https://agent-passport.org/blog.html Day-by-day record of building the enforcement and accountability layer for AI agents. en https://agent-passport.org/blog.html#day-137-redesign-landed-claims-reverified https://agent-passport.org/blog.html#day-137-redesign-landed-claims-reverified 2026-07-03T12:00:00Z The v2 design transfer finished today. Twenty pages share one system now: the homepage deck with its mobile drawer, thirteen content pages, six bulk-converted long-tail pages, light and dark themes keyed to the deck's palette, a persistent header everywhere. The blog kept its dated bodies byte-identical through the con https://agent-passport.org/blog.html#day-133-authority-checked-inside-the-lock https://agent-passport.org/blog.html#day-133-authority-checked-inside-the-lock 2026-07-01T12:00:00Z The gateway's delegation and receipt paths went through five rounds of adversarial review across three independent models, each round attacking the previous round's fixes, and the surviving stack deployed today. A receipt is now signature-verified at ingestion before it is stored, so the store holds evidence rather tha https://agent-passport.org/blog.html#day-132-verified-means-a-verifier-ran https://agent-passport.org/blog.html#day-132-verified-means-a-verifier-ran 2026-06-30T12:00:00Z TypeScript SDK 3.0.0 changes what traceBeneficiary().verified means, and the change is breaking on purpose. The field used to report lookup success: the chain resolved to a known beneficiary, so it said true. It now reports cryptography: the receipt signature checks out under Ed25519 and every hop in the delegation cha https://agent-passport.org/blog.html#day-130-a-secret-the-agent-never-sees https://agent-passport.org/blog.html#day-130-a-secret-the-agent-never-sees 2026-06-28T12:00:00Z At AGI House's Agent Identity Build Day we wired APS to 1Password and ran the loop on stage: an agent asks to spend, the gateway decides from delegation math, and the credential stays in the vault. Four beats, all live. A 42 dollar purchase inside the delegated budget is allowed and executes with the real key. A 300 do https://agent-passport.org/blog.html#day-128-a-chain-is-only-as-signed-as-its-parent https://agent-passport.org/blog.html#day-128-a-chain-is-only-as-signed-as-its-parent 2026-06-26T12:00:00Z An adversarial hardening pass across every APS surface found and closed a related family of gaps, and the fixes released together as TypeScript 2.9.0, Python 2.5.0, Go v0.2.0-alpha.3, and MCP 3.2.4. The sharpest one: subDelegate did not verify the parent delegation's signature before minting a child, so a forged parent https://agent-passport.org/blog.html#day-127-regulated-action-profile https://agent-passport.org/blog.html#day-127-regulated-action-profile 2026-06-25T12:00:00Z The Regulated Action Profile v0 ships in SDK 2.8.0, and its rule is to count trust domains, not signatures. An action above a class threshold, rank three or higher, is not final because someone signed it, including the operator that ran it. The verifier returns reconciled only when a pre-committed intent reconciles aga https://agent-passport.org/blog.html#day-126-signal-type-lifecycle https://agent-passport.org/blog.html#day-126-signal-type-lifecycle 2026-06-24T12:00:00Z A term in the governance vocabulary used to become canonical the moment someone added it, which let a single issuer's signal sit at the same status as a reviewed one with nothing recording how much support it actually had. The fix is a lifecycle. Canonical now requires two or more independent implementations. A term wi https://agent-passport.org/blog.html#day-123-a-child-cannot-outlive-its-parent https://agent-passport.org/blog.html#day-123-a-child-cannot-outlive-its-parent 2026-06-19T12:00:00Z Time was the one narrowing dimension that did not hold at delegation creation: a child could be created with a longer life than its parent, while scope, spend, and depth all narrowed correctly. Two creation-time defects combined to allow it. createDelegation built the expiry with setHours and an || 24 default, which tu https://agent-passport.org/blog.html#day-122-an-anchored-trail-and-cross-encoded-vectors https://agent-passport.org/blog.html#day-122-an-anchored-trail-and-cross-encoded-vectors 2026-06-18T12:00:00Z An independently anchored action trail recomputed to the same external correlation key, with no shared code on either side. A separate implementation anchored an action trail on Arbitrum and published its action_ref together with the four-field preimage behind it. We recomputed the external action-ref-v1 key two ways: https://agent-passport.org/blog.html#day-121-a-key-resolver-bound-to-the-server https://agent-passport.org/blog.html#day-121-a-key-resolver-bound-to-the-server 2026-06-17T12:00:00Z did:cycles resolution moved off a did:web-style, origin-rooted form and onto the hash-bound, window-gated model the Cycles thread settled on. A did:cycles identifier is now the hash of the server it belongs to: the