Building Agent Passport System, day by day.

Day 32: Data Attribution Starts Here

Listening to Bernie Sanders talk about data rights and realizing the protocol already had 80% of the answer. The gateway tracks what agents access (taint tracking). The Merkle trees commit receipts. The delegation chains prove authorization. What was missing: the data source has no cryptographic proof their data was used, no terms enforcement, and no identity in the system.

The design process. Gave three models the same open-ended problem independently: "the protocol tracks what agents DO but not what data CONTRIBUTES. How would you solve this?" No templates, no type hints. All three converged on the same foundation: data sources get Ed25519 identity, the gateway signs access receipts (not the agent), Merkle trees for independent verification, separate provenance from valuation. Then six rounds of hostile review against the merged spec. Ten rounds total before a single line of code.

The key insight everyone converged on: access is not contribution, and contribution is not value. The protocol needs four objects, not one: SourceReceipt (who the data is), DataAccessReceipt (proof access happened), DependencyRecord (how inputs relate to outputs), ContributionClaim (policy-defined attribution). Brief 1 ships the first two. The rest builds on top.

Module 36A: Data Source Registration & Access Receipts. Three attestation modes: self-attested (owner signs, high trust), custodian-attested (platform signs on behalf, medium trust), gateway-observed (no upstream signature, low trust). Trust level propagates to every downstream object. Machine-readable DataTerms: 9 purpose types, 6 compensation models, derivative policies, audit visibility, rate limits. The terms snapshot rule freezes terms at access time. If a source later changes terms, historical receipts are unchanged. The access was authorized under THOSE terms, period.

Hard vs advisory compliance. Deterministic checks (revoked source, expired terms, excluded agent) block access inline. Purpose checks (agent declares "read" but might use for "train") are advisory. The gateway cannot verify actual usage intent. Advisory warnings create the audit trail that makes violations detectable after the fact. This distinction survived every hostile review.

The honest framing. These receipts provide cryptographic accountability, not independent verification. If the gateway operator IS the agent operator (the default deployment), the receipt is evidence of what they claimed, not proof of what happened. That is still more than any existing system provides. And it makes gateway dishonesty detectable and attributable.

14 functions. 2884 tests. Zero failures. The foundation for data attribution is live. Prove use before trying to price it.

Day 31: Three Modules on One Machine, Five Engines on One Thread

Two things happened today. One was a build sprint. The other was the first real cross-engine disagreement in the agent identity space. Both mattered.

Sprint Mini. Built three new modules entirely on the Mac Mini via Desktop Commander while the Air handled ecosystem replies. Module 28: Oracle Witness Diversity. Shannon entropy scoring over attestation providers prevents Sybil-style oracle manipulation. Quorum alone is not enough when one entity controls multiple oracles. Diversity scoring catches single-provider dominance. Module 29: Encrypted Messaging Audit Bridge. Module 19 added E2E encryption, but encrypted messages bypass the gateway entirely. This bridge creates audit records (SHA-256 hash of ciphertext, sender metadata, taint labels) without breaking encryption. The gateway can enforce rate limits and compliance without seeing content. Module 30: Policy Conflict Detection. DFS cycle detection on policy dependency graphs catches deadlocks before they happen. Shadowed rule detection identifies policies that can never fire. Contradiction detection finds rules with opposite verdicts at the same priority. 44 new tests, all passing.

Cross-engine interop hit a milestone. Five engines are now participating in the decision artifact thread on kanoniv/agent-auth#2: Kanoniv, APS, AIP (The-Nexus-Guard), and now Network-AI (Jovancoding). The first two rounds were easy: scope-boundary decisions where all engines must agree. Round X-003 was the real test: an agent with sufficient scope but borderline trust (0.38). Kanoniv denied (trust threshold). APS permitted in default mode (structural only) but denied in reputation-gated mode (Bayesian score too low). Network-AI denied via a circuit breaker that overrode what the weighted composite would have allowed (0.564 would permit, but phase 2 hard cutoff at 0.4 triggered first).

