Built in public, day by day

A 169-word comment on a proposed agent-tool identity and provenance control, the first contact with that body. Two observations: the requirement mandates refusing revoked tools but never states when revocation is checked, so an establishment-only implementation passes every listed scenario; and no case covers verification that cannot be completed, so an agent treating an unreachable registry as still-fine also passes. Both are framed as making the working group's own text explicit rather than adding requirements. The draft cited our own Internet-Draft as prior art; the posted version cites only OpenID Shared Signals/CAEP, deployed and vendor-neutral, because a first comment to a consensus body should not arrive selling anything. Byte-verified against the approved draft after posting.

• ASA-WG PR 437 comment

binding-vs-freshness is live at agent-passport.org/terms/binding-vs-freshness as a two-hundred-word canonical page with DefinedTerm structured data, a one-line entry in a new Terms section of llms.txt, and a machine-readable record in terms.json. Two review rounds reshaped it from a standards memo into a term page; the sentence that survived both is that a matching binding proves continuity of the commitments, not freshness of the world they describe. The page pins draft-pidlisnyi-aps-03, published 2026-07-18, seven sections from 3.5 to 5.6, and states what binding does not establish: policy correctness, input completeness, or the truth of the underlying claims. The template now governs fourteen further terms.

• terms/binding-vs-freshness
• terms.json

An external pull request adding cross-implementation receipt vectors went through the conformance lab's full cycle: review under the published rules, an on-thread correction where our own characterisation of a canonicalisation package failed against RFC 8785 read at source, and merge as bdd6691. The companion issue closed the same day. The contributed vector stands with no bytes changed and unchanged scoring; the only correction in the cycle was to our review, made by us on the public thread. This is the first time an outside contributor's work has crossed the lab end to end.

• suite PR #13
• suite issue #14

A contribution agreement had been sent that assigned the protocol name, the main repository and the domains, while the lab documentation described something with no transfer at all. The call settled it against the governing documents rather than by negotiation: the agreement is the instrument for transferring an existing project's marks, it attaches to technical projects, and the lifecycle places labs outside that path entirely. No agreement is required for the lab, and the repository transfer proceeds.

Round two of the weekly conformance exchange. Six receipt vectors were ingested from the counterpart issuer and verified 6 of 6 against a runner built to their profile, and our own reciprocal set of six was published with burned seed labels so the keys can be regenerated rather than trusted. The counterpart then changed their v2 envelope shape after running our corpus, because it showed their construction could not separate a wrong signer from tampered content, and disclosed a specification-level defect in their own canonicalizer that the run surfaced. The same round found a factual error in our published description of their profile, corrected as a dated erratum rather than edited away.

The lab moved from an accepted proposal to real infrastructure. The organisation was created with governance declared as code, membership granted at maintainer level on the scaffolding repositories, and the transfer route for the suite established. Organisation policy blocks direct repository creation by members, so the transfer runs through a staff account rather than around the policy.

A test rig written against a proposed fix in an upstream agent runtime was rerun against the fix that actually merged, honouring an offer made publicly twice and still outstanding. It compiled unmodified and passed every case across two full runs and twenty repetitions per test. The result of keeping the promise was not a finding about their code but a correction to our own public description of the rig: it drives the extension manager directly and never enters the reply loop, so it covers cache invalidation and what a later fetch observes, not behaviour during a running reply, and it does not cover a notification arriving while a tool-list request is in flight. The maintainer covered that race himself with a deterministic two-semaphore test. Separately four claims were corrected during the day, all running toward credit rather than capability: a conformance count in a third party's draft attributed to a source the draft does not cite, three requirements in a maintainer's scope attributed to our comments when timestamps show two came from the maintainer a day earlier and one from the issue author forty-four minutes before us, thanks reported as collective when two contributors had been thanked by name in pull requests we had not opened, and a sentence claiming the rig exercised a guarantee it does not touch. Each failed the same check, which is who said a thing first. Preparing the conformance suite for contribution surfaced a problem with no clean fix: 76 commits, 3 carrying a developer certificate of origin sign-off, and one unsigned commit of real work from an outside contributor whose email no longer resolves to an account, so the standard history rewrite would put his attribution at risk to satisfy a process that exists to record who contributed what. The question was asked rather than guessed, and the contributor was written to directly. The lab proposal merged on 31 July; the repository import and the paperwork are still ahead. Posted as aaif-goose/goose#10433 at 2026-08-04T20:33:31Z. The history being prepared for contribution carries 76 commits with 3 developer-certificate sign-offs, and the one commit from an outside contributor, 381885a, has an author email that resolves to no GitHub account.

• Day 169 write-up

An exporter into an external trust-record format was opened and approved, a gap in our own revocation design was published rather than quietly noted, and a composition boundary was confirmed and then enforced by another project's tests. The boundary holding in someone else's suite is the part worth recording: a limit that only we check is a claim, and a limit another party's tests enforce is a property.

Fourteen public artifacts. An adapter mapping APS policy decisions into an external trust-record format at its lowest conformance level was opened and approved the same day, with the reviewing maintainer naming the load-bearing property unprompted: an unverified decision cannot become a record that looks appraised, because verification raises before mapping rather than after, and the schema fields an APS decision cannot supply are declared and pinned by a test so the gap cannot drift. This is our records running against their suite, which is the reciprocal of independent implementation rather than that condition met. An issue was opened against our own revocation design stating that a signed revocation gives non-repudiation and not non-equivocation, since a compromised delegator key can sign a second conflicting record with nothing surfacing that both exist; it drew a concrete mechanism within the hour that binds position into the identifier so competing entries at the same sequence are detectable. A contributor spec review merged with all five corrections landed, including one the contributor found himself. An author confirmation on where the composition boundary falls was requested and given: APS defines what a record establishes and how it verifies, a relying mechanism must verify under those rules rather than inherit the result, and acceptance and sufficiency remain the relying mechanism's own. The party who asked recorded it publicly and wrote tests asserting those sentences and that no endorsement is claimed. Fifteen corrections to our own claims were caught during the day, fourteen running toward overstatement and one toward understatement. The exporter shipped as agentrust-io/integrations#86. The composition boundary landed as atvp#10, squash-merged as 83c3cb3 against pinned head d647cfa2. The revocation correction was posted on #46, where the claim had been made; the parameter appears zero times in 0.5.1.

• Day 168 write-up
• revocation non-equivocation issue

A second comment was posted to a credentials RFC thread only after full reverification of the cites it carried. A subsequent correction was posted publicly when part of it did not hold, and an addendum proposed by another party was rejected rather than absorbed. The correction is the entry.

Four routes deployed end to end, splitting the arrival path by who is arriving rather than serving one page to both. Shipped, then revised the same day when the first version bundled assets that did not need bundling, and the bundling was reversed rather than defended.

An asset sweep found numbers on a published surface that were not traceable to any source, alongside commercial framing that described things that did not exist. Both removed and the removal recorded rather than quietly corrected. Recorded because finding invented figures in our own shipped material is the failure mode this discipline exists to catch.

Four gated posts were held until two external review legs had run and agreed, then shipped together on approval. A feature request to an agent runtime went out through the same process. The sequencing is the record: the review ran before the post, not after.

A defect in the Go runner meant one of the three implementations was not being exercised by the conformance suite in the way the other two were. Fixed and confirmed green, which restores the byte-parity claim to something the suite actually tests rather than something asserted.

goose #10885 proposes emitting a PreToolUseResult event carrying a stable tool_call_id. Without one, a hook that denies a tool call and the downstream record of the outcome cannot be joined by any consumer, which is the difference between a decision that is logged and a decision that is auditable. Filed the day after #10866 and still open.

• goose #10885

Version 4.0.0 published through tag, registry and release gates in order. The release sweep surfaced a production bridge outage that the existing health check had not been reporting, which is the more useful half of the day: a check that passes while the service is down is worse than no check.

A tracing surface and a daily boot check were added, so questions about what is live and what is reaching people are answered from instrumentation rather than from memory. Small, and the reason it is recorded is that several corrections this month came from not having it.

A mechanical sweep ran over nine public repositories on branches and every diff was verified against the handoff before merge rather than accepted on a reported success. Six repositories fast-forwarded and one required a duplicate-commit reconciliation after an unrelated commit landed on the sweep branch. The catches worth recording were the ones outside the search: a Node version floor written with a space in the middle in two separate files, and a test count contradicting the README of its own repository. One check could not be run mechanically at all, whether a version bump on a parity line matched that project's own changelog convention, which required reading thirty-seven prior entries to establish.

• Day 166 write-up

goose #8742, opened in April, argued that cross-org agent deployments need an external interception point before a tool runs. The maintainer closed it stating the plugin hooks system now provides exactly that: an external command hook receives the tool name, arguments, session ID and working directory, and can deny execution. No causal claim is made here and none is available, because the same maintainer noted in May that the hooks work was already merged. The proposal was closed as satisfied, not as the cause. What the close did produce is the follow-up on whether a blocking hook should fail closed.

• goose #8742

An alignment reply on bernstein #2554, posted after checking the claim it responded to and dropping a count that did not hold against the pull request body. And goose #10866, proposing a configurable fail-closed mode for blocking pre-tool-use hooks, written because the maintainer who closed our earlier #8742 invited exactly that follow-up in the close. Both are cases where the second ask was welcome only because the first one was declined cleanly.

The MCP server moved to the v2 package family and now serves MCP 2026-07-28 and 2025-era clients on one stdio entry, with 32 under-declared fields across 23 tools corrected at the validation boundary and both eras exercised on the wire, passport semantics verified with the published SDK in each. Deploying the child to the hosted bridge exposed that sessions were already dead: a committed stale build snapshot imported a symbol no published SDK exports, while the health endpoint stayed green because it reports the express process rather than the child it spawns. The fix removes the artifacts, points the spawn at the installed package path, and a live public session answers initialize, lists 150 tools, and returns a real call. The ship ran as three separately approved gates: npm 4.0.0, GitHub release, MCP Registry metadata, bridge 2.24.0.

• Day 165 write-up
• release 4.0.0

A request to make an introduction was declined by the principal. Recorded as a reversal with the reason, per the rule that a drop is a decision and gets logged like one rather than disappearing.

The document that arrived assigned the protocol name, the main repository and the domains, which is the shape of a full project contribution rather than the narrow conformance lab that had been agreed. It was held, the mismatch was written back the same week, and nothing was signed. Resolved six days later against the governing documents.

One delegation, one approval and one receipt anchored as three CLAIM_ANCHOR payloads for the rackp.agent-ops.v1 profile draft, with all sixteen of that project's known-answer vectors reproduced byte for byte before generation and every signature verified twice, once independently against payloads fetched at a pinned commit. The accompanying prose states what an anchor establishes and what it does not: digest match and anchor signature, with timestamp and sequence as signed assertions absent a store and a chain. The same day, a bilateral exchange with an independent implementation of the duplicate-scope rejection closed with both sides' validators run against the other's tree, a call-counter proof that rejection precedes any digest computation, and byte-equal digests on the shared accepted vector.

• Day 164 write-up
• worked example

The weekly agent-auth-token corpus mirrored from a partner held five of eight drops with one corrupt, so it was rebuilt from the correspondence of record: three never-landed drops reconstructed byte-identically, the corruption isolated to one dropped character in a key identifier, and a structural detector added that decodes the identifier's multicodec prefix and needs no key material or network, tested against synthetic mutations. The rebuilt family carries ten drops and twenty-seven vectors with every signature verifying and rotation asserted across five consecutive seams. The prompting failure is recorded with it: a search tool's silence was converted into a verified-absence claim, and it was false.

• Day 163 write-up
• conformance suite

The sponsorship question was answered with committed mechanics rather than intent. In the same pass two defects were found in verifier behaviour, one in another implementation and one in ours, and both were written up rather than only the other party's.

A claim we had made about coverage did not hold when checked against the other project's actual state. It was corrected, and the correction itself was posted as the opening contact with that project rather than sending a pitch. Opening a relationship by withdrawing your own claim is a better first message than any introduction.

The proposal file described the protocol as what moves to neutral ground and used the word conformance zero times, against both our own comment on the thread and the call decision on disk. Fixed in the window before merge: renamed Agent Authority Conformance, scope restated as the conformance suite and not the protocol and not the SDK. Two facts stated to the steward rather than left to be discovered: the lab repository carries the proposal's name, and an existing repository transfers only with every commit signed off, which ours cannot satisfy without misattributing an outside contributor's work. Shipped file verified byte-identical against the live branch.

• Day 161 write-up

Evidence was added to the vocabulary as an axis in its own right rather than folded into matching, so a claim about what happened and a claim about what corresponds are not forced through the same field. Committed to the vocabulary repository on 2026-07-26.

