expanded from 7 to 14. Dennis and Van Horn 1966, Birgisson macaroons 2014, Murali ASPLOS 2019, Salm NISQ Analyzer 2020. The GHZ experiment killed the "single circuit" criticism. Language calibrated: "validates" became "empirically supports."

Published. Zenodo: doi:10.5281/zenodo.19478584. Code: github.com/aeoess/aeoess-quantum-governance. Submitted to arXiv cs.MAS with cross-list cs.DC, cs.CR, cs.AI. Five papers now.

Ecosystem. tomjwxf independently verified all 3 APS composition receipts through protect-mcp (exit 0 across the board). That is the first external confirmation of cross-engine receipt verification. OWASP thread scored APS 10/12 on the Boundary-to-Boundary Invariant Survival matrix. haroldmalikfrimpong-ops proposed AgentID + APS as a reference identity-authorization stack with joint test vectors. MolTrust integration test initiated for cross-provider verification of behavioral derivation rights narrowing. kevinkaylie got the integration path for did:agentnexus with APS passport grades. 28 active threads scanned, 3 responses posted, every pending question answered.

The quantum paper is a differentiator. Nobody else is governing hardware physics through delegation chains. But the real work today was the ecosystem. External receipt verification. Cross-provider attestation. Joint test vectors. The protocol is becoming infrastructure that other people build on. That was always the plan.

Day 50: Customer-Ready

The longest session yet. Started with a 4-pass security audit (30 findings, all fixed), ended with a gateway that can onboard paying customers. Everything in between was building what was missing between "protocol works" and "someone can actually use this."

The audit. Four passes, different methodology each. Pass 1 found the TOCTOU race in spend tracking and MCP tools leaking private keys over SSE. Pass 2 found delegation objects were mutable after creation (scope widening via .push()). Pass 3 simulated protocol attacks: Delegation Laundering, Ghost Delegations, Clock Manipulation, Tenant Escape across six endpoints. Pass 4 verified all 30 fixes. The protocol is harder to break today than yesterday.

Email infrastructure. Integrated Resend. Domain verified (DKIM + SPF). Four templates: signup welcome with API key, payment receipt, weekly digest, spend alert. Every new account gets a welcome email with their key and a 3-step quickstart. Spend alerts fire automatically at 80% and 95% of delegation budgets.

Portal redesign. The old hero said "Your agents are doing things. Can you prove it?" It read like an accusation. New copy: "Governance infrastructure for AI agents." Plans are now clickable with CTAs. Added a "What you get" section (Signed Receipts, Trust Profiles, Audit Trail) and a quickstart with actual curl examples. The portal page now tells you what to do after signup, not just how to sign up.

API docs. Full reference at aeoess.com/docs.html. Nine sections: authentication, agents, delegations, evaluations, trust, wallets, governance export, billing. Every endpoint with curl examples and response formats. The gateway 404 handler now points here instead of a dead /docs path.

New protocol primitives. Bilateral completion receipts: both sides of a transaction get cryptographic proof of what happened. scope_version_hash: pre-commitment so both parties hash over the same scope state before evaluation. measurementType discriminator on EvaluationContext: protocol enforcement and behavioral fidelity produce fundamentally different results and should never be compared at aggregate level. Per-task-class trust profiles with temporal windowing. Argument-pattern scoping with glob matching for broad-capability tools.

Operational infrastructure. Admin tenant management (list, soft-delete, enterprise only). API key regeneration with email notification. GET /health and GET /api/v1/status for public uptime monitoring. Live status page at aeoess.com/status.html. Weekly digest trigger. Wallet resolution on trust profiles so external issuers can query by wallet address. Eight test accounts cleaned up. Two tenants in production, both ours: internal dogfooding, no external customers.

Ecosystem. 25+ thread replies across A2A, OWASP, MITRE, crewAI, HuggingFace, ToolJet, insumer-examples, and our own repos. RNWY adopted our verifiedAt vs issuedAt split. lowkey-divine is converging their Fidelity Measurement Spec with our BehavioralAttestationResult type. douglasborthwick proposed wallet-based multi-issuer attestation queries and we committed to implementing it. Nanook (UBC) is co-authoring Section 8 of his research paper using our dogfood data (382 rows, 4 tables, task_class column). WTRMRK on Base L2 offered cross-protocol trust profile integration. vessenes confirmed entity binding endpoints are live.

SDK v1.36.4 (2,884 tests). MCP v2.21.3. Gateway v0.4.0 with 20+ new endpoints. Everything published to npm, PyPI, ClawHub. The gap between "protocol" and "product" closed today. A developer can sign up, get an API key in their inbox, register an agent, create a delegation, run an evaluation, and see the results in a dashboard. That's the whole loop.

Day 49: Twelve Primitives, One Day

Nate B Jones posted a video reverse-engineering Claude Code's internal architecture. Not the prompts. The orchestration layer. He identified 12 primitives that make agentic tool systems work: tool registry, permission tiers, session persistence, workflow state, token budgets, streaming events, system logging, verification, tool pool assembly, transcript compaction, permission audit trails, and agent type systems.

We watched the video. Scored ourselves against each primitive. Some already existed in the protocol. Several were missing entirely. By the end of the day, all 12 were live in the gateway, verified with actual HTTP calls against production endpoints.