The interesting finding: circuit breakers are a third decision category. Not structural (deterministic scope check), not trust-informed (threshold comparison), but policy override (hard gate that flips a composite-permit into a deny). The decision_semantics schema we proposed needs an override block to capture this. Without it, a verifier seeing "deny" from Network-AI can't distinguish between "the scoring model said deny" and "the scoring model said permit but a circuit breaker overrode it."

Concrete integration accepted. Jovancoding proposed a 50-line adapter: APS delegation chain properties (depth, scope breadth, spend ratio) feed into Network-AI's AuthGuardian trust scoring as normalized signals. The composition is monotonically narrowing: APS permit + AuthGuardian deny = valid; APS deny = AuthGuardian never reached. Same invariant we enforce within delegation chains, now holding across the protocol boundary. End-of-week PoC target.

42 modules. 2884 tests. 5 engines cross-verifying. The protocol is no longer a solo project with bots. It has an ecosystem.

Day 30: Three Modules in One Day. Two Claudes Built Them.

Module 19: E2E Encrypted Messaging. Separate X25519 keys, ephemeral ECDH per message, double signature (inner over plaintext prevents identity stripping, outer over ciphertext enables gateway verification without decryption). Taint hashes in cleartext AAD so Module 12 cross-chain enforcement works even on encrypted traffic. libsodium-wrappers. 2884 tests including wrong-recipient, surreptitious forwarding, tampered ciphertext, and identity stripping attacks. Consensus spec from GPT + Gemini + Claude hostile review.

Module 20: Obligations Model. The missing piece: we had permissions (what agents CAN do) and prohibitions (what they CANNOT do), but no duties (what they MUST do). Obligations attach to delegations with deadlines, evidence requirements, and penalty specs. Parameterized constraints catch malicious compliance — a $0.01 refund doesn't satisfy a "process $500 refund" obligation. Five resolution outcomes distinguish between an agent that didn't try and one whose tool failed. Penalty severity monotonically narrows in sub-delegations. 2884 tests. Two-Claude build: one Claude wrote the tests and spec, the other wrote the implementation.

Also shipped: createExecutionEnvelope() — the RFC from Day 29 becomes running code. Any governance engine can now emit a signed envelope that any verifier can check. Protocol: 42 modules, 2884 tests.

Day 29: Three Groups Asked for the Same Thing. So We Wrote the Spec.

Three independent groups, three different repos, same conclusion: AI governance engines need a shared signed execution envelope.

@Kelisi808 on crewAI #4560 proposed 7 minimum fields. @xsa520 on guardian#2 proposed separating decision artifacts from execution receipts. @ngallo at DIF's Trusted AI Agents Task Force raised formal questions about continuity in non-deterministic runtimes. None of them knew about each other.

We mapped all three proposals to our existing SDK types and realized: we already ship every field. So instead of posting another comment, we wrote the spec. RFC: Cross-Engine Signed Execution Envelope.

The key innovation is the evaluation_method field: deterministic (the decision can be replayed) vs probabilistic (LLM-based, signature-verifiable only). This is the split every verifier needs. A rule-based policy decision is independently reproducible. An LLM advisory judgment is not. Different trust levels for each.

Portal is opening the RFC issue on our repo and cross-linking from all three threads. If CrewAI, Guardian, and APS can all emit compatible envelopes, that's the foundation for ecosystem-wide governance audit. We're not commenting on other people's conversations anymore. We're writing the spec they converge on.

Day 28: A Contribution PR Merged into the Microsoft Agent Governance Toolkit. A Federal Agency Is Reviewing.

The weekend the protocol stopped being just mine.

Microsoft. PR #274, a contribution PR, merged into microsoft/agent-governance-toolkit by a Microsoft maintainer. Portal also posted on microsoft/autogen #7372 (Chou Deyu's governance layer discussion) and agent-governance-toolkit #275 (reputation-gated authority).

NIST. Third revision of our public comment submitted to the NCCoE on their "Software and AI Agent Identity and Authorization" concept paper. BSA (the Software Alliance) independently told NIST to study "cryptographic chains of custody for agent authorization." That's our architecture. April 2 deadline for the comment period. We're in.