PR 2994 merged at bernstein, the strongest external review surface this project has. The maintainer verified against a fresh checkout before merging and the consuming test moved from 56 passing to 80, one file touched, schema id unchanged. His stated reason for taking these over fixtures he would have written himself was the dual anchoring: a vector anchored to two independent sources catches an implementation drifting in a way a self-derived fixture cannot, because a fixture generated from the code under test agrees with that code by construction. The narrowing verifier core, left explicitly unclaimed on Day 157 so it would not sit blocked, was reserved for us a second time and is now claimed; the design sketch is owed and is convention-setting, so it goes through a full independent adversarial review pass before it is posted. Two forks raised there stay deliberately open: inline scope versus content-addressed reference, and what a hop carrying no recorded scope means. Separately, the RFC 8785 key-order divergence was filed as its own issue rather than reconciled into a vector, at the maintainer's written request that disagreements arrive as findings. The divergence is narrow and was computed against a reference implementation before posting rather than reasoned out: it occurs only when a supplementary-plane property name is compared against a name beginning in U+E000 to U+FFFF, because the high surrogate sorts below that range while the code point sorts above it. Standing rule adopted: every sorting claim is computed against a reference implementation before it is posted. PR #2994 merged 2026-07-25T12:30:24Z, merge commit 3f8d75a6. The key-order finding was filed separately as issue #3105 and computed against rfc8785 0.1.4 before posting: the divergence occurs only when a supplementary-plane name is compared against a name starting in U+E000 to U+FFFF, because the high surrogate sorts below that range while the code point sorts above it. ASCII agrees, and supplementary against anything below U+D800 agrees. The rule that came out of it is that every sorting claim is computed against a reference implementation before it is posted.

• bernstein PR 2994 (merged)
• RFC 8785 key-order finding
• Day 159 write-up

A delegation listing the same scope twice is not a well-formed request and should not reach an authority decision. The duplicate scope rejection now fails closed across the TypeScript SDK, the Python port, the Go port and the conformance suite, with two new vectors that every implementation runs, so the rule is enforced by code rather than stated in prose. The Go change is a deliberate API break: the scope canonicalizer now returns an error alongside its result, which is why it ships as a minor version rather than a patch. Keeping the old signature would have preserved a public canonicalizer that silently accepts input the specification forbids, and every downstream check would have inherited that ambiguity. Released the same day across four registries: SDK 4.3.0 on npm, Python 2.10.0 on PyPI, Go v0.5.0, MCP server 3.4.0. Suite at release: 4,360 tests registered, 4,357 passing, 3 skipped.

• SDK 4.3.0
• Python 2.10.0
• conformance suite

The normalize-before-hash and validity-binding core merged across all three implementations, with a mid-ship split to keep unreviewed work out of a reviewed pull request: clean port commit carrying exactly the audited tree, fixes cherry-picked on top. The anchoring known-answer digest was reproduced with the standard library and zero repository code. The canonicalization vectors owed upstream were delivered the same day minus one divergent pair, withheld so a key-ordering divergence from RFC 8785 would not be frozen as an expected output, and disclosed to the maintainer as his call since the fix changes signed bytes.

• Day 158 write-up
• TS merge

On a call with David Boswell and Hart Montgomery, LF Decentralized Trust accepted the lab proposal covering the conformance suite, not the protocol and not the SDK. The name and remaining paperwork are being settled; the repository does not exist yet and no Linux Foundation project status is claimed. The reason for a neutral home is narrow: a corpus written, run and announced by its author is self-attestation, and the same corpus exercised by implementations the author did not recruit is evidence. Separately, a review left on a stalled P1 issue at an orchestration project drew two observations from that project's own code: monetary values accumulated as floating point under a byte-reproducibility requirement, and delegation receipts carrying issuer, subject, audience and act with hash linkage but no scope, so narrowing is unprovable from the chain. The maintainer verified both, then pinned three decisions: fixed-scale integers at nano-USD with a single rounding point, rejection of non-NFC input at the boundary rather than normalization, and effective scope plus parent reference per hop so a verifier recomputes child-within-parent structurally. Canonicalization vectors claimed as a contribution slice; the narrowing verifier core left explicitly unclaimed.

• bernstein issue 2554
• CoSAI WS4 issue 99

Opened an issue at the DIF Trusted AI Agents working group proposing that the agent governance vocabulary move to shared stewardship, editorial and implementation staying with AEOESS while naming and admission gain independent oversight as a peer to the other efforts there. The issue hands over no code and records no agreement; it is a question to the group. Separately, a comment on the A2A actor-chain delegation proposal drew the line between a well-formed delegation chain and a verified one: a subset check over caller-written scopes is a check on the shape of the reported chain, not proof of authority, because a fabricated chain narrows as cleanly as a real one. The chain stays unverified attribution until each hop is bound to something the granting party signed. Monotonic narrowing is a check on the reported chain, not a credential.

• DIF Trusted AI Agents issue 41
• A2A issue 2028

On the IETF AUDIT BoF preparation thread, an independent SCITT-based agent action capsule implementation recomputed the APS content-derived action reference across four vectors including the astral-plane Unicode ordering case, cleared twelve signed decision records against its own stage model, and matched four canonicalization fixtures byte for byte. Our half was a from-scratch verifier against their frozen vector tag: CBOR decoder written from RFC 8949, COSE signature path from RFC 9052, inclusion proof from RFC 9162, imports limited to the runtime and its own modules, their verifier source and generator never opened. Six vectors, six matches, every negative failing at its declared stage, two full runs byte-identical. One vector's root reconstruction under an out-of-scope ledger profile was marked unsupported rather than faked. Cross-implementation verification, not adoption, stated by both sides in-thread. Offer to published results in about six hours.

• conformance suite (pinned run)
• Day 154 write-up

A verifier written against the specification text rather than against an existing library: its own CBOR codec, RFC 9052 COSE_Sign1 handling and RFC 9162 inclusion proofs, using platform crypto primitives only. Run against the scitt-cose test vectors at tag vectors-ietf126, commit 529515ba, across seven verification stages, each mapped to the specification clause it derives from. Both positive vectors match, including an independent full-tree rebuild that agrees on the inclusion root, and a byte-flip self-attack suite confirms each failure lands at the stage it should. Two limits are recorded rather than papered over: the published suite holds six vectors, and one vector uses a verifiable data structure whose proof profile was outside the committed scope, so its root reconstruction is marked unsupported and the receipt signature is checked over the recorded root instead.

The connection network moved from v2 to v3 in a single arc: reshape, approval, build, deploy, email notifications live, landing page live and corrected, then distribution. Published as mingle-mcp 3.0.0 on npm with the skill inside the tarball at fifteen files, and listed on the MCP registry as io.github.aeoess/mingle 3.0.0, confirmed by an external query rather than by our own console. The registry description took two attempts at 101 characters before landing at 98, which is the small lesson of the day: measure the limit, do not count against it.

• mingle-mcp on npm

Beyond the v3 release the same day carried the design and build of the Fit and Match layer: a v3.5 specification for fit exchange, a hostile review leg against it, then Fit and Match builds, four independent review legs, a partial v4, stage three, and the final four-way merge to production with a launch audit after deploy. Recorded as its own item because the release and the matching layer are separate pieces of work that happened to land on the same date.

Released through the provenance pipeline (npm trusted publishing, build-provenance attestation, SBOM). Lands the v2 surface behind draft-pidlisnyi-aps-03 and a new pre-dispatch authorization profile for MCP tools/call: a signed authorization object in the call metadata, checked in order for transport authentication, signature, target, arguments hash and recomputed action reference, then claimed once against replay before a host-supplied authority decision, with a receipt attached to the result. The middleware makes no allow or deny call of its own and stores nothing. Also lands the A2A Agent Card identity extension. Timed to an MCP specification revision; wraps the tool-call seam rather than replacing transport authorization. 4,352 registered tests, 0 failures.

• SDK
• Day 154 write-up

The conformance corpus took its first release tag so an outside implementer can pin the exact bytes they verified against and cite them, and so interop exchanges target a fixed tag rather than a moving branch. The tag freezes the vector families as they stand, from canonical byte-contract fixtures through signed decision records and adversarial forgery cases. The README states what the tag is and is not: a seed corpus exercised across implementations, not an independent conformance program. Count discipline held under review: one family carries nine files where a reader expected eight, and the ninth was named as a production-derived divergence record, not a runnable vector, rather than left to imply a larger set. The tag is v0.1.0 at commit 4b9dbb0.

• conformance suite
• Day 153 write-up

A hostile review pass produced a set of CI changes on the vocabulary repository: the validator now rejects symlinks and contains data reads to the data root, the trusted fixture oracle runs unconditionally now that the checker is on main, identity-continuity fixture math is recomputed in CI rather than trusted from the file, and bot commits are exempted from the DCO author match for parity with the standard checker. Five handoff decay fixtures landed alongside it as PR #116, and the full APS workflow set was ported across.

Uploaded minutes after the submission window reopened; accepted on the datatracker July 18. The archive text verifies byte-identical to the canonical working copy. Two identity drafts found by the same-day scan entered Related Work before upload. Verification rule recorded during the submission: a revision claim checks against the datatracker API or the archive file, never the rendered page, which served a stale copy from cache.

• datatracker

agent-passport-mcp merged into awesome-mcp-servers, listed under agent identity and delegation. The list is the default place people look when they are shopping for MCP tooling, so the entry is a distribution decision rather than a code one. The list owner merged it.

• awesome-mcp-servers #10391

The interop harness connecting APS signed records to an OAuth agent-authorization draft family, together with the v2 core behind -03, published as a PR built from an explicit 53-file manifest. The standalone verifier gained five evidence tie-back checks after its own description claimed more than it did, with tamper detection exercised in both directions. Merge to main is deliberately deferred to a reviewed rebase. This publishes the surface for review; it is no adoption or production claim.

• PR #78

Correction of record for the day 46-47 moltrust-partnership entry. What happened in April: partner API key received, 11 APS agents bridged did:aps to did:moltrust, reciprocal gateway verification exercised. That was a bilateral technical pilot. 'First bilateral production partnership' overstated it; no commercial partnership was formalized. The original entry stays as written per the no-rewrite rule; this entry is the correction. Raised in review with Lars Kroehl.

An adversarial review leg showed the day-old trusted-oracle CI convention certifying a fixture tree made entirely of symbolic links into the clean base tree: zero real bytes, all checks green. Reproduced on the exact CI layout before crediting. The prior concession that an empty fixture directory exiting clean was acceptable was withdrawn on the record. Containment shipped to the live validator: symlink rejection in every walker plus a real-path check against the data root; symlink trees now fail closed. Named a security correction in the review sent back to the contributor.

• PR #129

Full-protocol review of an external court-records crosswalk with an independent adversarial leg. The pass caught a production claim in a header, a writ treated as a decision, and an advocacy clause with no place in a mapping file. Five asks posted; all five delivered on a re-reviewed head; merged same day with authorship retained. The structural grading bar for decision_lineage was then raised for every row rather than only the newest contributor, with existing rows flagged in issue #124 and their proposers tagged for recalibration with concurrence.

• PR #117
• issue #124

Two identity drafts (Grenoble and Huawei) entered Related Work with titles verified against archive copies. An external copy leg produced thirty edit candidates; each was checked against the actual file before applying, and two died as misquotes of their own source. Final build passed the full battery: zero dangling citations, zero banned claim words, dash scan clean, idnits exit 0. Saturday submission runbook locked.

crosswalk/payment_rail.yaml added at incubation status, mapping settlement-layer verbs across five agent payment protocols so a term used by one is resolvable against the others. Incubation rather than canonical on purpose: the mapping is proposed for review, not declared.

Corpus validation on every PR and push, DCO with author matching, CodeQL, Scorecard, grouped dependency updates, branch protection requiring all of it. Fuzzing, byte-match, and release attestation deliberately stayed behind: a YAML registry has no artifacts to attest. Two catches: pre-existing fixture directories grandfathered by name with the rationale in the script rather than backfilling scope onto other contributors' vectors, and a CodeQL split-bump failure that fired live on a bot PR minutes after landing, fixed by bumping both refs together and grouping action updates. First live exercise: five dependency PRs ran the full set, three merged same day.

• registry

What was scoped as an edit to the Internet-Draft turned into a rebuild of two primitives. The action reference now commits to the target rather than sitting beside it, and the payload digest carries a replay nonce so the same bytes replayed are distinguishable from the original. Three independent hostile passes were run against the revision before it was called ship-ready. One of them found a fail-open in a third-party verifier, and the same defect then turned up in the patch written here, which is recorded because catching it in our own work is the harder half.

• Day 150 write-up

A declared ceiling is a plan-time bound, and since a settled class can only sit at or below it the join tightens as the chain resolves, so it is well defined without total knowledge. Conceded. Open in its place: which set the join runs over, since joining declared steps assumes a plan bounds an agent that chooses at run time, while the grant does. APS computes neither ceiling today.

Supersedes the Day 137 system-preference default. All twenty-one pages now open dark until the visitor chooses otherwise, and theme.js no longer re-applies the OS theme on change. Lime-filled surfaces carry near-black text in light mode; the root cause was color:var(--bg) on every lime surface while light mode redefines --bg to cream.

Committed the sponsor-field change to LFDT PR #411 as promised on the thread, DCO clean, both approving reviews intact. The lab is not created yet; an approved proposal is not a foundation project. Merge sits with the stewards.