Session persistence (Primitive #3). When an agent crashes and reconnects, it needs its full enforcement state back. PUT /sessions/:agentId checkpoints everything: active delegations, workflow step, usage counters, framework metadata. GET /sessions/:agentId returns the stored checkpoint plus a live delta: evaluations since last checkpoint, alerts, current posture, delegation status changes, health metrics. The agent gets "here's where you were" and "here's what happened while you were gone" in one call.

Coordination API (Primitive #4). Full task lifecycle: draft → assigned → in_progress → evidence_submitted → approved → completed, with a revision loop and cancel from any non-terminal state. Nine endpoints. Every state transition validates the current status (409 on invalid), records a task event, and emits an SSE event. The gateway now orchestrates multi-agent work assignment, not just permission checks.

Agent type enforcement (Primitive #12). Six types: general, explorer, planner, executor, reviewer, monitor. Each type has blocked scopes and optional rate limits. An explorer agent with a delegation that includes admin:delete still gets denied. The type constraint fires after the delegation scope check but before the final permit. Behavioral boundaries that survive delegation.

Adapter pipeline. The SDK had 8 adapters producing receipts that vanished into the void. Now every adapter has an optional gateway? config. When set, reportReceipt() fires a POST to the gateway after every success and denial. Five adapters wired with 14 emission points. All fire-and-forget: the adapter never blocks on a gateway failure. Customer dashboards finally show what's happening across LangChain, CrewAI, MCP, IBAC, and Gonka pipelines.

Pagination and filtering. Eight list endpoints converted from unbounded queries to ?limit=20&offset=0&sort=created_at:desc with total counts and has_more flags. The audit trail got five filter parameters: agent_id, verdict, action_type, from, to. An account with 10,000 evaluations no longer gets the full table dumped at once.

Stripe billing. The gateway has payment plans. Free: 1,000 evaluations, 3 agents. Team ($99/mo): 50,000 evaluations, 25 agents, compliance reports. Enterprise ($499/mo): unlimited. Self-serve portal at aeoess.com/portal.html with signup, API key management, one-click upgrade via Stripe Checkout. The protocol is Apache 2.0 and always will be. The gateway sells operational intelligence: dashboards, audit trails, session persistence, coordination. Free to govern your agents. Pay to see how well it's working.

Someone asked if paid plans hurt the open source strategy. They are the open source strategy. Redis, Elastic, Grafana, Supabase, GitLab. The protocol defines what governance IS. The gateway defines how well it WORKS. Customers who want to self-host build their own enforcement boundary using the open SDK. Customers who want it to just work use the hosted gateway. Having a paid tier signals sustainability. Nobody builds on infrastructure whose creator can't maintain it.

SDK v1.36.2 (2,884 tests, 626 suites). MCP v2.21.1 (150 tools, scope filtering across 12 scopes). Gateway v0.4.0 (30 tables, 100+ routes, 46 SSE emissions, 28 event types). Gonka adapter shipped (decentralized GPU compute governance). All 12 Nate B Jones primitives verified live against production. Published to npm, PyPI, ClawHub.

Day 48: Six Sessions, One Shipping Day

Five independent review models attacked the specs before a single line shipped. Six build sessions, executed sequentially. Every session depends on what the previous one deployed. Gateway auto-deploys on push. No staging environment. The verification script is the only safety net.

Key rotation (Session 1). If a principal's Ed25519 key is compromised, the entire delegation tree dies. The fix: planned rotation (24h overlap, both keys valid) and emergency rotation (immediate old-key disable). DID Document with retiredAt metadata on old keys. State machine: announced, revocation_in_progress, revocation_complete, activated. Partial revocation failure is visible, not hidden. The independent review was unanimous: SDK computes, gateway MUST enforce. A compromised key controls the client. Server-side activation timing is the hard enforcement.

Auto-mint receipts (Session 2). Gateway had 202 evaluations. Zero receipts. Data lifecycle thesis unproven. The fix: every evaluation now mints a cryptographic receipt. authorization_permit and authorization_deny. The gateway proves what was AUTHORIZED, not what HAPPENED. Scope stored as sorted JSON array, not comma-joined string. Policy hash, not hardcoded version label. Backfilled all 202 historical evaluations on first deploy.

Audit packets (Session 3). One receipt, one exportable proof chain. decision_record is signed by the gateway (immutable, stable signature across calls). current_context is queried at request time (volatile, delegation chain may have changed). Completeness metadata tells the verifier if any sub-query failed. Markdown format option for human review. The two sections are clearly separated: what was true at decision time vs what is true now.

Agent posture overlay (Session 4). Binary revoke/not-revoke is too crude. Three states: active, restricted, suspended. The independent review killed the original design: DO NOT put degradation on the passport. The passport is an immutable signed credential. A rogue agent won't sign its own suspension. Posture lives in the gateway DB only. Gateway checks status before delegation scope. Posture events audit trail records every transition with reason and changed_by. Eighteen governance regression tests prove the authorization boundaries hold.

Governance evidence export (Session 5). Nine sections, single signed artifact. Agent registry, delegation inventory, evaluation events, authorization receipts, revocation events, posture events, key rotations, receipt window seals, governance attestations. Sections with zero data show total: 0. That's honest, not broken. Known exclusions are explicit: "downstream execution results" and "external processing not mediated by this gateway." Not a compliance report. A governance evidence export.

Trust bootstrap adapters (Session 5). bootstrapFromAPIKey, bootstrapFromGitHub, bootstrapFromCIKey. Every adapter creates a fresh Ed25519 keypair. The external credential is a trust input, not the identity. Raw credentials never touch the SDK (caller pre-hashes with HMAC-SHA256). Suggested grade is a suggestion. Actual grade computed by computePassportGrade when the passport enters the gateway. Upgrade path to full attested identity via upgradeBootstrappedPassport.