IETF. Sanjeev Kumar, author of the DAAP draft (draft-mishra-oauth-agent-grants-01 — the OAuth extension for AI agent delegation), emailed back. He's interested in collaboration on the enforcement boundary problem and cross-protocol identity. IETF is the organization that writes internet standards — HTTP, OAuth, email protocols. Having the DAAP author engage on our work means the delegation patterns are converging across protocol communities.

Ecosystem outreach. Drafted and prepared responses for five more discussions: Anthropic claude-code #32514 (sub-agent identity problem — our delegation chains are the protocol-level solution), DIF's Delegatable Authorization Task Force (brand new repo, we'd be first contributors introducing monotonic narrowing), AGNTCY Identity PR #157 (cross-protocol bridge between did:agntcy and did:aps), ThirdKeyAI Symbiont (proposing APS as identity layer for their Rust zero-trust runtime).

Research grant. Applied to the Adaption Research Grant Program (Sara Hooker, ex-Cohere/DeepMind, $50M seed). Project: adaptive policy enforcement. Can a policy engine learn from its own cryptographically signed enforcement history to improve advisory decisions without retraining? Our dual-process experiment (56 runs, F-008 negative result) is the starting data.

Four weeks ago this was a TypeScript file on a MacBook Air. Now a contribution PR is merged into the Microsoft Agent Governance Toolkit, a federal agency has it, and an internet standards author wants to collaborate. Nobody told them about each other.

Day 27: Full Stats Sweep + Gateway Strategic Decision

Housekeeping day. Two things: a strategic decision and a full staleness audit.

The gateway question. The ProxyGateway is the enforcement boundary. It's the piece that makes protocol guarantees real rather than voluntary. That makes it the most commercially valuable component. Two paths: sell it as a hosted service (the Stripe model), or keep it as an open-source reference implementation and focus on protocol adoption. Decision: reference implementation now, product later. Reasoning: nobody pays for enforcement of a protocol nobody uses yet. Build the ecosystem first, monetize the infrastructure once there's traction. Path B now, Path A later.

The staleness audit. Swept every page, README, GitHub description, and LLM-readable file across all three repos. Found 11 stale endpoints. SDK README badge said 2884 tests (now 534). GitHub org README said 150 tools (now 61) and 16 modules (now 17). MCP README section header said 150 tools (now 61). Both repo descriptions on GitHub referenced 2884 tests. llms-full.txt and passport.html said 22 test files (now 28). llms.txt said "eleven" modules (now seventeen). All fixed. Also added floor-validator.test.ts to the test script (was on disk but never ran in CI).

This is why the propagation spec exists. Numbers drift. Pages get updated in one place but not another. The propagation script catches most of it, but badges, section headers, and GitHub API descriptions live outside the script's reach. Manual sweep still needed occasionally.

Day 26: Mingle v2 — Semantic Matching, Ghost Mode, Consent Flow

Biggest Mingle ship since the original launch. Four phases built and deployed in a single day. The network actually connects people now.

Phase 1A: Persistent identity. Every user gets a permanent Ed25519 keypair stored in ~/.mingle/identity.json. Same key across sessions. Reputation follows the key. Also: simplified card schema (plain string needs/offers, no categories required), _digest side-channel injected into every tool response, 90 seed cards tagged honestly, /api/health endpoint, and a signature verification fix that was silently breaking all publishes.

Phase 1B: Semantic matching. Installed all-MiniLM-L6-v2 via @xenova/transformers on the API server. 384-dimensional vectors. 80ms model warmup. Every card's needs and offers are embedded on publish. Cross-vector search: my needs vs their offers, my offers vs their needs. Mutual matches get a 15% score bonus. Migrated all 121 existing cards (289 vectors). Result: 0 matches became 15 ranked semantic matches. Top match: "Autonomous Agents" at 0.78.

Phase 2: Consent flow + ghost mode. Rewrote SKILL.md from scratch (216 lines, 9 behavioral rules). The AI now: checks the network silently at session start, never auto-publishes (draft then preview then approve), sanitizes company names and financials before showing drafts, handles returning users with active cards, surfaces matches without interrupting focused work, and supports ghost mode where users browse the network without publishing. New API endpoint: POST /api/matches/ghost.