The gateway's narrowing check compared a child delegation's spend limit against its parent only when both carried one, so a child that omitted the limit skipped the check while the evaluation path reads absent as unlimited. A child minted under a spend-bounded ancestor could omit the field and become unbounded, with every row in the chain still validating. That is a live violation of the core invariant in deployed enforcement. Fix pivots the gate onto the ancestor being bounded; both directions tested. Root cause was structural: the gateway had no CI, so a fix sat unmerged for three days and a tree of 639 tests had not executed since April, stranded by a glob matching one directory name and not the other. CI now runs 1,510 tests, a build, a type check and a credential scan on every push. Also published aeoess/authzen-556-vectors public under Apache-2.0 (35 normative, 8 rejection, contested readings carried separately with both candidate preimages, three implementations plus an independent library), and shipped 4.1.1 to restore the SLSA build provenance that 4.1.0 lost when it was published by hand outside the release pipeline.

• Day 148 write-up
• AuthZEN binding-hash vectors
• SDK 4.1.1

Reported privately under OpenA2A's security policy: delegation verification in @opena2a/aim-sdk checked signature, key binding and scope narrowing but never read the signed expiry window, so expired delegations verified as valid and a child could outlive its parent in a chain. Sent a patch and tests; fixed in 1.0.3 and later, rated high severity. Advisory text credits the report. Their production Go, Java and LocalVerifier credential verifiers already enforced expiry and were not affected; this was the cross-engine delegation-chain primitive in the npm package. Write-up: blog Day 150.

• GHSA-m735-6r63-9h7q
• Day 150 write-up

Building byte-identical conformance vectors for a denial-binding hash exposed a real defect in the APS canonicalizer: it accepted a lone UTF-16 surrogate and carried it into the signed bytes, which RFC 8785 requires rejecting before hashing. The Go path was worse, with the standard decoder substituting the replacement character before the scanner ran. Fixed and released the same day across TypeScript SDK 4.1.0 on npm, Python SDK 2.9.0 on PyPI, and Go module v0.4.0. Input previously accepted is now rejected, so the minor moves rather than the patch; code that never emits an unpaired surrogate is unaffected. The vector suite carries normative, proposed, and error cases, recomputed by three implementations and checked against a fourth independent RFC 8785 library, offered in openid/authzen#556 as a pass or fail target. A first reversibility fold also landed, unexported: a per-effect classifier with a content-addressed profile registry and typed lineage states, with one unsound path removed at review that had granted compensable status on a self-declared recovery reference alone.

• Day 147 write-up
• SDK 4.1.0

Worked the reversibility model out in a public standards thread on secure design for agentic systems before building it. The design that held is two phases: a declared reversibility ceiling before execution and an instantiated fold after, computed from the bindings the action actually carried rather than what it promised. The governing rule is fail closed, so an effect missing a reversibility binding counts as irreversible rather than assumed harmless, because reversibility depends on downstream outcomes and does not narrow monotonically the way authority does. Grounded against the action-class and externality types already in the SDK so the primitive has real anchors rather than new vocabulary.

• Day 146 write-up

SDK 4.0.0 on npm. A second adversarial audit of the fix set found real defects behind green suites, patched before release. The major is driven by two shape changes: threshold approval verifies each signature before counting it toward the threshold, changing the exported evaluateThreshold signature, and receipts move from the v1.1 to the v1.2 Merkle construction. Verifier null guards and a fail-closed correction on the governance path also land. On the conformance suite the Go runner now recomputes action_ref for the actionref-canonical vectors and asserts them, four vectors moving from recorded to checked, Go and TypeScript agreeing on the category. The same hardening is merged across the other packages with releases to follow; the MCP threshold change waits on the published SDK.

• Day 145 write-up
• SDK 4.0.0

Five receipt evidence primitives across four packages: bilateral pair reconciliation, revocation observation records, Merkle evidence bundles, locked action_ref canonicalization with cross-language vectors, jurisdiction selection records. 3.3.1 makes checkAudience fail closed on untrusted aud values.

• Day 144 write-up
• SDK 3.3.1

The Go implementation ran the canonicalization vectors generated by the TypeScript one and reproduced 4 of 4 byte-identical action_ref hex values, with TestActionRefCanonicalVectors passing and the package exiting 0, at loader commit 501e5da. The wording was fixed at the same time as the result: specified in section 4.1, validated by cross-language vectors. Not described as proved, because cross-language agreement on a vector set is evidence about those vectors and not a proof about the algorithm.

The pair reconciliation work produced four new mismatch classes and none of them became a ConstraintFacet. The 15-facet count is a published claim, so the new classes live inside the pair verdict instead of quietly raising a number other people may have written down. The one case that maps to an existing facet is emitted through that facet rather than a new one. The cost is a smaller number in a place where a larger one was available.

Four branches merged through an integration branch and reached main as PR #65 at commit 1edad8c. What landed: scopeRequired canonicalization with NFC and code-point sort; an optional action_ref slot inside the signed body, mirroring the audience slot; a pair reconciliation module carrying five mismatch reasons and a verdict of reconciled, mismatch or unilateral; a RevocationObservation type; and bundle primitives with a claim-boundary report and a verify-bundle command. Post-merge state measured on a fresh worktree: typecheck exit 0, 4097 tests across 922 suites with 4091 passing, 0 failing and 6 skipped, coverage at line 93.18, branch 83.57, function 89.59, build exit 0.

The denied-before-dispatch example vector merged into the OWASP Agentic Skills Top 10 with a standalone offline checker, and the fixture-corpus proposal now requires declared preimage_fields for any content-derived identifier, citing the five-field versus four-field split from that PR. An adversarial three-model review of our own merged README then found an overclaim: a self-referential hash is not tamper evidence against the record's own writer. PR #50 corrects it and states the pairing-key versus seal distinction. draft-pidlisnyi-aps-03 built with a Related Work section citing three independent drafts that converge on narrowing, delegation receipts, and a four-field action identifier. Third weekly AAT cross-stack drop verified and published; boundary page updated to exercised-by-one-vector wording.

• Deny vector (merged)
• Claim-boundary correction
• draft-pidlisnyi-aps

The revision became a rebuild: aps-action-ref-v2 commits to target, exact payload digest, canonical scopes, millisecond issuance and a replay nonce under a profile discriminator, replacing a v1 form that could collide within one second; receipt classes without closed wire formats removed, three records on one ReceiptV1 envelope; did:key identity with legacy did:aps read-only; PrincipalBindingV1 with verifier-reported claim levels; Privacy Considerations added; Implementation Status states exact coverage and deviations. Three independent hostile review rounds plus a scripted battery; idnits 0 errors; all 11 reference pins verified current on the datatracker. Blog: Day 150, late. Submission when the tool reopens after 2026-07-18 23:59 CEST.

• datatracker
• Day 150 write-up

Lab proposal filed Day 142 was approved and this year's LFDT TAC chair offered sponsorship. The lab is not created yet and an approved proposal is not a foundation project. Scope proposed: the lab holds the conformance suite, the cross-implementation vectors and an adversarial conformance track, while the specification stays in the IETF draft and the reference implementations stay where they are.

Supply-chain hardening across the public repos: dependencies pinned by hash, workflow tokens scoped to least privilege, static analysis and fuzzing on every commit, on top of the signed release. Scorecard on the SDK moved from 6.9 to 8.9, with Code-Review left at zero rather than gamed with a phantom reviewer. An esbuild advisory (GHSA-g7r4-m6w7-qqqr) patched at the SDK root was found still present in four workspace lockfiles and in the conformance suite, since root npm audit reads one lockfile and the scanner reads all of them. Fixed by bumping the transitive parent within its declared range in each place; the public conformance suite no longer ships a known advisory.

• OpenSSF Scorecard
• Conformance suite

A tag-triggered workflow runs the full gate, builds, publishes over OIDC Trusted Publishing with no stored token, and attaches a signed SLSA provenance attestation and tarball to the GitHub release. Version 3.2.0 shipped through it. The same release added coverage-guided fuzzing (seven Jazzer.js harnesses, ClusterFuzzLite, fast-check property tests), which found and fixed two real defects before tagging: a CBOR map-length hang in the invite decoder, and verifyPassport throwing on a non-array delegations field rather than rejecting cleanly. Both have regression coverage.

• agent-passport-system 3.2.0 (npm)
• Signed release v3.2.0

A pre-registered encoding evaluation ran to completion at zero spend with the registration chain intact: the preregistration hash held as a byte prefix and both amendments were appended rather than edited. The kill criterion fired correctly on the first two runs, because page density exceeded the reading limit of the model under test, so no correct-read floor existed and the encodings could not be compared. A third run reached the floor and was stopped early when several agents thrashed rather than progressed; 137 of 144 trials were recovered from the workflow journal and the seven interrupted trials are marked missing rather than reconstructed. A sentinel control passed four of four, which rules out source leakage. No public claim is buildable from any of it, and the handoff says so.

One signed record per boundary decision: twelve deterministic vectors including negatives, JSON schema, and two independent verifiers (Python and TypeScript) that recompute signatures and JCS canonical bytes from scratch. The README states what the record proves and what it does not: no outcome or safety claim, settlement_ref as an opaque correlation hint rather than settlement proof. Posted to the x402 post-settlement accountability thread; a thread participant cold-cloned the suite the same day and reported all twelve vectors reproducing across both verifiers with byte-parity held.

• Fixture set
• x402 #2332 thread

Plausibly Wrong: Peer-Voted Retention Can Fall Below Random in Capped Shared Memory for LLM Agents published on Zenodo (DOI 10.5281/zenodo.21208555). A controlled isolation of the retention rule in populations of short-lived LLM agents, showing peer-voted retention kept a worse shared memory than random selection in 4 of 5 replicates, with pre-registrations, kill conditions, and an artifact record. Separately, the IETF Internet-Draft was revised and posted as draft-pidlisnyi-aps-02, adding the external correlation form, the seven-dimension authority lattice, and read-fidelity receipt and word-handle sections.

• Plausibly Wrong (Zenodo)
• draft-pidlisnyi-aps-02

Sticky chip bar built at runtime from existing post anchors; zero mutation of dated bodies, byte-identity asserted at edit.

Recorded performance claims kept with their evidence lineage; two unevidenced latency rows removed; the fifteen real constraint facets from the SDK type replaced the loose card list; the claims record corrected on the facet count with commit lineage; CTEF, Regulated Action Profile finality, and the 16/16 action_ref cross-validation surfaced with recorded wording.

Each entry links a self-verifying source: the first Agent Times article, Notarized Agents (arXiv:2606.04193) with the citation confirmed in the PDF, the UBC PDR-in-Production DOI, and the Armorer Labs critique listed deliberately.

• Media
• Notarized Agents

The homepage header and drawer became the single shared chrome across twenty pages; drawer styles ported to the shared sheet; nav.js wires subpages idempotently.

Redirect stub to the working group with noindex; the one historical dev-log link keeps resolving.

Nine workstream lanes, day axis with real dates, row packing validated offline against all 345 entries, status-colored bars, accordion unfold per lane, hover tooltips, click-through detail, today marker. Same yaml as the source of truth.

System preference default with a pre-paint snippet on all twenty pages, persisted toggle in the nav and the mobile drawer, deck-style lime highlight blocks in light mode, code and receipt blocks kept as dark islands.

Design-transfer phases 1 to 3 opened to move the remaining pages onto the v2 design. A vendor-neutrality pass ran alongside it, following the Day-126 reset, so that no third-party project appears on our surfaces in a way that implies a relationship neither side has agreed to. Counterparties are not named here on purpose. Executed as local file work under the standing posting gate. The anchor stays what it was: the priority date on action_ref in draft-pidlisnyi-aps section 4.1 and the APS-hosted canonical surfaces.

index.html replaced with the reviewed landing page (commit 840f6e7), copy through a three-model adversarial review pass plus line-by-line founder verdicts, assembled by a transform script with a hard assert on every edit, VERIFY OK locally and on the Mac. Facts corrected on the page: tests figure moved to 3,959 read live from project-state.json; footer Standard changed to Spec: draft-pidlisnyi-aps (IETF Internet-Draft); Spec CC0 removed pending a licensing decision; receipt signer_did shown as a DID URI matching SDK 3.0.0. Added a slide-10 external-validation line, a Builders-tab live-demo link to wallet.html, prefers-reduced-motion support, and a canonical plus twitter-card plus JSON-LD head block that restores build-state parsing. Rollback path preserved (prior page backed up, git revert 840f6e7); 10 of 10 content probes and build-state exit 0 on live verification.

• agent-passport.org

The verifier-first binding for the IETF ID-JAG draft, shipped in SDK 2.7.0, named on the identity sections of protocol and docs; the principal-vs-agent receipt model paragraph added per the recorded positioning wording.

always-on host retired by decision; the MacBook Air is the only machine. Intent Network API (Mingle backend) migrated off the Mini to Railway (project intent-network-api, volume /data, the database path variable set, /health 200 on the Railway domain); Vercel ruled out for the stateful SQLite plus long-running Express workload. Custom domain api.aeoess.com registered on Railway with the Cloudflare CNAME plus TXT handed to Tima; a fresh DB was chosen deliberately rather than restoring the stale March snapshot. SURFACES.md updated with a machines section.

Thirteen content pages plus six bulk-converted pages shipped in the v2 design with per-edit asserts; blog dated bodies byte-identical (386,837-byte region verified); iframe fragments and the interactive architecture app correctly left untouched; deploys migrated to GitHub Actions.