Delegation linting + receipt seals (Session 6). Two gateway-compatible feasibility checks: SPEND_TOO_LOW and SCOPE_MISSING. Three checks always skipped with reasons (gateway doesn't store expiresAt, currentDepth yet). No reputation emission from lint results. Infeasible delegations are admin mistakes, not agent misbehavior. Receipt window seals: sorted-hash commitment over receipt hashes in ID order, atomic transaction, gateway signature. The commitment proves "these receipts, in this order, were sealed at this time."

SDK v1.34.0 (2,884 tests, 581 suites, 103 modules). MCP v2.21.0 (150 tools). Python v0.9.0 (2884 tests). Gateway v0.4.0. Governance canary: 5/5 pass. All published to npm, PyPI, ClawHub.

Day 47: Protocol Infrastructure Expanding — MS PR Approved, SINT Interop, Behavioral Spec

A Microsoft maintainer merged our Agent Governance Toolkit contribution PR. SINT Protocol shipped v0.2 with our delegation_depth_floor. The W3C behavioral attestation spec reached normative language. Evidence-based grading and freshness semantics designed across 11 threads, and the protocol ecosystem is growing through collaboration, not announcements.

Grade model rewrite (A2A#1712). VCOne-AI identified a real flaw: our passport grades map by identity method, not evidence quality. A TPM-backed did:key gets Grade 0 because it's did:key. A SPIFFE SVID from a misconfigured cluster gets Grade 2 because it's SPIFFE. Backwards. Three exchanges deep, we committed to evidence-based grading: Grade 0 = bare key, Grade 1 = issuer vouched, Grade 2 = infrastructure-attested (TPM or SPIFFE with verified binding), Grade 3 = principal-bound. The method prefix is a proxy. The evidence is the truth.

Freshness semantics (A2A#1712). Same thread, different problem. VCOne-AI pushed on ttl: null for snapshot attestations: a TPM quote from 6 hours ago is not the same as a TPM quote from now, and null implies never-expires. The fix: maxAge for snapshots, ttl for rotating (SPIFFE). Grade becomes index, evidence becomes payload. A $10K trade checks evidence_age() < maxAge. A read-only query trusts the grade alone.

SINT v0.2 review (A2A#1713). 8 comments in one thread. pshkv shipped SINT Protocol v0.2 with OWASP Agentic Top 10 coverage, industrial IoT bridges (MQTT Sparkplug B, OPC UA), and the delegation_depth_floor we designed together. The APS/SINT integration stack formalized: APS passport (who + scope) → SINT token (which MCP tools + tier) → EvidenceLedger receipt (what happened). Cross-org first-contact trust as a three-layer architecture.

Behavioral attestation spec (w3c-cg#32). 6 comments. The timing asymmetry became normative: CCS fires synchronously per-action (gateway-enforced), ghost lexicon computes over windowed receipt history (session-level), the combined AND row triggers only in post-hoc forensics. MUST NOT constraint added: implementations cannot wait for both signals simultaneously in live enforcement. Our CDP empirical data from MolTrust pilots cited as validation.

PayableOperation architecture (x402#1921). First engagement with ThomsenDrake (BTCPay/Lightning). The gap: x402 has payment primitives, but no receipt chain binding operations to settlements. The 3-sig model maps: agent signs intent, gateway signs evaluation, settlement adapter signs proof. Rail-agnostic at the schema level, rail-specific only in the verification path.

MnemoPay receipts (x402#1904). Non-repudiation gap identified: MnemoPay gives agents economic memory, but memory without cryptographic proof is just a claim. Proposed: APS receipt as the proof layer under MnemoPay's reputation score. One signing key, two consumers. The reputation score references the receipt hash, traceable back to a 3-sig chain.

MS PR#598 approved. imran-siddique requested 6 changes, all addressed same-day: fail-closed signature verification (critical — format-only fallback was worse than no verification), dependency pinning, input validation, test coverage, README trimmed. Approved that evening. Awaiting maintainer merge.

Protocol infrastructure doesn't grow by shipping code alone. Microsoft PR approved. SINT v0.2 shipped carrying delegation_depth_floor, which pshkv and I designed together. W3C spec reached normative constraints. Evidence-based grading and freshness semantics designed and ready to build. The ecosystem is collaborating on shared infrastructure — every thread is a design document for what ships next.

Day 46: Bring Your Own Identity — The Interop Stack

APS is not an identity system. Today it stopped looking like one. Four new modules shipped that accept external identity credentials and route them through the enforcement boundary. did:key, did:web, SPIFFE SVIDs, OAuth tokens — all feed into the same gateway. Identity is the input. Enforcement is the product.

did:key + did:web interop. toDIDKey() converts Ed25519 public keys to W3C did:key format. fromDIDKey() parses back. resolveDIDWeb() fetches DID Documents over HTTPS. passportToDIDKeyDocument() creates a W3C DID Document with alsoKnownAs bridging did:key to did:aps. Any standard DID verifier can now check an APS passport without knowing APS exists.

SPIFFE + OAuth bridge. importSPIFFESVID() converts a SPIFFE Secure Workload ID into a Tier 1 infrastructure attestation — the agent gets Grade 2 automatically. importOAuthToken() converts OAuth claims into APS delegation parameters — the OAuth scope becomes the delegation ceiling. Deterministic agent IDs: same OAuth subject always maps to the same APS agent via sha256(iss:sub).