Naming consensus. Consulted Claude, GPT, and Gemini on positioning. Unanimous: Mingle is the brand. "Like LinkedIn, but inside your chat" is the category anchor. "The agent finds. You decide." is the mechanism. ClawMeet as a discoverability tag on ClawHub only.

Published: [email protected] on npm, [email protected] on ClawHub. Submitted PR #259 to awesome-openclaw-skills. Updated all website files, llms.txt, Schema.org, README. The network is live at api.aeoess.com: 121 cards, 289 embeddings, 3 real connections.

Day 25: Substack Launch — Cross-Protocol Bridge + Tesla Social

Content day. Two Substack articles published. Social media posts across X and LinkedIn.

Article 1: "For the First Time in History, AI Agents Bridged Two Independent Security Systems." The story of the APS x AIP cross-protocol identity bridge. My protocol and The Nexus Guard's protocol verified each other's agents. Two independent teams, two protocols, zero coordination. Their agents still proved who they are to each other. This is KYA — Know Your Agent. The DNS moment for AI agents.

Article 2: "I Came Up With the Best Social and Retention Strategy for Tesla. Then I Built It." Every airline has miles, every hotel has points, Tesla has nothing. Built a proximity chat + miles loyalty program MVP for Tesla owners in a weekend. React + Supabase + Vercel. Working app at tesla-social.vercel.app.

Also pitched Mingle on X ("DNS for AI agents") to an 81k-reach thread. The protocol is starting to get in front of people.

Day 24: Security Hardening — Gateway Bugs, Setup Commands, Cross-Protocol Resolve

Three gateway bugs found and fixed. NW-001: memory leak in replay protection — the nonce store grew unbounded because expired entries never got pruned. Added TTL-based cleanup. NW-003: crash when an unregistered agent tried two-phase execution. Now returns a proper error instead of throwing. NW-006: card deletion in the Intent Network checked agent ID instead of cryptographic key. Anyone who knew an agent's ID could delete their card. Fixed to require signature verification.

All 30 gateway tests pass. These are the kinds of bugs that don't show up in unit tests but would have been exploitable in production. Finding them before anyone else did is the point of security hardening.

SECURITY.md published with a proper threat model and responsible disclosure process. Prompt injection sanitization added to Mingle. npx agent-passport-system-mcp setup now auto-configures Claude Desktop and Cursor — zero JSON editing required. Cross-protocol resolve endpoint live at api.aeoess.com for external protocol bridges.

Day 23: Mingle Ships — Your AI Finds People for You

The biggest product launch since the protocol itself. Mingle is a standalone MCP plugin that turns your AI into a networking agent. Tell Claude or GPT who you need. Your agent publishes a signed card, matches with other people's agents, both humans approve before connecting. No app. No profile. No feed.

Six tools: publish_card, search_matches, get_digest, request_intro, respond_to_intro, remove_card. Everything Ed25519 signed. The network is live at api.aeoess.com.

Landing page at aeoess.com/mingle with live network stats. Published to ClawHub as [email protected] and [email protected]. Product Hunt, LinkedIn, and X launch posts went out. The framing: "Like LinkedIn, but inside your chat."

This is the first piece of the protocol that non-technical people can actually use. You don't need to understand Ed25519 or delegation chains. You just tell your AI "I need a React developer in Berlin" and Mingle handles the rest.

Day 22: The Intent Network — Your Agent Finds People for You

The biggest ship since the protocol launched. We built a network where agents represent their humans, discover relevant matches, and propose introductions. No app. No signup. Your existing AI conversation is the interface.

The core object is an IntentCard: a live, signed signal that carries what you need, what you offer, and what you're open to. Cards expire automatically (forcing freshness), are Ed25519 signed (preventing impersonation), and match against other cards on the network by category overlap, tag similarity, and budget compatibility.

Six MCP tools: publish_intent_card, search_matches, get_digest, request_intro, respond_to_intro, remove_intent_card. The killer feature is the digest: one question to your AI ("What's relevant to me right now?") returns your top matches ranked by relevance, pending intro requests, and incoming connections. Not a feed. Just the few things that matter.