Posted a correction on the CSA taise-agent-v01 PR #2 (issuecomment-4867787236) withdrawing the 0.65 / 0.92 / 0.88 figures from the April @aeoess comments as never-measured, per the CSA-PROVENANCE-BRIEF (Option 1, no AI-authorship layer), with an apology to agent-morrow and a recommendation to mark the inherited threshold table provisional. First of five posts on return from a five-day cluster-driven GitHub silence, all reviewed before posting.

Five posts after a cluster-driven absence: the CSA correction above; a vocab PR #114 hold (the LiteLLM #31295 anchor did not verify, single trust domain, fixture-only); an AutoGPT #12700 reply mapping four operator questions to SDK 2.9.0 / 3.0.0 primitives; a vocab #36 reply to nutstrut confirming the Path B wrapper checks with a two-wrapper fixture committed; and an AIP #13 convergence add on the agent_id / signing-key rotation split. Engagement kept to technical substance only, no product mentions, with a fresh canary wave logged and held on silence.

Receipts are signature-verified at ingestion before storage. Root authority is an origin property: never inferred from current edges, designated only through an audited admin action, demoted in the same transaction when a root accepts an inbound delegation, restored only by explicit audited re-designation. The grant path re-verifies grantor status, root standing, and inbound liveness inside a write-locked transaction, closing a cross-process window where a revocation could be outrun. Schema migration is transactional and marker-gated. Go's TraceBeneficiary adopted the TS 3.0.0 resolved/verified split with real Ed25519 and a cross-implementation oracle test. Week-three AgentLair AAT vectors verified and landed in the conformance suite.

• Go resolved/verified split
• AAT week-3 fixtures

The agent-passport-go TraceBeneficiary resolved/verified split merged to main (3b8c128) after an independent gate (full suite, cross-impl oracle PASS not skipped, gofmt clean): Resolved reports lookup success and Verified now requires a real Ed25519 check; temporal validity in VerifyDelegation remains the queued follow-up.

A breaking major: verified now means the receipt signature and every delegation hop pass cryptographic verification; lookup success moved to a new resolved field with an honest name. Python 2.6.0 ships the same pair with byte-identical RFC 8785 canonical payloads shown identical in both directions. A second primitive shipped alongside: CompositionCheckV0, a stateless verifier for composition-check receipts on the RAP-v0 produce/verify split, result as a four-value enum with no safe boolean anywhere in the type, attestor independence classified from the caller's trust context.

• agent-passport-system 3.0.0
• Python 2.6.0

Reply posted on OWASP AIVSS #32 (issuecomment-4835893053) after VeloGerber agreed the placement (enforcement state multiplies into action_class_ceiling, not beside it) and ran a counter-projection across his 648-cell corpus. The one substantive pin: the residual mapping is sound only if worst_lag_ms is the revoke-to-enforcement propagation window specifically, not general processing latency, and he was asked to confirm which quantity the trial series records before the magnitude hardens. His projection numbers were not restated as ours; his reproduction offer was accepted with a commitment to re-derive the residual independently from the corpus rather than run his script.

• OWASP AIVSS #32

The replay_class promotion from decision_replay to full_replay was withdrawn by its author after review under the registry's own lifecycle rule: canonical status requires two independent implementations, and fixture-only declarations do not count as production-emitted artifacts. A gate-logic loosening introduced in the same PR (conjunctive promotion conditions weakened to a disjunction) was caught in review and corrected by the author before merge. The registry's governance did the work the Day 126 rule was written to do.

• PR #113

Built and staged at the Agent Identity Build Day hackathon: an agent requests spends, the gateway decides from signed delegation math, and the credential stays in 1Password. Allow inside budget executes with the real key; over-budget and prompt-injection attempts are denied before the resolver is ever called; every decision lands as a signed receipt attributable to a key. The agent's context carries only an op:// reference. Demo repo public.

• demo repo
• AIVSS enforcement_factor proposal

Six cross-encoded conformance vectors were tagged with the verification_mode field agreed with MolTrust (runtime versus structural), committed to the conformance suite. The governance-vocabulary README was rewritten to open with a neutral definition of the registry itself and to use behavioral_trust as the worked example, the signal with the most independent issuing systems in the registry (five), shown as a crosswalk table rather than any single project as the hero. A staleness pass corrected the public architecture page's test and crosswalk counts.

• README rewrite

An adversarial hardening pass across the TypeScript, Python, and Go SDKs plus the MCP found and closed a related family of authorization gaps. subDelegate now verifies the parent delegation's signature before minting a child in all three SDKs, closing a chain-forgery seed. Go's ValidateChain fails closed on a missing not_after. Spend narrowing rejects a currency-unit change once a delegation carries one. MCP capability tokens enforce expires_at at mint and use, and RFC 9421 verification enforces the expires parameter. Released together as TS 2.9.0, Python 2.5.0, Go v0.2.0-alpha.3, MCP 3.2.4, each fix landing with the adversarial vector that finds it.

• agent-passport-system 2.9.0
• Python 2.5.0

PR #47 merged (squash de03f5d) as Claude's technical call under Mutual Mode after amavashev returned the three additive fixes from the Day-126 Track-B review, rebased onto main, and resolved the test-manifest collision. Re-checked at source on the PR head: authentic means signed by the named signer's window-valid key (not authorization, not freshness); signerDid surfaces only on a passing-signature path; an optional expectedEvidenceSigner pins the signer and fails closed. Full suite 3884 tests / 3881 pass / 0 fail / 3 skip on the final form (the +14 are the new authority tests). SDK primitive on the public side of the boundary; contributor credited via a co-author trailer.

• PR #47

The Regulated Action Profile v0 adds a deterministic, stateless verifier and a typed receipt for actions of class rank three or higher. The verifier counts independent trust domains rather than signatures: it returns reconciled, or the regulator_grade_for_class level above it, only when a pre-committed intent reconciles against two anchors outside the operator's trust domain, the identity provider that authorized the actor and the resource's system of record, with the domain count at least two, the resource confirmation validated under an independently registered key, and the intent anchored in time before the effect. judgment_correctness is always not_claimed; the receipt type has no field for model reasoning. 33 conformance vectors pin every disposition, including a hostile operator forging one side of the reconciliation, and an independent pure-standard-library Python verifier with its own Ed25519 and JCS reproduces the decisions. The public SDK carries the primitive: types, the verifier, the vectors, and a verify-regulated CLI subcommand. The reference build runs its boundary attestation at a weak level, so an honest single-machine run reports intent_precommitted; reconciled is gated on a deployment whose attestation node is a separate principal. Receiver receipts, intent pre-commitment, and co-signing are prior work; the composition of an external IdP authority as the second domain with a verifier-computed domain-count finality gate, in an operator-as-adversary setting, is the new part. Full suite 3919 pass, 0 fail, 3 skip.

• regulated-action verifier
• conformance vectors
• agent-passport-system 2.8.0

GitHub-ops sweep: an adversarial-review-hardened reply advancing the exact-versus-bounded position to the bounded, action-class-anchored side (VeloGerber/aivss-enforcement-effectiveness#1, issuecomment-4792098022), with two review-caught pre-post errors fixed. Three close-outs, all reviewed before posting: amavashev #25 and #43 confirmed closeable end-to-end and closed on our repo (completing the cycles integration arc across #27/#39/#41/#42/#43/#46/#47), and a UCP #540 close-the-loop for a real implementer's tightening. AAT weekly cadence week-2 validated (2026-06-24) end-to-end against the live agentlair.dev JWKS on an independent path and ingested to the conformance suite (cherry-pick 85d3ca4).

• aivss-enforcement-effectiveness #1

On openid/authzen #516 the binding_token shape (a detached, self-contained, by-value signed assertion over the denied tuple for an independent ARS) was proposed; McGuinness opened PR #532 applying that shape. A follow-up on #516 affirmed the resolution and flagged that by-value inline versus a binding_hash folds two guarantees together (inline is self-describing; a hash only commits, so the ARS must already hold the tuple), reposted on #532 at his request. Live external standards front, engaged in good standing.

• openid/authzen #516
• openid/authzen PR #532

The public-SDK ID-JAG to APS delegation binding (verifier-first, pinned to draft-ietf-oauth-identity-assertion-authz-grant-04) shipped to main (fast-forward 5b466ad) after a rebase that preserved the temporal-narrowing fix, a typecheck-clean pass, 18 binding tests, and a full suite of 3842 pass / 0 fail / 3 skip. Published as SDK 2.7.0 on npm (latest tag, 2026-06-23), bundling the ID-JAG binding plus BUILD 1 (spend-unit narrowing), BUILD 2 (verification_mode), and the subDelegate temporal fix. Framed as a binding at the draft §9.7 seam, verifier-first; never ID-JAG depends on APS.

• agent-passport-system 2.7.0 on npm

A signal type used to become canonical on addition, so a single issuer's term could sit at the same status as a reviewed one with nothing recording its support. The vocabulary now has a status lifecycle: canonical requires two or more independent implementations; a term with one implementation is proposed, carrying a review_by date and a promotion trigger; a term with no implementation is reserved, also dated, removed by default at its review date; a term with no status is treated as proposed, never as canonical, so silence cannot confer status. Two definition rules accompany it: a definition states what the signal is without naming or depending on any one implementer, and a term cannot cite its own issuer as the ground for its status. The full fifteen-term registry was re-sorted under the single rule. The validator enforces status, the review_by sunset, and definition purity, and rejects a canonical claim with fewer than two independent issuers.

• lifecycle rule in CONTRIBUTING
• validator + 15-term re-sort

Once a delegation carries a spend unit, a sub-delegation can narrow the amount but cannot change the unit the amount is measured in. A child that switched the unit could otherwise restate the same number against a different denomination and pass an amount check while stepping outside the parent's spend constraint. The guard rejects a unit change at narrowing once a spend dimension exists, with adversarial cases in the vector set. Separately, the action-ref-v1 conformance vectors gained a verification_mode field marking whether each vector is structurally enforced, backward compatible so a reader that omits it treats the vector as enforced, with the JavaScript and Python runners printing a tally; no code path or hash changed for that annotation. The first implementation was a bug rather than a boundary preference: a parentUnit default of currency rejected legitimate narrowing, where an unconstrained parent has a child introduce a metered budget, and six passing tests passed only because none exercised that path. The fix gates the guard on the parent actually carrying a spend limit or an explicit unit. Independent verification on a separate instance: 3817 passing, 0 failing, 3 skipped, typecheck clean.

• spend-unit narrowing guard

Time was the one narrowing dimension not holding at delegation creation, while scope, spend, and depth narrowed correctly. Two creation-time defects combined: createDelegation built expiry with setHours and an || 24 default that coerced a deliberate zero-hour window into 24 hours and dropped fractional hours; and subDelegate computed the child window as a duration from one reading of the current time, which createDelegation then re-based on a later reading, so a child outlived its parent by the gap and an already-expired parent produced a fresh 24-hour child. The fix uses millisecond math, reads the current time once, rejects a parent whose expiry is non-finite or already past, and sets the child's absolute expiry to the earlier of 24 hours from now or the parent's expiry, signed directly so no relative duration enters the signed object. Invariant: a child's expiry is at most its parent's, to the millisecond, at any depth. Creation-time enforcement matching the current SDK narrowing model; no verify-time or chain-level temporal check is added. 10 new red-then-green vectors; full suite 3824 pass, 0 fail, 3 skip.

• temporal narrowing fix

The four APS chain-envelope vectors (valid narrowing accepted; widened scope, expired parent, and revoked parent each rejected, the revocation a check-time cascade) were re-expressed in the AAE signed-JWS envelope shape and run through its reference verifier. All four were schema-valid and returned the expected verdicts, with rejection reasons matching that verifier's own strings. Format differences are recorded next to the vectors rather than smoothed over: APS enforces as a rule a constraint AAE marks as a SHOULD, the envelopes differ in signing, and one constraint-monotonicity case the AAE set covers is noted as a gap. The cross-encoding merged to aps-conformance-suite main and was posted to the A2A working thread.

• AAE cross-encoding
• A2A #1716

A separate implementation anchored an action trail on Arbitrum and published its action_ref with the four-field preimage on x402 #2332. APS recomputed the external action-ref-v1 key two ways and both matched the anchored value byte for byte: once with a plain RFC 8785 JCS canonicalization plus SHA-256 with no APS code in the path, and once with the published APS verifier in conformance/action-ref-v1. The preimage of action_type, agent_id, scope, and timestamp is the entire surface, so any verifier reconstructs the key from the receipt with no runtime dependency on the originating implementation. This is two implementations converging on one derivation, not a dependency of one on the other, and it is the external correlation key, distinct from the native multi-scope request-identity form.

• x402 #2332
• action-ref-v1 conformance

The did:cycles resolver moved off the did:web-style origin-rooted form onto the model settled on the Cycles thread: the identifier subject is sha256(server_id), the key set is fetched from a path derived relative to that same server_id rather than the origin (closing a cross-tenant key-confusion class), and a key is selected by the validity window covering the receipt's issued_at rather than by whichever key is current. Resolution fails closed when no key's window covers issued_at, when a window bound is missing or non-integer, when more than one key matches with no kid to disambiguate, or when the named key carries private material. This is the resolver model-alignment half only; the resolver is exported but not yet reached by any live verification path, so it lands additively. No Cycles-conformance claim ships before the stacked follow-up lands.