VC wrapper + credential request. W3C Verifiable Credentials with did:key identifiers and SPIFFE evidence attachments. Selective disclosure: verifier requests specific claims, agent reveals only what's asked for. Full pipeline tested: SPIFFE agent → VC → selective presentation → OAuth-authenticated verifier.

Competitive repositioning. Mapped the full landscape: DID/VC (identity), OpenID4VC (exchange), SPIFFE (runtime), OAuth (delegation). Together they cover 70% of what APS does. The 30% gap — enforcement boundary, monotonic narrowing, cascade revocation, data lifecycle — is the moat. New positioning across all surfaces: "Enforcement and accountability layer for AI agents. Bring your own identity."

Full audit. 5-phase production readiness check: build integrity, cross-connection verification, logic verification, dependency audit, export completeness. All phases PASS. 430 exported functions, 428 types, 0 vulnerabilities, 0 strict mode violations. 25 circular deps (22 type-only). 7 core modules without dedicated tests (covered by integration tests).

Cross-language. All 4 interop modules ported to Python SDK v0.8.0. Cross-language verification: TypeScript toDIDKey() and Python to_did_key() produce byte-identical output for the same Ed25519 key. Same for SPIFFE subject hashes and OAuth agent IDs. 197 Python tests. Published to PyPI.

Microsoft AGT PR#598. imran-siddique reviewed, requested 6 changes. All addressed: fail-closed signature verification (critical fix — format-only fallback was worse than no verification), dep pinning, input validation, README trimmed to technical style, 3 new signature tests. Awaiting re-review.

SDK v1.32.0 (2,884 tests, 559 suites, 103 modules). Python SDK v0.8.0 (2884 tests). MCP v2.19.1 (150 tools). Gateway v0.3.4. 27+ GitHub posts across 15 threads. YC application finalized. Every competitor is now a feeder.

Day 45: SDK v1.31.0 — Governance Hardening + Gateway Bridge

SDK v1.31.0 shipped. Governance hardening pass across the protocol: stricter validation on delegation chains, tighter scope authorization checks, 34 new tests covering edge cases from the MoltyCel security audit. 2,884 tests now, 533 suites, 99 modules.

Gateway bridge. The MCP remote server now auto-registers every issued passport on the hosted gateway. Issue a passport from any MCP client — Claude, OpenClaw, any SSE connection — and the agent appears on gateway.aeoess.com with a trust profile and public verification endpoint. No manual registration. The bridge reads the issue_passport response, extracts the DID and public key, and POSTs to the gateway's agent registration API. Every passport is now verifiable infrastructure, not just a local keypair.

Gateway v0.3.4. Context continuity scoring: activity regularity, behavioral consistency, and identity maturity combined into a 0-100 score on every trust profile query. Fixed evaluate endpoint (stale SDK v1.27→v1.31, incrementUsage manual upsert for Railway's SQLite without UNIQUE constraint). SSE heartbeat added to remote MCP server to prevent Railway/Fastly CDN from killing long-lived connections.

0xbrainkid on NVIDIA/OpenShell#682. Deep technical exchange: sandbox-as-attestor model (the sandbox signs what it observed, the agent can't forge it), fidelity probe under constraint pressure (Hold/Bend/Break), trust_context now embedded in ExecutionAttestation — trust score at execution time is signed and tamper-detectable. Three independent threads (OpenShell, OWASP#802, W3C) converging on the same 3-layer architecture: authorization (APS), execution policy (Cedar/protect-mcp), output integrity (VeroQ/receipt chain).

Infrastructure. README rewritten for infrastructure positioning — APS is not an identity solution, it's governance infrastructure. Integration guide published: "build on APS, don't rebuild underneath." CLAUDE.md added for Claude Code sessions — every Claude Code instance now has project context, repo paths, and build commands on first load. Propagation sweep across all surfaces with updated numbers.

SDK v1.31.0 (2,884 tests, 533 suites, 99 modules). MCP v2.19.1 (150 tools). Gateway v0.3.4. 12,500+ installs across npm and PyPI. 35+ active GitHub threads across the ecosystem.

Day 44: First Code Integration + 5 Security Fixes

PR#3 merged into kai-agent-free/solana-agent-identity. APSProvider is the 4th identity provider in the Solana Agent Kit. First external code dependency on APS. Not a spec comment — running code in another project's repo.

Twelve protocol features. Execution attestation with context-aware drift. Bilateral receipts. Evidence commitments. Compromise window. Proof ID namespacing for cross-system lineage. x402 governance adapter (4-gate commerce wrapping HTTP 402 → USDC on Solana/Base). Tool integrity verification (OWASP Layer 2). trust_context in ExecutionAttestation. DID pattern matching in aps.txt. Fail-closed revocation policy. Hash-aware drift detection. Compaction-drift probe.

Five security gaps closed. MoltyCel found 5 attack vectors in governance blocks and aps.txt. AV-1: governance block spoofing → VerifiedGovernanceCredential (W3C VC with Ed25519 proof). AV-2: aps.txt manipulation → enforceApsTxt() strict mode already existed. AV-3: governance block replay → expires_at field + expiry check in compliance loop. AV-4: aps.txt DoS → trust threshold protection. AV-5: cross-skill confusion → bindGovernanceToImplementation(). All five fixed same-day, all nine tests passing.

Gateway v0.3.1. Receipt resolution endpoint: GET /.well-known/receipts/:id. Cross-system lineage traversal — any WG member resolves a proof reference to its full receipt + signature + JWKS. certify_required flag for high-risk interceptors: missing receipt = audit gap = hard gate.