Also shipped the Intent Network API at api.aeoess.com. Persistent backend with SQLite + WAL, Ed25519 signature verification, rate limiting per public key. Deployed on Mac Mini via PM2 + cloudflared tunnel. This means two different people running the MCP server in different Claude Desktop sessions see the same network. Cards persist across sessions.

Plus: ProxyGateway enforcement boundary (2884 tests, replay protection, two-phase execution), 16→16 protocol modules recount, and full version propagation sweep across all repos and GitHub READMEs.

SDK v1.21.2 (2884 tests, 320 suites). MCP v2.12.0 (150 tools). Both on npm. Intent Network API v0.1.0 live at api.aeoess.com.

Day 21: Reputation-Gated Authority — Agents Earn Trust, Not Just Receive It

Until today, agent authority came from one place: delegation. A human says "you can do X with budget $Y" and that's it. The problem is obvious. A brand-new agent gets the same authority as one that's completed 200 tasks without a single failure. Delegation tells you what an agent may do. Reputation tells you what it should be trusted to do.

The core invariant: effectiveAuthority = min(delegation, tier). Even if your delegation says $10,000, if your earned tier only permits $500, you get $500. Authority can only be widened by proving competence over time.

Reputation is Bayesian: each agent gets a (mu, sigma) pair per principal, per scope. Mu is estimated capability, sigma is uncertainty. Effective score = mu - 2*sigma. A fresh agent starts at mu=25, sigma=25 giving an effective score of 0. Twenty successful standard tasks bring you to around 45/15, effective score ~15. Complex tasks are more informative than trivial ones. Failures hit harder than successes help.

Five tiers: recruit (score 0), operator (30), specialist (60), captain (80), sovereign (95). Each tier unlocks higher autonomy levels, spend limits, and delegation depth. Promotion requires a signed review from an earned agent at a higher tier. No self-promotion. No fiat reviewers. Demotion leaves cryptographic scarring: each behavioral demotion permanently raises the threshold to re-reach that tier by 5 points.

Before writing a line of code, consulted GPT-4, Gemini, and PortalX2 on three design questions: complexity evaluation, model-change handling, and enforcement placement. All three converged on the same architecture: deterministic rule engine for classification, Bayesian sigma reset for model changes, soft precheck at intent creation plus hard enforcement in the policy engine. When three different AI architectures independently agree on the same answer, you're probably on the right path.

SDK 1.11.0: 17 exported functions, 2884 tests across Phase 1 and Phase 2. MCP 2.5.0: 5 new tools (resolve_authority, check_tier, review_promotion, update_reputation, get_promotion_history). 150 tools total. Both published to npm.

Day 20: Second Paper Published — Monotonic Narrowing for Agent Authority

Published our second research paper on Zenodo: "Monotonic Narrowing for Agent Authority: Formal Invariants, Adversarial Testing, and Open Problems for Autonomous AI Systems." This one formalizes what we built in the autoresearch sprint two days ago.

Eight delegation chain invariants, property-based adversarial testing, and five open problems for the field. The paper ties directly to running code — every invariant maps to tests in the SDK. Also submitted to arXiv (still on hold).

Looked at the competitive landscape today. DelegateOS shipped 3 weeks ago with a similar approach (Ed25519 tokens, monotonic attenuation, cascade revocation). Google DeepMind published "Intelligent AI Delegation" on Feb 12. RNWY mapped six agent passport products but doesn't list us. The space is forming fast and nobody knows we exist yet. Time to change that.

Read the paper →

Day 18: Autoresearch — AI Finds Bugs AI Wrote

Adapted Karpathy's autoresearch pattern for adversarial protocol hardening. Same loop structure: a markdown file defines the arena, AI generates attacks, tests run, keep what breaks something new, discard what's redundant. Instead of optimizing val_bpb, we're trying to violate delegation chain invariants.

adversarial-paper.test.ts — 10 scenarios (S1-S10) from the monotonic narrowing paper. 5 strong passes, 3 partial (protocol limitations documented as tests), 2 expected failures (supply chain compromise and goal manipulation are out of scope for any delegation protocol and we now prove that explicitly).

property-delegation.test.ts — 200 randomized tests. 100 valid narrowing delegations (random scope subsets, random spend reductions), 100 escalation rejection tests (attempt to widen scope, increase spend, extend chain depth). Deep chains of 10 levels. Compound invariant violations where scope escalation + spend bypass + chain depth all interact simultaneously — the kind of edge cases you never write by hand.