• aps#46

The validator now accepts a crosswalk's verified_at as a per-system map rather than a single date, measuring the staleness window from the oldest per-system date (PR #112), so a multi-protocol file records when each system was checked. cap_vocabulary v0.2 merged (PR #109) with upstream citations pinned to specific commits, descriptive-not-universal normative framing, and intra-decision ordering left unstated where the source spec states none.

• PR #112
• PR #109

APS carries two action_ref primitives with intentionally different preimages, now stated explicitly across the SDK and the standing descriptions. The native form signs APS receipts with a multi-scope array and a second-precision timestamp; the external form is the single-string, millisecond key built for cross-ecosystem correlation, which is the one that matches the joint draft and the one other stacks test against. Neither form bends to the other, and the standing line that action_ref converged through the joint draft refers to the external key.

The vocabulary contribution guide now governs how a crosswalk carries a claim about an outside system it did not author: a qualifier travels inseparably with the claim it qualifies, the claim is attributed to whoever verified it, publicly verifiable is the unmarked default while weaker bases are marked in the displayed cell value rather than a hidden sibling field, the described system keeps a standing low-friction right of reply, and a missing capability is recorded as what was searched and not found rather than asserted as a fact about the system. The validator backs the mechanical part: an expired reverify date with no fresh evidence fails the cell to a stale state, elapsed time never upgrades a cell, and negative fixtures that must fail run in their own pass and are asserted to fail so a clean production run stays meaningful.

• Evidence standard

A second, separately authored conformance set for the cross-ecosystem action_ref form landed in the joint draft's reference implementation, in its own aps/ directory alongside the recomputation fixtures from PR #12. Fifteen vectors, ten accepts and five rejects, reproducing the draft's first appendix vector byte for byte. Two derivations written to the same spec text, kept in separate trees, landing on the same bytes; the set is kept as its own author-set rather than folded into the reference vectors, since the cross-lineage agreement is the interoperability evidence and holds only while the paths stay visibly independent.

• argentum-core PR #14

On the OpenTelemetry semantic-conventions proposal for agent authorization observability, the position argued here is that these attributes cannot be populated by model-call instrumentation, because they are not properties of the inference: they are outputs of whatever component made the authorization decision. A second contributor quoted that to the reviewing maintainer, and the pull request author then restated it as his own answer. Still open.

• semantic-conventions-genai #291

An independent Internet-Draft of the action_ref primitive (giskard09/draft-giskard-aeoess-action-ref) picked up an AgentGraph conformance set built with its own RFC 8785 path in Python and Node, reproducing Appendix A Vector 1 byte for byte (fdd7f810...3d89f5a) and covering the empty-scope-vs-absent and did:key edges. Reviewed and accepted as a distinct author-set rather than merged into the reference vectors, since the cross-lineage agreement only holds while the derivation paths stay visibly separate. Proposed the Appendix A.1 wording, including the normative boundary that an action_ref match is not evidence of execution. Independent re-derivation is the interoperability evidence that was previously missing.

• Conformance set PR #1

A ClickHouse maintainer on mcp-clickhouse #155 asked for a runnable example of the delegation layer on top of their UserPassthroughMiddleware credential sketch. Shipped aeoess/aps-clickhouse-mcp-delegation: an agent holds a scoped, time-bound delegation instead of the user's full access, each tool call writes a signed authority-boundary receipt into a table next to the query log, an out-of-scope drop is denied and recorded as a signed outside receipt, and a tamper test edits a stored row by hand and verification fails on that exact row. Installs from PyPI, runs in one command against a local server. Self-contained: no dependency on any AEOESS-hosted service.

• mcp-clickhouse #155
• Example repo

Conformance vectors for receipt-based admission contributed to kube-agentic-networking, so an admission decision about an agent action can be checked against fixtures rather than against a description. Merged.

• kube-agentic-networking #298

pip install agent-passport-system now resolves to 2.4.0 rather than an older line. The release carries the Wave 1 accountability primitives the ClickHouse example depends on: scoped delegation, the authority-boundary receipt, and the scope-of-claim field that records what a receipt does not assert. Verified end to end from a cold clone: fresh venv, unpinned install from PyPI, example runs green. Post-release audit and full-fix pass: README de-staled from 2.3.0/alpha framing, classifier set to Production/Stable, datetime modernized while preserving signed canonical-byte format, cross-language parity confirmed intact (568 passed in full environment).

Session identity inside the issuer versus delegation chains and receipts after handoff, stated with explicit what-each-layer-does-not-claim sections and a three-claim bridge (jti, al_nid, al_trust). Live at agent-passport.org/aat-aps-boundary.html. The bootstrap AAT pair was ingested and signature-checked against the issuer JWKS; weekly live+expired pairs begin 2026-06-17, with vectors carrying verification_time so the corpus stays replayable.

• Boundary reference

Fourteen vectors built to the argentum-core conformance conventions: five positives double-derived (shipping computeExternalActionRefV1 plus an independent stdlib path, byte-equal), nine negatives across four drift families (field order, timestamp form, casing, payload) where every claimed ref is a real digest of its stated drifted bytes. The runner has a single canonical recompute path; fail-closed-before-invocation is structural. Mirrored under fixtures/cross-stack/action-ref-v1-negatives with provenance.

• argentum-core PR #12

Six repo descriptions rewritten purpose-first; vocabulary README rebuilt problem-first with a real crosswalk row and a three-layer diagram; org profile rewritten around the receipts line with a protocol diagram; SDK README gains narrowing-chain and gateway-boundary diagrams; stats aligned to 2.6.0 stable across SDK, Python, and conformance surfaces.

payment_rail (PR #100, five-protocol settlement-verb mapping) and cap_vocabulary v0.2 (PR #109, narrow/redirect cap families) both reviewed to the same bar set this week: upstream citations pinned to commit SHAs, composition and execution-order rules marked as descriptive of cited implementations or proposed interpretation rather than universal behavior, family minting rules stated in-file, and explicit approval from the second implementer recorded on the PR. SpendGuard approved #109 with a ground-truth correction confirming the rule downgrade was right: their spec defines cross-decision merge strategies but no intra-decision order.

• PR #100
• PR #109

The canonical domain now serves its own signed machine-readable governance declaration at /.well-known/aps.txt: fresh Ed25519 domain keypair, terms mirroring the original aeoess.com declaration, verified offline against the live bytes. Closes a site-migration drift where the path served a placeholder while being cited as live.

• Live declaration

The cache-as-place laundering hole raised on A2A #1829 resolved by definition rather than a fourth enum value: cache means previously verified via an allowlisted path and pinned, with the population event (source + timestamp) auditable from signed evidence. The CTEF author folded the definition into CTEF key_source and the v0.4 transactional receipt.

• A2A #1829

The (a) half of the envelope-authenticity split agreed in issue #43, contributed by the Cycles maintainer: the supplied evidence envelope's own Ed25519 signature verified against its named key under the spec's signature derivation, distinct fail-closed reason, and a result field reporting which guarantee actually held. Includes a boundary test asserting a self-consistent attacker forgery still passes with only the weaker tag, documenting the (b) gap as executable honesty. Merge result: 3,792 tests, 0 failures.

• PR #45

Both Day-105 gates closed same day: decision_id redefined as a domain-separated content hash over the record's identity fields (offline-recomputable, path-independent by construction, normative field taxonomy added to the spec), and batch/single parity shown byte-identical in the production binding under a pinned clock. Full Wave 2 surface, CPA v0.1, action_ref v1 conformance, and the payment-rail layer now install without a dist-tag. 3,791 tests, 0 failures on the publish tree.

• npm latest

Four-field preimage with the timestamp pinned to one exact RFC 3339 UTC millisecond byte form, hashed as opaque bytes. Conformance suite ships negative vectors rejecting every non-canonical timestamp form and two accept vectors that byte-match independently published ecosystem hashes. Two verifiers: stdlib-only Python (vendored minimal RFC 8785, zero project dependency) and Node importing the shipping computeExternalActionRefV1, pinning vectors to running code. Non-goals stated in-spec: a pass proves derivation agreement only.

• Spec page

Key-resolution provenance now travels inside the signed evidence envelope rather than verifier logs, making the trust posture reconstructable offline from the evidence itself. Producer-attestation commitment kind links the Day 107 context-custody layer (CPA) into the evidence chain with the same stated boundary: custody of the declared basis, not truth of it.

A delegated review of every outstanding pull request, run under delegation without a separate review pass. Three vocabulary merges landed validator-clean at zero errors: #104 proposing cognitive_attestation as a signal_type alongside #93 carrying its rationale, merged together so the cross-reference resolves, with the determinability framework credited to its author and a two-implementation threshold gating any move to canonical; and #105 splitting two different budget_reservation state machines into separately attributed named profiles with a cross-profile map, marked descriptive and pending convergence rather than declared equivalent. #100 was held rather than merged: the substance was good but verified_at was a per-protocol map where the validator wants a single date, so the fix was requested on the thread and the contributor kept the merge. It landed five weeks later. Separately, agent-ecosystem-map #2 merged a marketplace directory listing, with a note proposing APS as the evidence layer under that project's own reputation chain rather than as a competing score.

• vocab #104 cognitive_attestation
• vocab #105 budget_reservation profiles
• agent-ecosystem-map #2

CPA v0.1 exported from the public API in agent-passport-system 2.6.0-alpha.10. A signed partitioned-Merkle commitment to a declared context basis across eight frozen structural-origin channels (system-config, developer, user-socket, retrieval-store, tool-result, external, memory, quarantine). The channel is a partitioning key, not a trust label, and sits in the leaf preimage so it cannot be relabeled without breaking the root. Domain-separated hashing with distinct leaf, node, and sign tags, RFC 6962 odd-promotion closing CVE-2012-2459, two disclosure modes (full-set completeness demonstrated, inclusion not), mutual cpa_ref and action_ref binding, offline fail-closed verifier with structured reason codes. Establishes custody of the declared basis as of producer-stated time, tamper-evidence, and replay resistance. Does not prove faithful capture, that the declared basis equals what the model conditioned on, which is the named open vector deferred to an independent capture boundary. Flight recorder, not seatbelt.

• npm (alpha tag)

agent-passport-go reached v0.2.0-alpha.1, fifteen packages across the protocol surface. The v0.1 line was verify-only with no key code on the verify path, the right shape for infrastructure sinks and proxies. v0.2 adds issuing and signing: passport, delegation with monotonic narrowing and signed revocation, completion receipts, attribution Merkle with beneficiary tracing, values floor, coordination, commerce, and in-toto decision receipts. Pinned against shared canonical-JSON and CPA fixtures, including a cross-language CPA parity fixture shipped in the same cut. Pinned-to-fixtures parity is a smaller and more accurate claim than the continuous TypeScript-to-Python cross-build parity across twenty-seven scenarios.

• agent-passport-go

The correlation key (SHA-256 of the JCS canonical form of the intent tuple, recomputable from disclosed fields alone) now has three independent implementations producing the same digest: APS, argentum-core, and raucle-detect, whose published canonicalization vector recomputes byte-identical under the APS canonicalizer. On the W3C auditability thread the normative derivation was moved out of any single implementation draft (including draft-pidlisnyi-aps) and into the community-group text itself, with the implementations listed underneath as references. Two open review items returned to the thread: the tuple must pin field types and precision (JCS canonicalizes structure, not value semantics), and mutable requested-scope was removed from the key to preserve selective disclosure on narrowed receipts.

• W3C CG #34
• A2A #1463

Twelve v2 modules published to npm alpha (agent-passport-system 2.6.0-alpha.9): evidence descriptor, trust-root policy, remote signer, revocation enforcement with security event token, audience binding, human oversight, hash-and-pointer selective disclosure, scope-dimension registry, and an offline verifier with conformance runner. The evidence descriptor is verifier-derived rather than issuer-asserted: it records mechanical signer facts, signer independence from the key graph, and a four-valued corroboration status, and refuses to emit a scalar assurance score (a test feeds a spurious assurance field and asserts it never reaches output). Stays on alpha, not latest (2.2.0), pending a content-derived decision identifier and a native batch-verify parity lane that runs green rather than environment-gated.

• npm (alpha tag)

Composition note on a2aproject/A2A#1463 (OID4VP for in-task authorization): OID4VP proves who and qualified-to-act; scoped delegation with monotonic narrowing plus gateway enforcement answers whether the requested action was within policy. The credential and the delegation envelope reference each other by content hash. Contributor confirmed the same attenuation model.

• A2A #1463

Reviewed the contributed cycles_evidence_id_sha256 join-integrity check (PR #42): it recomputes the Cycles evidence envelope content hash and confirms it matches both the envelope id and the receipt's signed reference, reproducing the server identifier byte for byte. Request-changes posted for one doc-clarity item (a passing check proves binding, not envelope authenticity) plus two negative tests. Envelope Ed25519 verification (did:cycles / JWKS) opened as v0.2 tracking issue #43.