29 active threads. desiorac co-designing cross-issuer resolution spec (Rekor anchoring, proof namespacing, certify failure modes). agent-morrow cross-calibrating fidelity probe with W3C CCS reference. MoltyCel cross-testing vectors across APS/AgentID/MolTrust. tomjwxf validating 3-layer architecture (APS delegation → protect-mcp Cedar → receipt chain). MEEET requesting integration for 1,020 Solana agents. kevinkaylie connecting AgentNexus DID. Entered 2 new ecosystems (LangGraph Swarm, MetaGPT).

SDK v1.29.6 (2,884 tests, 522 suites, 99 modules). MCP v2.19.1 (150 tools). Gateway v0.3.1 (34 routes + 2 .well-known). Everyone who reported a gap was notified with working code.

Day 43: Multi-Attestation Verification

douglasborthwick-crypto ran a 5-issuer live verification pass. InsumerAPI, ThoughtProof, RNWY, Maiat, and APS. Five issuers, five trust dimensions, two algorithms (ES256 + EdDSA), independently signed, verified in a single pass. APS slotted in with zero code changes to the reference verifier. Passport grades are now a composable attestation type in the multi-attestation spec.

Gateway identity. The gateway needed its own cryptographic identity to sign trust attestations that external verifiers can check. Ed25519 keypair generated on first boot, persisted in SQLite, reused across restarts. /.well-known/jwks.json exposes the public key in standard JWK format. /api/v1/public/trust/:agentId/attestation returns a JWS-signed trust profile. Any relying party fetches the JWKS, selects by kid: "gateway-v1", and verifies the signature without contacting us.

Policy hash chaining. From haroldmalikfrimpong-ops, who shipped compound digests, contextEpoch, and Merkle trees on AgentID while we were spec'ing. His insight: SHA-256(constraints_at_N + previous_policy_hash) creates a tamper-evident history of an agent's constraint state. If constraints drift through summarization or memory compaction, the chain breaks. verifyPolicyChain() recomputes every hash. detectConstraintDrift() classifies each change as narrowed (safe), widened (violation), or changed.

Routing divergence detection. From desiorac on OATR and A2A. When an agent declares intent to reach endpoint A but the actual execution hits endpoint B, the receipt needs to capture both. Five divergence patterns: none, endpoint_migration (benign), key_rotation (re-attest), full_migration, entity_change (always flag). Each carries a risk level. captureRoutingContext() snapshots DID + document hash + endpoint hash at a point in time. detectRoutingDivergence() compares two snapshots and classifies the pattern.

Ecosystem. 15+ GitHub replies across 8 threads. Every SDK function built today came from a conversation: importProviderAttestation() from msaleme, addIdentityBoundary() from xsa520, computeCompoundDigest() from desiorac, routing divergence from desiorac, policy hash chaining from haroldmalikfrimpong-ops. OpenClaw #49971 engagement (13K+ skills registry debating agent identity). Working Group referenced in 4 high-traffic threads. ClawHub skill rewritten agent-first (v4.4.0). All stale GitHub surfaces fixed (repo descriptions, glama.json, README headings).

SDK v1.29.4 (2,884 tests, 503 suites, 96 modules). MCP v2.19.1 (150 tools). Gateway v0.3.0 (38 routes). 37 new tests today. 9 new exported functions. APS is the 5th verified issuer in a cross-protocol attestation standard.

Day 42: Agent Attestation Architecture

In a sandboxed test, an agent farmed unlimited passports and drained a promo wallet in 60 seconds. Ed25519 keys are free. Identity Sybil is unsolvable in open protocols. We ran a 3-round independent review across Claude, GPT, Gemini, and a real sandboxed agent (Portal). Universal convergence: cheap identities are fine, cheap extraction is the bug.

Attestation types. Four-tier evidence model: Observed (TLS fingerprint, timing, velocity), Infrastructure-attested (sandbox signs it), Provider-attested (OAuth, cloud tenant), Self-declared. Passport grades 0-3 based on attestation richness, not admission rights. Grade 0 agents still work. Evidence and assessment split into separate records. Workspace manifest hash for proof of history. Recovery requires cryptographic proof, not just environment matching.

Sybil hardening. Gateway v0.3.0: 4-gate pipeline on wallet provisioning (registered + delegation + publicKey dedup + principal rate limit). Presentation trust profile API: one call, one JSON, one decision. Destination convergence detection catches farming consolidation points. Issuance dossier storage for full forensic record. Public trust-profile endpoint for cross-org trust querying. 37 API routes.

Behavioral tracking. Post-issuance behavioral sequence recording: first 10 tool calls after passport issuance. Real agents do work. Farming agents extract. Pattern classified as productive, extractive, or neutral. MCP fires IssuanceContext to gateway on every passport issuance. End-to-end pipeline live.

SDK v1.29.1 (2,884 tests, 96 modules). MCP v2.19.0 (150 tools). Gateway v0.3.0 (37 routes). Two machines, zero overlap, bridge wired. 8 ecosystem posts across OWASP, crewAI, NVIDIA, Microsoft, Worldcoin, DIF. 10 dead repos archived.

Day 41: Agent Wallets

Agents need to spend money. Coinbase charges gas. ChainHop takes 0.75%. We charge nothing. Three commits, 1,430 new lines, gateway went from 18 to 36 API routes.