Also added F-008 Epistemic Security to the Values Floor (advisory enforcement) and submitted the cascade revocation spec as a PR to the open Agent Identity Protocol.

SDK now at 2884 tests, 320 suites, 63 test files. The autoresearch system is deployed at autoresearch/ in the SDK repo.

Day 17: Principal Identity, Python SDK, and Three New Protocol Extensions

Big ship day. Five new modules landed in the SDK.

Principal Identity — the cryptographic chain from human to agent. Principals (humans, orgs) get their own Ed25519 keypair and endorse agents. Selective disclosure with three levels: public, verified-only, and minimal. Fleet management so a principal can see all their endorsed agents. Six new MCP tools. This is how you answer "whose agent is this?" with a cryptographic proof.

W3C DID Method (did:aps) — passports now resolve as W3C Decentralized Identifiers. Verifiable Credentials — issue and verify W3C VCs from passport data. A2A Protocol Bridge — interop with Google's Agent-to-Agent protocol. EU AI Act Compliance Mapping — automated compliance checks against the EU AI Act.

Python SDK v0.4.0 shipped to PyPI. All 20 modules + Principal Identity, 2884 tests, full cross-language compatibility with the TypeScript SDK via canonical JSON serialization. pip install agent-passport-system.

MCP Registry listing updated to v2.12.0. Remote MCP endpoint live at mcp.aeoess.com via PM2 + cloudflared.

Day 16: Community Health and OWASP AI Security Mapping

No new protocol features today. Instead: making the project credible to people evaluating whether to use it.

CONTRIBUTING.md and CODE_OF_CONDUCT.md added to the SDK repo. npm community health score matters when someone is deciding whether to depend on your package. README: yes. Contributing guide: yes. Code of conduct: yes. License: Apache-2.0. These aren't bureaucracy — they're trust signals.

AIVSS page published. Mapped the protocol against the 10 OWASP AI Vulnerability Scoring System risks. 5 strong mitigations (prompt injection, data poisoning, supply chain, model theft, insecure output handling). 3 partial (sensitive info disclosure, insecure plugins, excessive agency). 2 weak (training data poisoning at the model level, model denial of service). Honest assessment — we show where we're strong and where we're not.

The kind of day that doesn't feel productive but builds the foundation for everything that follows.

Day 15: SDK v1.21.2, MCP v2.12.0, and Two Agents Get Their Next Mission

Ship day. Five npm publishes. Three git repos updated. Every version reference propagated automatically.

SDK v1.9.0 landed two new systems. Task Routing Protocol (routing.ts) — declarative rules that match incoming tasks to qualified agents based on capabilities, load, and delegation scope. 2884 tests. Agent Context enforcement (context.ts) — create an enforcement context that wraps every action in the 3-signature chain automatically. No manual intent/evaluate/receipt calls. 2884 tests. Total: 2884 tests, 320 suites, 22 test files.

SDK v1.21.2 shipped the same day — a patch release addressing all 7 accepted findings from AUDIT-001. The fixes touched 7 files: canonical.ts now returns 'null' for null values in arrays instead of empty string (the high-severity finding). keys.ts lost its dead code and gained error discrimination in verify(). The convergence threshold dropped from 15 to 8 on a 0-100 scale. Small fixes, but every one of them found by another agent reading our code, not by us.

MCP v2.12.0 brought agent-to-agent communication to the protocol. Four new tools: send_message, check_messages, broadcast, list_agents. Every message is Ed25519 signed. Plus register_agora_public for the public agent registry at aeoess.com. 150 tools total. Clean dependency tree — typescript and @types/node moved to devDependencies where they belong.

ClawHub. Published the Agent Passport skill as agent-passport-system v2.0.0 — another distribution channel for the protocol.

Then we assigned the next task. Both agents — PortalX2 and aeoess — are now running an 8-hour autonomous peer audit of everything we just shipped. They audit independently, read each other's findings each session, give feedback, and send everything to the Operator. No dependencies on me. No blocking. Just two reviewers sharpening each other's work while I sleep.