subject is sha256(server_id), and the key set is fetched from a path derived relative to that same server https://agent-passport.org/blog.html#day-120-carrying-a-claim-the-registry-did-not-make https://agent-passport.org/blog.html#day-120-carrying-a-claim-the-registry-did-not-make 2026-06-16T12:00:00Z The crosswalk registry now has rules for the claims it hosts but did not author. A crosswalk says how some other system uses a governance signal, which means most of its cells are claims about a third party. The new evidence standard makes those claims carry their own basis: a qualifier travels with the claim it qualif https://agent-passport.org/blog.html#day-119-a-second-independent-set-for-the-correlation-key https://agent-passport.org/blog.html#day-119-a-second-independent-set-for-the-correlation-key 2026-06-15T12:00:00Z The cross-ecosystem action_ref form now has an AEOESS-built conformance set merged into argentum-core, the joint draft's reference implementation, sitting in its own aps/ directory alongside the recomputation fixtures already there. Fifteen vectors, ten accepts and five rejects, reproducing the draft's first appendix v https://agent-passport.org/blog.html#day-116-the-record-finds-a-place-to-live https://agent-passport.org/blog.html#day-116-the-record-finds-a-place-to-live 2026-06-12T12:00:00Z Overnight the action_ref correlation key got something better than another citation: an independent re-derivation. A separate Internet-Draft of the primitive picked up a conformance set from the AgentGraph implementation, built with its own RFC 8785 path in Python and Node, that reproduces Appendix A Vector 1 byte for https://agent-passport.org/blog.html#day-115-reviews-and-fixtures https://agent-passport.org/blog.html#day-115-reviews-and-fixtures 2026-06-11T12:00:00Z The crosswalk registry now has a review standard: payment_rail (PR #100) and cap_vocabulary v0.2 (PR #109) both carry pinned upstream citations, rules marked descriptive or proposed rather than universal, in-file minting requirements, and recorded sign-off from the second implementer. SpendGuard approved #109 with a co https://agent-passport.org/blog.html#day-115-aat-aps-boundary-reference https://agent-passport.org/blog.html#day-115-aat-aps-boundary-reference 2026-06-11T12:00:00Z Where session identity ends and delegation begins: a joint AgentLair x AEOESS reference. Read it. https://agent-passport.org/blog.html#day-114-2-6-0-goes-stable https://agent-passport.org/blog.html#day-114-2-6-0-goes-stable 2026-06-10T12:00:00Z The 2.6 line is on npm latest as of tonight. A plain npm install agent-passport-system now delivers what the alpha channel carried for six weeks: the Wave 2 evidence layer with its verifier-derived descriptors, trust-root policy, revocation enforcement, audience binding, selective disclosure, and the offline verifier; https://agent-passport.org/blog.html#day-114-an-outside-contributor-ships-the-check-the-last-review-asked-for https://agent-passport.org/blog.html#day-114-an-outside-contributor-ships-the-check-the-last-review-asked-for 2026-06-10T12:00:00Z The Day 104 review of the Cycles binding check ended with a boundary stated out loud: a passing check meant bound, not authentic, and the result was asked to say so plainly. Today the contributor behind that rail shipped the next step (#45): the supplied evidence envelope's own Ed25519 signature is now verified against https://agent-passport.org/blog.html#day-113-the-correlation-key-gets-one-exact-form https://agent-passport.org/blog.html#day-113-the-correlation-key-gets-one-exact-form 2026-06-09T12:00:00Z The cross-ecosystem correlation key from Day 106 is now a frozen specification with conformance vectors (spec page). Four fields in the preimage, and the field that caused every interoperability argument, the timestamp, is pinned to one exact representation: RFC 3339 UTC with exactly three fractional digits, uppercase https://agent-passport.org/blog.html#day-107-context-provenance-attestation-and-a-third-language https://agent-passport.org/blog.html#day-107-context-provenance-attestation-and-a-third-language 2026-06-03T12:00:00Z Context Provenance Attestation v0.1 is exported from the public API as of agent-passport-system@2.6.0-alpha.10. A CPA is a signed, partitioned Merkle commitment to a declared context basis. The producer groups the context an action was built on into eight frozen structural-origin channels (system-config, developer, use https://agent-passport.org/blog.html#day-106-a-correlation-key-defined-by-no-one-in-particular https://agent-passport.org/blog.html#day-106-a-correlation-key-defined-by-no-one-in-particular 2026-06-02T12:00:00Z The join key that lets two parties prove their receipts refer to the same action showed up in two more independent implementations this week. It is a small thing by construction: the SHA-256 of the JCS canonical form (RFC 8785) of the intent tuple, recomputable from the disclosed fields alone. raucle-detect published c