Nano payment rail. Generic PaymentRail interface with Nano as the first adapter. Invoice creation with amount-unique fingerprinting, on-chain polling, outbound sends with idempotency, block verification. Six endpoints: invoice, status, settle, balance, history, verify. 28 unit tests plus 12 live tests against the real Nano network.

Agent wallets. Every agent with a passport gets a Nano wallet via HD key derivation. Every send goes through a 3-gate delegation pipeline: active wallet check, commerce scope check, budget check. Freeze and revoke cascade from the existing revocation system automatically lock wallets. Nine new REST endpoints. Private keys never leave the gateway process. aeoess.com/wallet.html

Local crypto. wallet-crypto.ts (323 lines): master seed auto-generates on first run, HD key derivation gives one deterministic address per agent, local block signing with Ed25519, public RPC for work generation. No Docker. No Nano node. Just one seed file and a public RPC endpoint.

Day 40: Gateway Wiring

Import graph analysis showed only 20% of modules were connected to the gateway enforcement hub. Built four rounds of wiring. Final interconnection rate: 79%.

Fidelity probe. New measurement protocol based on the Hold/Bend/Break model. Tests whether agents actually follow their delegation constraints by measuring behavioral responses to boundary conditions. Wired into gateway scheduling.

Module wiring. Gateway identity layer connects DID, principal endorsement, and entity verification into agent registration. Data cluster wires data-source, data-contribution, data-enforcement, and data-gateway into the processToolCall pipeline. Gateway-wiring adapter connects 13 more modules: commerce, charter, coordination, routing, precedent, oracle-witness, reserve, context, governance-consumer, encrypted-messaging, messaging-audit, federation, EU AI Act.

Ecosystem. 12 substantive GitHub replies across 10 threads. Accepted lowkey-divine's fidelity probe collaboration on crewAI. Gave honest answers about Merkle anchoring gaps on A2A. Pinged four dormant contacts with specific collaboration offers. SDK v1.29.1. 2884 tests, 503 suites, 96 modules.

Day 39: Governance for the Agent Economy

The site said "AEOESS" in giant letters and then explained the acronym. Three paragraphs saying the same thing three ways. A metaphor ("passports") doing the work that plain language should do. The design was dark-themed startup aesthetic. None of it matched what the protocol actually is: serious governance infrastructure for an emerging economy.

Complete visual redesign. Crimson Pro serif for headlines. Source Sans 3 for body. JetBrains Mono for code. White background, black text, high contrast. iOS-style frosted glass on the nav bar. Warm dark gray (#1c1c1e) for dark mode instead of pure black. Every element got subtle border-radius. The aesthetic is academic paper, not SaaS landing page.

Enterprise positioning. The headline is now "Governance for the Agent Economy." Not a feature description. A category claim. The body text is a problem statement: agents represent companies, spend real money, no one can verify who they are. Then a Today vs With AEOESS comparison. Then 10 capabilities listed without frames. Then a 10-question FAQ that carries all the depth: what the protocol does, how it differs, production readiness, audience, delegation, integration, revocation, standards, compliance, pricing.

38-entry ship log. The updates panel became a full timeline from Day 1 (Feb 18) to today. Four tag types: ship (green), paper/standard (amber), traction (purple), deploy (blue). The Agent Times deployment sits in the timeline as the first production use of APS. YC CEO endorsement and Microsoft merge are tagged as traction. Visitors scroll through 38 days of continuous shipping.

Unified design system. shared.css v9 rewritten. All 15 pages now have the same nav, footer, theme toggle, and fonts. Deleted 7 dead files (old backups, admin page, stale architecture viz). Removed all ghost HTML elements (old side-nav, old logo, old theme-toggle, old burger/drawer). Fixed stale numbers across every page. Zero old UI patterns remaining.

Day 38: Institutional Governance Layer in One Session

The spec estimated 12 sessions. It shipped in one. Three phases of institutional governance — charter, approval, time, reserve, federation — went from zero lines to 1634 passing tests, 120 MCP tools, and two npm packages published before midnight.

Phase 1: Charter and Approval. A charter is the founding document of a multi-agent institution. 19 types define offices, succession rules, quorum policies, incompatibility constraints, dissolution terms. 16 pure functions handle creation, signing, verification, amendment, office transfer, and quorum checks. Multi-class threshold approval lets different signer classes (founders, officers, auditors) each satisfy independent requirements before a decision passes. 2884 tests, including the INV-5 guard: suspended or dissolved charters cannot be amended. A Petri net specification proves 10 invariants across 6 state machines with full transition tables.

Phase 2: Time, Foreign, Escrow, Gateway Identity. Hybrid Logical Clocks handle the fundamental problem of distributed time: wall clocks disagree, so every timestamp carries uncertainty bounds. Temporal ordering is three-valued — definitely_before, concurrent, or incomparable — because honest uncertainty beats false precision. Foreign counterparty envelopes wrap untrusted entities with mandatory expiry, sandboxing, and monotonic trust upgrade paths. No permanent foreign trust: the envelope expires even if you forget about it. Escrow-aware revocation blocks cascade revocation when active escrows exist, forcing a grace period instead of an instant rug-pull. Gateway identity publishes sovereignty level, trust basis, import policy, and fee model so agents can evaluate gateways before entering them.

Phase 3: Reserve and Federation. Reserve attestations let gateways declare their backing with liability semantics and assurance classes ordered by strength (self_attested < peer_audited < third_party_verified < regulatory_certified). False attestation penalties are declared upfront. Federation makes receipts and reputation portable: a foreign receipt envelope imports execution history from another gateway with automatic downgrade, and vouched reputation attests to an agent track record without exposing the underlying receipt history. 2884 tests cover all three phases.