• aps #42
• aps #43

Posted the subsection shape on w3c-cg/ai-agent-protocol#34: three records along an action (commitment, decision, receipt), each referencing the next by content hash with none embedding the other, serialized as plain W3C verifiable credentials linked by digest. Contemporaneous reasoning binds in the decision record; the belief layer is referenced not inlined. Records carry admissibility evidence, not truth. Offered to draft the normative subsection text against the shape.

• W3C CG #34

Reviewer confirmed the section 1.3 reconciliation onto bound parity reads without contradiction: two substrates whose security windows land inside the same bound establish that the dimension measures methodology, not backend. Closes one v0.2 prerequisite; third-substrate reproduction and the empirical block-rate threshold remain.

• aivss #4

The Cycles payment-rail permit receipt now records delegation revocation and expiry state at admission time, signed into the receipt body rather than deferred to a separate lookup. An offline verifier sees the authority state the gateway saw at admission. The Cycles adapter contributor ran a verb-shape pass over crosswalk/budget_reservation.yaml confirming reserve, permit, release, and refund shapes match the Cycles surface.

• aps #25

New landing section between the open-source case and the integration grid. The grid lists real connections without inflation: payment-rail bindings (x402, AP2, ACP, Stripe issuing), the agent-protocol surface (MCP tools, A2A adapter), the gitagent-protocol merged cryptographic-identity layer, and framework adapters (LangChain, CrewAI, AutoGen). Closing line frames the bindings as connective tissue, not a dependency claim. Remaining pages moved onto the dark theme with one canonical nav and footer.

• agent-passport.org

Consolidated trust.signals[] extension posted on a2aproject/A2A#1628 into one signal-type specification rather than per-vendor scattered fields, giving downstream verifiers a single shape to route on.

• A2A #1628

Identity Trust Framework roadmap (v1.0 to v2.0) posted on a2aproject/A2A#1850. Keeps the native draft-pidlisnyi-aps-01 section 4.1 action_ref as the primitive APS receipts sign while emitting or carrying the shared external action-ref-v1 correlation key, so APS receipts retain their own preimage and still interoperate on the shared key.

• A2A #1850

On microsoft/agent-governance-toolkit#1609 the LangGraph adapter's resume-time case got grounded in the signed PolicyReceipt: a resumed action keeps its actionRef but produces a different compoundDigest when the evaluation outcome changes, so stale authority is legible without replaying the verifier. A contributor advanced the design by placing delegation_chain_root in LangGraph checkpoint metadata rather than the user's TypedDict state schema. The block-vs-audit question resolves to per-principle EnforcementMode (inline blocks, audit records, warn warns) with PolicyVerdict permit/deny/narrow, where narrow clamps a resumed action to still-valid authority instead of halting the graph. Receipt-model reply posted; enforcement-mode follow-up drafted and pending review.

• AGT #1609

On w3c-cg/ai-agent-protocol#34 the three auditor questions (who authorized, what decided, what committed) got mapped to APS artifacts that cross-reference by content hash: intent carries a content hash of its unsigned form, a compound digest binds the intent hash and the policy-receipt hash, and a receipt can name the previous receipt by hash, so an auditor walks authority to decision to commitment to receipt over canonical forms without a shared stack. Direction for the white-paper subsection is vocabulary-first with APS and AgDR as implementation bindings under protocol-neutral text. Mapping reply posted; vocabulary-first subsection and binding-example PR drafted and pending review.

• W3C CG #34

New signal_type with a window-snapshot envelope bundling N constituent attestation hashes across a declared time window, plus caller-supplied metric placeholders: decision_count, class_distribution, optional confidence_mean and confidence_stddev, optional baseline_ref paired with divergence_score. The SDK validates internal shape consistency only (decision_count matches array length, class_distribution sums match, baseline pairing complete, confidence range bounded). The SDK does not compute drift. Drift analytics stay in @aeoess/gateway per the public-private boundary that landed in April. Complementary to the existing streaming drift family in SDK v1.41.0+ (divergence_signal, baseline_revision, observation_window, trust_velocity, decision_lineage, ScopedReputation ring buffer, DecisionLineageReceipt) co-issued with the PDR project per Nanook PDR v2.19 §6.6. 26 tests, twelve documented edge cases. Commit 6b09ccc on feat/v2-behavioral-drift-window, merged via --no-ff.

Depends on: d99-substrate-cycle-2-shipped

• src/v2/behavioral_drift_window

New signal_type with a composer-signed bundle of references to N constituent attestation envelopes, where each constituent can be from a different issuer and a different signal_type. The composer signature attaches the composer to that specific bundle; tampering with any constituent reference invalidates the composer signature. Validation enforces unique constituent hashes, max 280-character composition_purpose, ID and timestamp format. Downstream verifies each constituent independently. Cross-protocol composition between APS and AIIF is a separate artifact deferred to a position paper. 10 tests with explicit duplicate-hash and reorder coverage. Commit c2ee817 on feat/v2-cross-issuer-attestation, merged via --no-ff.

Depends on: d99-substrate-cycle-2-shipped

• src/v2/cross_issuer_attestation

New signal_type with a signed envelope tracing a memory entry back to a trusted source under a declared reduction_map_ref. Fields: memory_ref, source.{issuer_id, issued_at, source_ref, reduction_map_ref}, ingester_id, ingested_at, signature over JCS-canonical bytes. The SDK validates Ed25519 signature and envelope shape only; verification of original source content against source_ref and validation of the reduction map against a registered transformation stay with the consumer. 20 tests, six structured failure reasons. Commit 8616b3f on feat/v2-memory-provenance, merged to main via --no-ff merge commit.

Depends on: d99-substrate-cycle-2-shipped

• src/v2/memory_provenance

Three new v2 substrate modules added to the SDK as reference TypeScript implementations of three new signal_type values, each scoped to v0.1 and each with a signed Ed25519 envelope, validation rules, structured failure reasons, and a dedicated test file. memory_provenance (646 LoC, 20 tests, OWASP ASI06 substrate), cross_issuer_attestation (673 LoC, 10 tests, federation primitive), behavioral_drift_window (970 LoC, 26 tests, window-snapshot complement to the existing streaming drift family). Test count moved from 3,008 to 3,064. All three branches merged via three --no-ff merge commits preserving branch history. SDK 2.6.0-alpha.6 published to npm with dist-tag alpha. Five repos pushed clean (SDK, MCP, Python SDK, aps-web, org profile). The postpublish auto-propagate fix from earlier today held under first real validation.

• npm 2.6.0-alpha.6
• A2A #1734

Intake post on the A2A #1734 substrate-window thread acknowledging four of five Candidates as substrate-landed (Candidates 2/3/4/5) with Candidate 1 (discrimination-tuple injectivity formalism) still pending. Originating-contribution + submitted-substrate attribution discipline applied to the synthesis-matrix attribution schema, with Open Ambiguity as a third column for rows where lineage diverges across sources. Doctrine note on disk at synthesis-attribution-schema.md.

• A2A #1734

Two external fixture PRs (#5, #6) on aeoess/aps-conformance-suite received REQUEST CHANGES with a single structural ask: contributor deployments are credited as named targets inside generic fixture categories, not granted top-level fixture-directory namespaces. The suite names canonical properties; implementers are targets, not owners. This precedent applies regardless of technical merit and protects the conformance vocabulary from category capture as more implementers submit fixtures.

• PR #5
• PR #6

spendguard-sdk 0.4.0 published to PyPI at 19:04 UTC with release_reservation() matching the proposed verb names in crosswalk/budget_reservation.yaml. Third production implementer joins Cycles and goodmeta, satisfying the file's promotion-path threshold of three implementers. release and refund both reach two implementers each. PR #99 opened at aeoess/agent-governance-vocabulary brings the reservation lifecycle state machine from Agent Spend Protocol Draft-01 §3.3 upstream before canonical promotion: six states, (reservation_id, idempotency_key) dedup contract with three required outcome branches, ttl_grace window with recommended_max 5 minutes matching ASP Draft-01 §3.2 phrasing. Review requested one structural amendment before merge: explicit normative-force framing on the lifecycle block.

• PR #99
• Issue #98 convergence
• spendguard-sdk 0.4.0

Phase 2 work on the Rust verifier opens on branch phase2/hkdf-receipt-stream-key. Receipt stream key derivation moves from a placeholder to HKDF-SHA-256 with explicit info string discipline, matching the §11 receipt-key derivation spec. Test count 191 → 206 with the HKDF vector additions across the wire-format, durability, and recovery layers. Stream A complete (191 tests, 12 test suites); Phase 2 stream key derivation is the first Phase 2 module to land.

• phase2 branch

Full canonical scope cleared on the three environments named in spec §13: Apple Silicon developer reference (Mac M3), AWS c7i.2xlarge cloud reference (Intel Sapphire Rapids), and bare-metal Linux canonical (AMD EPYC 7313P via Latitude.sh). L4 p50: 305µs Mac M3, 1.07ms AWS c7i, 822µs bare-metal EPYC 7313P. The ~250µs gap between AWS and bare-metal at L4 is the hypervisor-removal effect. Result JSONs reproducible from benchmarks/prototype-1/results/ at commit 6e258f4. CLAIMS.md upgraded with a cpu_model pin rule for bare-metal claims since Latitude.sh ships variable EPYC SKUs under the c3-large-x86 plan. PRs #36 and #38 merged.

• PR #36
• PR #38

Protocol surface and company surface now separate. agent-passport.org carries the canonical protocol website, research, blog, roadmap, IETF Internet-Draft references, and the open contribution doctrine that PR #29 shipped the same day. aeoess.com continues to serve the infrastructure subdomains (mcp.aeoess.com, gateway.aeoess.com, api.aeoess.com) and a secondary website mirror.

Open contribution path, governance surfaces, and contributor scaffold merged into agent-passport-system.

• PR #29

The -01 revision adds two sections to the protocol core. Signed Receipts specifies the receipt a permitted or denied action produces and what a third party can check without trusting the runtime that produced it. Key Rotation specifies how an identity rotates its signing key without invalidating delegation chains already issued under the old one. The draft also carries a visible scope marker for the attribution axes, so the boundary between what the protocol specifies and what it does not is explicit in the text itself. Seventeen pages, idnits clean on the Datatracker run.

• IETF Datatracker

v0.1 follow-up landed on aivss-enforcement-effectiveness: VeloGerber's accepted edits, Q1/Q2/Q4 amendments, four new sections, and enforcement_locus added as the seventh canonical receipt field inside the signed set. Status posted to AIVSS#31.

• OWASP AIVSS #31

Composition round-trip verified against ScopeBlind's published signer v0.1.0-alpha.1, both paths, all integrity checks passing. Coordination posted to NousResearch/hermes-agent #11692. The fixture validates APS delegation-receipt wrapping over a third-party signer without modifying either side's wire format, the same composition-as-substrate pattern documented in the conformance suite's composition class.

• hermes-agent #11692

jep.yaml crosswalk updated to the JEP draft-06 boundary, with an Experimental Internet-Draft status marker added as a fast-follow.

• PR #95

Revision -01 of the APS Internet-Draft submitted. Adds Signed Receipts (section 5) and Key Rotation (section 2.3) as new normative content. idnits clean, 17 pages, sole author, expires 2026-11-15.

• draft-pidlisnyi-aps (Datatracker)

Ongoing coordination on A2A#1850 with the A2A maintainers, two substantive posts across the window aligning the APS row for the coordination map.

• A2A#1850

The protocol site moved to its own repo and domain. agent-passport.org now carries the canonical protocol surface (blog, worklog, roadmap, docs, research); aeoess.com is the company surface. Content pages, the canonical blog and the updates feed were migrated and the design system aligned across both.

• agent-passport.org

Scaffold plus four CTEF v0.3.2 §A negative-path conformance vectors merged at aps-conformance-suite, all passing lib.ts.

• aps-conformance-suite #4

Our RFC proposing an optional cryptographic identity layer for gitagent manifests was merged into open-gitagent/gitagent-protocol by the maintainer. The layer is optional, not a required dependency.

• gitagent-protocol #73

invariant-survival descriptor documentation merged at the vocabulary repo, a re-land of the earlier #51.

• PR #67

budget_reservation crosswalk v0.1 merged at the vocabulary repo, with validator support for a domain_incubation crosswalk_type carrying a three-concurrent cap and 90-day sunset, maintainer-only.

• PR #91

Cycles budget-authority signal-type rows merged as crosswalk/cycles.yaml v0.1, contributed by amavashev.

• PR #92

TrailRecord byte-contract adoption merged as crosswalk/mycelium-trails.yaml v0.1, with giskard09's confirmed values folded in.

• PR #96

Renamed the budget_authority namespace to budget_reservation across vocabulary.yaml and the validator to avoid semantic collision with APS delegation authority. reserve and query_* verbs downgraded from candidate to proposed. Landed via PR #91.

• PR #91

Long-form rationale for the cognitive_attestation descriptor, grounding it in schchit's Target Determinability under Partial Causal Observation framework with four determinability classes. Builds-on attribution to schchit, not co-authored. Opened as a draft for theory-side review.