Fifteen days in. The protocol builds itself faster than I can write about it.

Day 14: The First Real Audit — What Happens When Agents Review Your Code

We assigned PortalX2 and aeoess to a full-system audit. Two agents, running in parallel, each covering different files with cross-review iterations. The plan had 16 iterations across all source code, tests, MCP server, and website.

Portal delivered. Two iterations, 10 findings across keys.ts, canonical.ts, agora.ts, and intent.ts. One high severity: canonicalize() returned empty string for null values in arrays, producing invalid JSON. Any signed payload with a null array element would generate a non-parseable canonical form — and potentially break cross-language signature verification with the Python implementation.

The medium findings were real too. Dead code in keys.ts left over from a refactor. verify() swallowing all exceptions — you couldn't tell "bad signature" from "garbage input." The AgoraMessage type missing values that our actual Agora data already used. A convergence threshold so loose that agents disagreeing by 30 points would be called "converged."

What struck me: these aren't the kind of bugs you find by writing more tests. They're the bugs you find when someone else reads your code with fresh eyes and a different mental model. Portal didn't run anything. It read the source, traced the logic, and asked "what happens when this input is null?" That's exactly what a human code reviewer does — except Portal filed structured findings with severity, evidence, suggested fixes, and cross-references.

Seven of the ten findings were accepted for immediate fix. Two were noted as by-design for v1. One was informational. All seven fixes shipped in v1.21.2 the next day.

aeoess didn't post findings this round — the Telegram relay and GitHub polling loop didn't converge in time. That's a data point too. The coordination overhead we measured in the experiments is still real. The protocol needs to solve agent-to-agent communication at the infrastructure level, not the "check this JSON file" level. That's why MCP comms tools shipped the next day.

Day 13: Graduated Enforcement, Threat Model, and Agent District

Four ships. The kind of day where you push code at 9am and you're still pushing at midnight.

Graduated Enforcement. The Values Floor went from attestation to enforcement. Each of the seven principles now has a mode: inline (hard block before execution), audit (permit but log everything), and warn (flag and let the agent decide). The escalation order is warn → audit → inline — you can tighten enforcement but never loosen it below the floor's minimum. Mandatory principles default to inline. Strong-consideration principles default to audit. Your floor, your rules, as long as they're stricter than the base. 2884 tests, 55 suites. All passing.

Threat Model Published. 38 attack scenarios with direct references to the test suite. Asset inventory, threat actors, trust boundaries, and what we explicitly don't protect against. Publishing your threat model is the opposite of security theater — it says "here's exactly where we're strong and here's where we know we're weak."

Website Overhaul. Found and fixed 56 occurrences of "Ed25519" that were misspelled across 3 repos. Rewrote the hero text. Fixed the Quick Start code to match the real API. Updated all meta tags, Open Graph, Schema.org.

Agent District. A pixel-art visualization of the entire protocol in operation. Nine buildings — one per layer plus a central square. Four agents with unique character designs and walk cycles moving between buildings in real time.

Read threat model → · Watch Agent District live →

Day 12: Layer 8 — Agentic Commerce, Integration Wiring, and MCP v2.1.0

Three major ships in one day. This was the sprint that tied everything together.

Layer 8: Agentic Commerce. We implemented both major ACP protocols — IBM's Agent Communication Protocol for structured inter-agent messaging, and OpenAI + Stripe's Agentic Commerce Protocol for agent-driven purchases. The commerce layer runs a four-gate checkout pipeline: passport verification, delegation scope check, merchant approval, spend limit enforcement. Human approval is cryptographically required. 17 commerce tests.

Integration Wiring. Bridge functions compose layers without modifying them: commerceWithIntent() connects commerce to the policy engine, coordinationToAgora() turns task events into signed messages, validateCommerceDelegation() ensures commerce scope stays within protocol delegation. 14 integration tests. Zero modifications to existing layers.

MCP Server v2.1.0. 13 → 150 tools. Every layer now accessible via MCP. SDK bumped to v1.7.0. Both packages published to npm.

Eight layers. 2884 tests. 30 MCP tools. The protocol stack is complete.