12 new MCP tools. create_charter, verify_charter, sign_charter, evaluate_threshold, create_approval_request, add_approval_signature, create_hybrid_timestamp, compare_timestamps, validate_temporal_rights, create_reserve_attestation, vouch_reputation, apply_reputation_downgrade. 150 tools became 120.

Naming conflicts and the cost of scale. Two type collisions surfaced at 53 modules: JurisdictionEnvelope (data-lifecycle vs gateway) became GatewayJurisdiction. RevocationStatus (execution-envelope vs escrow) became EscrowRevocationStatus. At this scale, every new type needs a namespace check before it gets a name.

SDK v1.27.0 (2884 tests, 503 suites, 86 files). MCP v2.19.0 (150 tools). Both published. 63 core modules + 32 v2 constitutional modules. ~9,000 npm downloads. The protocol can now model institutions, not just individual agents. Charters define governance. Approval policies enforce it. Time is honest about its uncertainty. Reserves are backed or they say they are not. Federation means agents carry their history with them. Rome is complete.

Day 37: Governance Distribution Stack — Every Article on The Agent Times Is Now Cryptographically Governed

The protocol could sign content. It could verify signatures. What it couldn't do: tell an agent reading a webpage what the terms are, in the HTML, at the moment of access. Today that's running code.

Five delivery mechanisms, one primitive. A governance block is Ed25519-signed JSON declaring: who published this content (DID), what the content hash is (SHA-256), what the terms are (inference, training, redistribution, caching), and what happens if terms are revoked. Five ways to deliver it: <script type="application/aps-governance+json"> in HTML, aps.txt at /.well-known/aps.txt for site-wide coverage, X-APS-Governance HTTP headers on any response, <meta> tags for lightweight embedding, and chained governance blocks where derivatives reference the parent's hash. All signed. All verifiable. All shipping in SDK v1.25.0.

The 360 loop. Publisher calls embedGovernance() — signed block goes into the HTML. Agent calls governanceLoop360() — extracts the block, verifies the signature, checks if its intended usage is permitted, and creates a signed AccessReceipt. The receipt captures the terms and revocation policy at access time. If the publisher later changes terms, the receipt proves what terms existed when the agent accessed the content. Both sides have cryptographic proof. Publisher signed the terms. Agent signed the receipt. No trust required.

The Agent Times integration. PR #58 merged. Every article page on theagenttimes.com now includes a governance block in its HTML <head> and governance headers on every HTTP response. Terms: inference permitted (agents can use for RAG), training requires compensation (pay to train models on our journalism), redistribution requires attribution (share everywhere, credit The Agent Times), caching permitted. Signed with the tat-editor Ed25519 key. Every article page carries a signed governance block in its HTML.

Framework adapters. Governance hooks for CrewAI, Google ADK, LangChain, and A2A — each one maps the protocol's delegation verification and policy evaluation to the framework's native concepts. A CrewAI agent verifies its delegation chain before executing a task. An ADK agent checks policy before tool calls. All four adapters ship in the public SDK, but they're thin wrappers over the core primitives, not framework lock-in.

Conformance suite. 21 invariants across 4 categories: delegation invariants (authority never increases, revoked chains stay dead), identity invariants (DID determinism, signature verification), policy invariants (intent-evaluation-receipt chain completeness), and commerce invariants (spend bounds, human approval gates). Any implementation claiming APS conformance can run the suite.

Hosted enforcement gateway. Private repo at aeoess-gateway. Multi-tenant enforcement API with signup, evaluate, receipt, revoke, audit, and dashboard endpoints. Three plan tiers (Free/Pro $99/Enterprise $999). Cascade revocation. Alert system. E2E tested. The protocol is open and free. The hosted gateway that makes it easy is the business. Path B done right: reference implementation ships first, product captures value later.

MCP remote passport tracking. The hosted server at mcp.aeoess.com now tracks per-tool usage and counts passport issuance events (generate_keys, identify, create_principal, endorse_agent). Public at /stats. 61 sessions, 48 tool calls since launch. The counter starts from zero — honest numbers, not inflated ones.

SDK v1.25.0 (2884 tests, 384 suites, 78 files). MCP v2.15.1 (150 tools). Python v0.7.0 (2884 tests). ~9,000 npm downloads in the first month. The governance distribution stack is complete: publishers embed, agents verify, both sides have proof. What's left is adoption.

Day 36: Clean Slate — 68 Dead Imports, OATR Founding Member, Zero Open Findings

Spent the day auditing instead of building. Pulled all four repos from GitHub, ran full test suite (1178 pass, 0 fail), then went line by line through the codebase looking for dead weight.

68 unused imports removed across 34 files. Type imports that were never annotated. Functions imported but never called. Variables assigned but never read. Every one verified via tsc --noUnusedLocals before and after. Net change: -47 lines. Zero test regressions.

Tracked garbage cleaned. Two old npm tarballs (320KB) committed to git before the .gitignore rule existed. A day-1 test artifact from February 18. A one-time security patch script in MCP that served its purpose months ago. All verified unreferenced before removal.

OATR founding member. APS registered as an issuer on the Open Agent Trust Registry (PR #12 merged). Domain verification live at aeoess.com/.well-known/agent-trust.json. Same Ed25519 key used across did:aps, MCP server, and qntm relay bridge. Four founding WG members — qntm, ArkForge, AgentID, APS — all registered within one wave.