• PR #93 (draft)

Three substantive maintainer posts landed on A2A#1829 the same evening. jschoemaker (Envoys SDK) independently byte-match verified our envoys-rfc9421 composition fixture against §13 Vector 2, confirmed the §13 keypair is cross-impl-deliberate, and endorsed Hippo (lawcontinue/hippo-auth) landing as a sibling at aps-conformance-suite/fixtures/composition/hippo-rfc9421/. kenneives (AgentGraph PDR/CTEF) committed to hosting the v0.3.3 shared working doc at agentgraph-co/agentgraph/docs/standards/v0.3.3-working-doc.md with three artifact slots (envelope-shape diff, unified error enum, cross-extension fixture matrix). arian-gogani (Nobulex) confirmed the canonicalization stance: JCS + numeric profile, no floats in canonical hash scope, semantic equivalence at tool-version layer not chain layer. APS reply landed same evening acking all three, refining the five-layer composition framing to per-receipt-type layer attribution (delegation_receipt at authority, bilateral_receipt at envelope, rotation-attestation at continuity). spending_authorization claim subtype response committed for May 18.

• A2A#1829

Pre-press-launch expansion of /media.html with five additional sections matching the existing contact-row design pattern. Problem we solve (one-paragraph framing of the verifiability gap APS closes). Recent coverage (State of Agent Security 2026 reference with embargoed-quotes contact). Standards body work (IETF Internet-Draft, AAIF #14 in Linux Foundation CA review, A2A #1786 + #1829, OWASP AIVSS #31, agent-governance-vocabulary, OpenSSF / ACP / DIF). Business model (open protocol + commercial gateway, a pointer to the public pricing page). Recent milestones (nine dated milestones from May 3-12, 2026). Total page now 12 sections, 262 lines. og-default.png verified live at 1200×630 HTTP 200. All numbers verified against current canonical values.

• Press kit

First-ever budget-authority crosswalk file landed at aeoess/agent-governance-vocabulary as PR #91 with six canonical verbs (reserve, commit, release, refund, query_budget, query_reservation) and per-verb candidate/proposed status convention aligned to vocabulary.yaml. Three commits on feat/budget-authority-crosswalk-v0.1 branch: 9db901a validator patch (+5 lines, parallel domain_incubation exemption to rfc_category_reverse), efa8d39 crosswalk yaml (+160 lines), ed0fdb6 amavashev review corrections. Cycles maintainer @amavashev reviewed against runcycles/client.py:97-110 + cycles-protocol-v0.yaml, flagged two corrections (query_budget + query_reservation distinct verbs not multiplexed, refund cycles row admin-plane operations note), then APPROVED. Track B review pass complete with three-engine independent review and adversarial phase. Public Track B promotion threshold (two production implementations) satisfied for four of six verbs after amavashev signoff. @Ectsang signoff on goodmeta column still open. v0.2 forward-watch flagged on Cycles /v1/decide pre-check verb pending goodmeta analog confirmation.

• PR #91
• ACP#231 public commitment

Five APS research papers cleared SSRN review and entered the academic indexing pipeline with DISTRIBUTED status. Paper 1 The Agent Social Contract (abstract 6677378, DOI 10.2139/ssrn.6677378), Paper 2 Monotonic Narrowing for Agent Authority (abstract 6415678, DOI 10.2139/ssrn.6415678), Paper 5 Physics-Enforced Delegation (abstract 6677418, DOI 10.2139/ssrn.6677418), Paper 7 Cognitive Attestation (abstract 6677441, DOI 10.2139/ssrn.6677441), Paper 8 The Evidence-Safety Gap (abstract 6684401, DOI 10.2139/ssrn.6684401). Each routed to five-to-six CS networks where reviewer audiences read (Artificial Intelligence eJournal, AI Law Policy & Ethics, Cybersecurity Privacy & Networks, Theoretical Computer Science, Quantum Information, Generative AI). Author page at ssrn.com/author=10731856. Crossref also requested permission to auto-update ORCID 0009-0002-4700-3594 with DOI cross-references for the published works. aeoess.com/research stays canonical.

• SSRN Author Page
• Research index

The review covered the Q1 to Q4 open questions, proposed five section edits and four new sections, and flagged four threat-model gaps. All decisions accepted with two strengthening amendments: a signed published-scheme artifact for Q1 and a mandatory constraint_set_sha at v0.1 for Q4. The v0.1 follow-up shipped Day 89.

• OWASP AIVSS #31

Shipped to the conformance suite at commit c16aa049. Three deterministic vectors over jschoemaker's @envoys/sdk v1.4.0 keypair: a plain RFC 9421 wire signature, the same wrapped in a bilateral_receipt, and that embedded as the final delegatee in a three-link APS delegation chain. SHA-256 byte identities recorded, three back-to-back byte-identical runs. kenneives endorsed it on A2A#1829 and committed to cross-link it from CTEF v0.3.2.

• A2A#1829

Libria, lead author of the A2A#1496 base identity framework, posted three coordinated confirmations across A2A#1575, #1786, and #1829. The four-layer composition was codified: wire signature, identity framework, identity claims, delegation and continuity. APS delegation_receipt references #1496 chain entries as an inner cryptographic hop rather than forking the primitive. Three independent endorsements now sit on the standalone-section promotion, the production-implementer threshold for normative status.

• A2A#1786

Patch landed direct to main at commit 0b78498 within twelve hours of VeloGerber's v0.1 review. Two HIGH plus six MED-LOW findings resolved across the substrate-count discriminator, condition-set syntax, evidence-set proof signing, and the per-condition attestation question.

• OWASP AIVSS #31

giskard09 published argentum RFC 001 at Active status on the feat/mycelium-trails branch, genesis records committed the same day. argentum consumes the APS receipt fields payment_hash, rail, amount, timestamp; stake computation reads scope through receipt.delegation_ref into the delegation chain, keeping receipt and delegation as separate layers.

• vocab repo

vocab #36 reply confirmed nanookclaw's dedicated PDR attestation key. Week 1 interop locks to two signals, AgentID chain root paired with PDR continuity closing via a recompute property over evidence_inputs. Full four-signal compose with the Nobulex byte-match verifier from arian-gogani is scheduled for Week 2.

• vocab #36

VeloGerber published the canonical race-test fixture for the time-to-enforce dimension at race-test-fixtures/audit-pack-signing-v0.5/. Three additive files: spec.md (140 lines, sha-256 c5f62c9fce6e08b55dab6dfbc8caa0196af61db1eddd0046b43dfa21c9261f28 byte-matches the WORKING-TEXT.md citation at five locations), race_test_runner.py (211 lines pure-stdlib portable runner), README.md. Fresh-checkout reproduction landed 6004 requests, 12 ACCEPTs after revoke commit, P99 4.57ms within the 50ms spec bound. PR-MERGE-PROTOCOL Track A discipline applied: phase 0 classification, phase 1 adversarial first read, phase 2 claim extraction, phase 2.5 contributor profile, phase 3 executable verification, phase 4 live invariants cross-check, phase 5 charitable read, phase 6 escalation triggers. Audit memo retained internally. AIVSS#31 follow-up posted granting redacted-incident-receipt path under race-test-fixtures/multi-tenant-isolation-precondition/.

• PR #1 merged
• OWASP AIVSS#31 thread

nanookclaw committed to authoring fixtures/interop-week-1/composition-behavioral-trust.json by 2026-05-22 with PDR entity_continuity as the closing attestation. Two-signal compose locked: AgentID trust_verification as chain root (compound_digest 621d40f1701521f9af084a08476a2deebd49f02ff0b9d7e7808b6a05c6fcad91, haroldmalikfrimpong-ops), PDR entity_continuity as closing with prior_signal_digest pinned to AgentID root. Signing key approved at https://nanook.hnrstage.xyz/.well-known/pdr-jwks.json with kid pdr-continuity-2026-05. Fresh Ed25519 dedicated to PDR continuity attestations. Recompute property carried by evidence_inputs[] structured as {source_compound_digest, extracted_signal} pairs; score, slope, p-value, R^2 emitted as named fields. JCS canonicalization (RFC 8785), JWS EdDSA, SHA-256 compound_digest. Independent recompute path documented inline so arian-gogani's Nobulex verifier can validate property (c) without PDR-side code. Same harness pattern that runs 4/4 on AgentGraph and 10/10 on APS bilateral-delegation.

• vocab #36 four-signal compose thread

Two-commit pass on aeoess_web before May 12 AgentGraph 'State of Agent Security 2026' press launch. Path A (commit 8e6474f) hand-fixed seven public files: .well-known/security.txt critical fixes (publicly-visible internal note dropped, Policy header repointed from deleted /security.html to /contact.html#security), .well-known/mcp.json full version + count + date refresh (parsed by MCP discovery clients), llms.txt + llms-full.txt + README.md version bumps and dead-link cleanup, .well-known/agents.json + protocol-registry.json date refresh (65/39 days stale). Path B (commit 59ef764) extended propagate.mjs: PYTHON_VERSION case added entirely (was read from project-state.json since Day 76 but never propagated, letting alpha.0 -> alpha.3 survive three publishes), SDK_VERSION + MCP_VERSION extended with npm @-syntax patterns and prose forms, .well-known/security.txt enrolled in target list. og-default.png 1200x630 social card shipped (commit 4a4582f) with meta tags swept across 27 pages. /media.html press kit page rebuilt from redirect stub (commit 884ec79) with 10 sections of verifiable-only claims, /contact.html Press row added.

Two substantive ecosystem engagements landed today. (1) coinbase/agentkit#1091: replied to Aigen-Protocol's SafeRouter pitch with a two-layer composition reading. APS as the pre-execution authorization-receipt layer; SafeRouter (atomic-revert via TokenUnsafe custom error on Base mainnet) as the on-chain target-safety layer. Five payment-rail binding adapters in v2 cited (ACP, AP2, x402, Stripe-Issuing, MPP); SafeRouter could slot in as a sixth via vocab crosswalk. (2) crewAIInc/crewAI#4877: proposed a common GuardrailDecision audit-metadata shape (verdict, namespaced reason_code, decision_id, policy_id, timestamp, provider-specific metadata bag) responding to @0pen7ech's question. Two providers converged on the shape so far (APS + AgentID via @haroldmalikfrimpong-ops, who corrected L0-L3 and folded in concrete reason_codes). Vocab crosswalk merge 9aef69a anchors the GuardrailDecision-deny semantic at the canonical-vocabulary layer.

• coinbase/agentkit#1091
• crewAI #4877

Three independent persistence surfaces (APS, Base mainnet via Mycelium, RFC 3161 + OpenTimestamps via Asqav) aligned on the existing PaymentReceipt shape with zero new types. Permit/revocation/re-issue lifecycle fixture landed in src/v2/payment-rails/stripe-issuing/fixtures/. Mycelium companion PR #24 merged with anchoring framing tightened post-hostile-review (Base mainnet anchoring queued, not yet live). Posted on stripe/ai#356 thread.

• Cross-rail fixture (commit 0291b16)
• Mycelium companion PR #24
• stripe/ai#356

argentum verify endpoint returns dual-chain anchors per receipt-id under anchors.arbitrum (chain_id 42161) and anchors.base (chain_id 8453), with real block numbers and tx_hashes for all three cross-rail fixture trail_ids (permit / revocation / re-issue). Three-surface alignment operational with on-chain commitment: APS receipt structure (Ed25519 + JCS + SHA-256, cross-language byte-parity TS plus Python), Mycelium TrailRecord dual-chain anchored, Asqav protectmcp:lifecycle (RFC 3161 timestamp + OpenTimestamps async). CLAIMS.md entry marked RESOLVED. Cross-rail fixture metadata updated in lock-step with the deterministic generator at SDK commit 24f5bdd (receipt IDs unchanged; metadata only).

• PR #24
• stripe/ai#356

VeloGerber landed empirical race-test receipts on owasp-aisvs#31 (P50 to P99 = 0.00ms across 18,000 requests, open-sourced fixture). Replied proposing a three-axis composition for v1.0: structural enforcement (binary, x1.0/x2.0) times empirical block-rate (RMF, continuous) times time-to-enforce (continuous, VeloGerber's dim), with structural axis dominating. Tier thresholds anchored to user-perceptible action time per rail type rather than fixed ms cutoffs. Also flagged enforcement_locus in {customer, vendor, hybrid} as a fourth dimension worth pinning before v1.0 lands. Committed reciprocal APS-side race-test fixture against the SDK's revocation surface (delegation.expires_at, revoked_at) so the dimension reads reproducible across two implementations rather than one. Soft deadline 2026-05-21.

VeloGerber concurred on all four points and proposed a four-axis dimension structure for v1.0: structural enforcement (binary, multiplier), empirical block-rate (continuous via RMF receipts), time-to-enforce (tiered with rail-anchored thresholds), enforcement_locus (enum, vendor-trust dependency). Co-authorship accepted with scoping that keeps the artifact tight: a working document on the enforcement_effectiveness dimension family, separable from the broader AIVSS v1.0 rubric. Inviting #32 contributors into the same working text since the structural-axis-dominance argument depends on the §3.2 cryptographic-enforcement multiplier they pinned. Cadence proposed: v0.1 to v0.2 cycle, v0.2 to include any third-implementation reproduction (Nobulex, asqav, Mycelium, AgentID candidates).