Propagation script hardened. The auto-propagation script was rewriting numbers inside historical blog entries — Day 15 was claiming test counts from Day 36. Added PROPAGATION-ZONE markers so only meta tags and the subtitle track current numbers. Historical prose stays frozen.

xsa520 published the Guardian v0.2 Decision Equivalence Specification — a clean primitive defining when two decisions across different engines should be treated as the same. Maps directly to our Module 37 (DecisionSemantics). All Portal audit findings confirmed resolved. Zero open items.

Day 35: First APS Envelope Through an Encrypted Relay

Peter Vessenes opened an issue asking if APS agents could communicate through encrypted channels. We already had Module 19 (E2E Encrypted Messaging). What we didn't have was a relay. He maintains qntm, an end-to-end encrypted messaging protocol for agents. Same Ed25519 identity keys, same XChaCha20-Poly1305 cipher. The integration was obvious.

The bridge. Built interop/qntm-bridge.ts in one session. 369 lines, zero new dependencies. HKDF key derivation matched his known-answer vectors byte-for-byte across three implementations (libsodium TypeScript, @noble/curves TypeScript, Python cryptography). We decoded his invite token, derived the conversation keys, encrypted an APS SignedExecutionEnvelope, and POSTed it to the qntm relay. HTTP 201. The relay accepted our encrypted payload without seeing what was inside.

The identity stack. Ed25519 passport → X25519 key derivation (5/5 vectors) → HKDF conversation keys (3/3 vectors) → XChaCha20-Poly1305 encryption → qntm relay transport. Every layer proven independently before composition. Three languages, one identity, byte-for-byte compatible.

Also today. Agora reframed as "Signed Communication Protocol" with per-instance isolation. No global feed. Intent Network and Mingle explicitly marked as opt-in ecosystem services. New FAQ: which parts are required vs optional. MCP stats endpoint shipped at mcp.aeoess.com/stats. Three MCP integration findings from the protocol test fixed and published as v2.12.0.

2884 tests. 320 suites. 63 test files. The protocol now has encrypted transport through an external relay, and every enterprise concern about shared feeds is addressed. Not a monolith. A composable stack where each layer does one thing.

Day 34: 30 Constitutional Modules. Every Gap Closed.

Three AI models attacked the protocol simultaneously. Claude, GPT, and Gemini each received the full codebase and one instruction: find what breaks. They identified 16 gaps in the governance layer. Today, all 16 are running code with tests.

The attack categories. Nine attack defenses: approval fatigue (detecting rubber-stamping and impossible review latency), effect enforcement (catching divergence between declared and actual outcomes), semantic drift (intent says one thing, action does another), composite workflow audit (authority laundering across multi-agent pipelines), cascade correlation (delegation loops), inaction auditing (agents that systematically avoid acting when they should), values override with mandatory justification and independent review, governance drift tracking (cumulative weakening), and emergence detection (epistemic monoculture, market concentration).

The structural safeguards. Separation of powers (agents cannot hold legislative and executive roles simultaneously). Constitutional amendment (supermajority vote + human ratification for structural changes). Policy profiles (per-target rule sets). Affected-party standing (any registered party can file complaints and appeal decisions). Circuit breakers (automatic category suspension when error thresholds are breached). Root authority transition (founding→operational→transitional→democratic, phase can only advance, never regress).

Published everywhere. SDK v1.21.2 on npm (2884 tests, 320 suites, 57 files). MCP v2.12.0 on npm (150 tools). Python SDK 0.5.1 on PyPI. Paper v2 on Zenodo. Peter Vessenes (corpollc/qntm) joined the A2A discussion on transport security. We already ship E2E encrypted messaging with the same Ed25519 identity keys his relay uses. Complementary layers, not competing ones.

32 v2 modules. 42 core modules. 2884 tests. The protocol now has constitutional governance. Not perfect. But every gap three hostile models could find is addressed with code that runs and tests that pass.

Day 33: Constitutional Governance Is Running Code

Two things shipped today. Module 37: Decision Semantics makes every policy decision content-addressable (SHA-256 of canonical JSON) and classifies how verdicts were reached (deterministic, heuristic, LLM-based, hybrid, human). When four different governance engines evaluate the same scenario, this module lets you compare not just what they decided but how.

V2 Constitutional Governance. Seven sub-modules that address the interview question: what happens when honest agents comply perfectly and the system still fails? Delegation versioning adds supersession and renewal hardening (renewal cannot expand scope without independent review). Outcome registration gives three perspectives: what the agent thinks happened, what the principal observed, and what an adjudicator concludes. Anomaly detection automatically flags the first time any agent uses its maximum earned authority. Emergency pathways are pre-authorized by the delegator at delegation time, not declared by the agent in the moment. Fork-and-sunset migration lets agents evolve through controlled reincarnation, not scope expansion. Contextual attestation requires pre-action reasoning records for medium+ risk actions.

Full codebase audit. Read every source file (20,490 lines across 77 files) and every test file (18,397 lines across 57 files). Verified all six protocol invariants in code. Found one cosmetic inconsistency (import style). No bugs. The audit confirmed that npm v1.18.0 was published before the V2 commits landed, so V2 was missing from npm. Bumped to v1.21.2, published with Touch ID auth. All 332 dist files confirmed present including dist/src/v2/.

2884 tests. 42 modules. 83 MCP tools. The protocol now addresses institutional failure modes, not just adversarial ones.