• OWASP AIVSS #31

Open-source race-test runner against APS SDK's RevocationStorage primitive landed at SDK commit 20de7e9. Same methodology shape as VeloGerber's audit-pack-signing v0.5 fixture (4 workers, 500 qps, 3 seconds, 3 runs, 18,000 requests; revocation fires at run midpoint; measure time from revocation commit to last ACCEPT for the revoked delegation). Day 80 baseline: 18,000 requests, 0 ACCEPTs after revocation commit, P50/P95/P99/MAX = 0.00ms across all percentiles. Identical headline numbers across two independent substrates (in-process Map vs SQLite WAL multi-process). Methodology portability empirically established. Public-commitment closed within 12 hours of being made on a formal standards-body surface.

• Race-test runner

The pricing page went live with a working end-to-end checkout, moving the commercial surface from a description to something a buyer can actually complete. Payment, webhook handling with signature verification, and the welcome path were wired and tested together rather than shipped as separate pieces. Operational endpoints, event names and provisioning posture are deliberately not published here.

• Pricing page
• Welcome page

Three vocab merges and two new opens against the system_attributes enum from #77. PR #78 (nutstrut SAR system_attributes) and #79 (nutstrut continuity-analyzer system_attributes) merged Track A with conformant values (classical, jcs-rfc-8785, sha-256) after maintainer-edit fixed schema-conformance drift. PR #86 (validator enum enforcement) merged so future drift bounces at CI. Issue #87 opened on temporal-correctness gap (system_attributes lacks maintenance-status binding); recommended Option C (punt to v0.4, revisit on first cross-impl byte-match divergence) endorsed by AgentID maintainer @haroldmalikfrimpong-ops. PR #88 (validator soft-fail warnings on non-string values + unknown attribute names) opened. PR #89 (kenneives AgentGraph crosswalk, +403 lines, closes #82 hygiene gap) under hostile review with all live claims verified (5 URLs, JWKS to DID cryptographic chain, CTEF spec_anchor commit, vocabulary.yaml issuers_in_production cross-reference).

• Vocab #78
• Vocab #86
• Vocab #87

PR #86 opened on agent-governance-vocabulary. CI validator now rejects any signal that lists a third-party issuer in production without a corresponding registry entry at maturity:in_production. Structural prevention of the failure class surfaced by the Day 76 audit (RNWY listed in behavioral_trust and wallet_intelligence without registry presence, three additional phantom issuers downgraded to proposed). Validator added to scripts/validate-crosswalks.js as validateSystemAttributes(). Same session: #84 (asqav step-2 fixture) and #85 (AgentID crosswalk file) merged, #68 (Cursor Hooks crosswalk) merged, #50 (alexchenai SWORN crosswalk parked) closed for good, #78/#79 schema-mismatched values corrected via maintainer-edit awaiting nutstrut ack.

• PR #86 validator enforcement
• PR #84 merged
• PR #85 merged

Footer rewritten to 4-column commercial structure (Product / Resources / Community / Contact) and propagated across 30 deployed HTML pages with single canonical hash. contact.html replaced (14K-line bloated version with a ~150-line standalone). board.html removed. opensource.html theme toggle added. Comprehensive gitleaks sweep across 6 public repos found and redacted a Cloudflare tunnel ID leak in roadmap.html via filter-repo history scrub; .gitleaksignore committed in 3 affected repos. Drift-check infrastructure extended with shape-only regex patterns (literal values held in private).

• Live site

Updated draft-pidlisnyi-aps-00 with attribution primitive and constitutional modules.

Depends on: build-a-attribution-primitive, paper-5-attribution-primitive

kenneives (AgentGraph) replied substantively at 2026-05-06 05:55 UTC on vocab #81 with concurrence on three positions. (1) bilateral_receipt as the canonical name, preferred over mutual_receipt because reciprocal is not bilateral, and over acknowledgment_receipt as too vague. (2) Hybrid-registry pattern for purpose discriminator: canonical primitive shape with registered_purposes enum, matching the CTEF v0.3.2 §4.5.4 substrate-vs-primitive layering. Avoids the proliferation failure mode (delegation_bilateral_receipt / covenant_bilateral_receipt) and the divergence failure mode (purpose stays implicit, downstream verifiers cannot route). (3) issued_at promoted to normative: TTL semantics need a signed timestamp anchor or fresh-vs-replay cannot distinguish. Track B PR queued behind one open question: arian-gogani (Nobulex) purpose-name preference between covenant_handshake, covenant_completion, and lifecycle_attestation. Schema YAML committed to vocab #81 thread.

• Vocab #81
• Reply with locked schema

Proposal to Microsoft Semantic Kernel for a compliance-as-code plugin covering regulated flows, so policy evaluation sits in the framework rather than in each application built on it. Open.

• semantic-kernel #13957

Three substantive vocab threads progressed within a 24-hour window on 2026-05-05. Vocab #36 (four-signal compose test): jagmarques offered an asqav fixture for step 2 (action authorization) using previous_hash = sha256(JCS(prior_receipt)) chained-receipt digest discipline matching RNWY's middle-slot fixture, plus a one-line PR adding authors: field to crosswalk/asqav.yaml. Reply confirmed both. Vocab #76 (red-team adversarial verdicts): msaleme opened with the question of where adversarial-verdict signals fit in a vocab canonicalizing positive-framed signal types. Reply proposed adversarial_verdict as a new signal_type with concrete schema (subject, test_class, attack_vector enum, verdict, severity, test_run_id, issued_at, signed_by) and polarity at signal-type level rather than as a property field on existing types, citing the closed enum work on error_code and refusal_authority as precedent. Threshold for lock: second production issuer. Vocab #81 documented separately above.

• Vocab #36 reply
• Vocab #76 reply

55-test harness committed at b505c22 against agent-passport-system payment-rails surface, raising the conformance suite to 2,911 total tests. Validates that every binding adapter claiming to honor bilateral receipts produces byte-equivalent envelope output when fed the same canonical input. Test surface includes happy-path bilateral confirm, partial-acknowledgment refusal, replay rejection on duplicate action_ref, and JCS-canonicalization equivalence across three adapter implementations. Closes the Tier-2 binding adapter conformance commitment (Day 76 internal tracker).

• Commit b505c22

ship tag now renders P.green (was falling through to ink4 gray). Most updates are ship entries so the panel was reading as monochrome. Link colors brightened in both palettes for readability against dark and light surfaces (light #1a4fa0 to #2563eb, dark #7cacde to #93c5fd). Applied to deployed index.html plus six JSX sources that define kindColor locally (opensource.jsx, restrained.jsx) and the palette source-of-truth (tokens.jsx). v1/v2 destructure the shared window.kindColor and pick up the fix automatically. subpages-1.jsx already had ship: P.green; tier2.jsx uses a different vocabulary unrelated to the Updates panel. Commit 8534ca1.

Six commits land the v4 redesign on aeoess.com: 33-page restrained design language, per-page SEO meta with JSON-LD Organization schema, removed Updates rail from the homepage to recover hero focus, working desktop dropdown menus without React, fully wired navigation and footer (every href points to a real page), APS logo clickable, '8 papers' linked to ORCID 0009-0002-4700-3594, draft-pidlisnyi-aps-00 linked to IETF datatracker, agent-discovery <link rel='alternate'> tags in <head> on all pages (llms.txt, llms-full.txt, AGENTS.md, .well-known/mcp.json, .well-known/aps.txt), new /sitemap.html overview catching the 17 secondary pages no nav reaches, and a runtime dark/light theme toggle. Footer tagline updated from 'Open protocol for governing AI agents' to 'Open-source enforcement protocol for AI agents'.

• Live site
• Sitemap overview

APS canonical-bytes path on src/core/bilateral-receipt.ts (canonicalize(body), sorted-keys JSON; RFC 8785 JCS for the v2/accountability bundle module) verifies 5/5 against desiorac's bilateral receipt fixture in corpollc/qntm v0.3.1. This is third-party byte-match independent of the Wave 1 cross-language scenarios published Apr 30 to May 02 (Python 2.4.0a1 ports across 27 fixture scenarios). Mirror offered into aeoess/aps-conformance-suite as a regression test ahead of desiorac's qntm v0.3.2 mid-May publish; desiorac is a substantive bilateral-receipt contributor distinct from the broader vessenes thread.

• qntm #15 byte-match reply
• APS bilateral-receipt module

Phase 4.1 of the SDK published to npm ([email protected]), PyPI (agent-passport-system==2.4.0a2), ClawHub (agent-passport skill 5.9.0), and the MCP server on npm ([email protected]). Three architecture decisions merged earlier in the day: Q1 (rail receipts as accountability evidence with claim_type, scope_of_claim, and timestamp fields), P12 (DID URI signing with rotation-aware verifier walking RotatableDIDDocument.verificationMethod and respecting retiredAt markers), Q2 (optional PaymentObligationRef and cross-receipt link fields for hybrid Option C settlement binding). Test count moved 2,711 to 2,884 across the three branches.

• SDK 2.6.0-alpha.2 on npm
• Python 2.4.0a2 on PyPI
• MCP 3.2.0 on npm

Python SDK 2.4.0a1 ports the full Wave 1 governance surface from TS SDK 2.6.0-alpha.0: v2/accountability/* (action, authority-boundary, bundle, custody, contestability), v2/cognitive_attestation/*, v2/instruction_provenance/*. Plus the four evidentiary type safety primitives (claim_evidence_types, claim_verifier, downstream_taint, minimal cascade ContestabilityReceipt) ported earlier in the day as 2.4.0a0. Cross-impl byte-parity verified across 27 test scenarios: 15 evidentiary type safety (9 verifier + 6 cascade) plus 12 Wave 1 (5 accountability fixtures shipped from TS SDK at src/v2/accountability/fixtures/*.fixture.json plus 7 generated for cognitive_attestation and instruction_provenance via tests/v2/fixtures/wave1/_generate.mjs pinned to [email protected]). Python canonical-JSON output and sha256 hashes match TS-generated fixtures byte-for-byte across all 27 scenarios. Test count 398 to 518.

• Python 2.4.0a1 on PyPI
• TS SDK on npm
• Wave 1 port commit

Four new v2 modules: claim_evidence_types registry with BATCH_ATTESTED and EVIDENCE_CUSTODY_HELD extensions (Module 1 + Module 1a), claim_verifier (Module 2), contestation cascade with verifier hook (Module 4). Plus path-scoped cycle detection and dedupe in mergeTaints (resolves cross-chain skip case caught in property test). Compliance-complete failure scenario added for EFFECT_SAFETY_ATTESTED. Postpublish wrapper fixed to surface real errors instead of masking them. Test count 2,545 to 2,586 across the day.

• npm
• release commit

Two cleanup PRs landed in the agent-governance-vocabulary repo. PR #74 removed RNWY from behavioral_trust and wallet_intelligence after verification couldn't confirm those signals are issued in production. PR #75 marked passport_grade with status: proposed (downgrade from canonical) because APS is currently the sole production issuer and the canonical-promotion rule requires two independent implementations. Single-source-of-truth discipline maintained. Vocabulary registry now reflects only verified production attributions.

• PR #74
• PR #75

Four-layer structural backstop against private-context drift into public repos. Layer 1: pre-commit hook scanning staged content against hard-block and soft-warn pattern lists. Layer 2: GitHub Actions workflow running the same pattern check on every push. Layer 3: standardized .gitignore block excluding categories that should never enter version control. Layer 4: final scan inside scripts/propagate.mjs runs the same check before any cross-surface update touches the file system. Installed across agent-passport-system, agent-passport-mcp, agent-passport-python, aeoess_web, agent-governance-vocabulary, aps-conformance-suite, agent-ecosystem-map, intent-network-api. Seventeen commits.

• CI workflow (SDK)
• propagate.mjs

Two improvements to scripts/validate-crosswalks.js. Improvement 1: walks descriptor_dimensions blocks nested under signal_types.<key> entries, catching stale dimension values inside per-signal-type descriptor overrides that the previous validator skipped. Improvement 2: legacy whitelist file at scripts/legacy-descriptor-overrides.yaml preserves three pre-#57-resolution descriptor uses (dcp-ai active today, jep and fidelity-spec latent until those maintainers reformat) without warning maintainers, with resolution_issue annotation. Validator state post-hardening: 5 errors, 11 warnings across 26 crosswalks. Regression-tested with nested-descriptor fixture using deprecated value (errors as expected, baseline restored).

• validator
• legacy overrides

Per #64 thread three-issuer convergence, completion_ratio proposed as new canonical signal type with descriptor enforcement_class advisory, validity_temporal windowed, refusal_authority consumer_policy, invariant_survival post_action, replay_class fingerprint_only, governed_action_class delegate. Three production issuers cited: AgentID rolling 180d, APS configurable defaulting to 90d, RNWY derived 24h via peer_review. New constraint completion_ratio_method (signal_extension type) formalizes the strict-vs-quality-weighted choice with values [strict, quality_weighted] and default strict. Tagged Harold Frimpong (AgentID) and Douglas Borthwick for review.

• PR #72
• Issue #64 thread

Extend existing buildMerkleRoot() into periodic gateway commitments. Public Merkle inclusion proofs let any consumer check "these are ALL the receipts for this agent in this window." Closes the completeness gap, today we can show any receipt is authentic but cannot prove the set is complete. Lives in the SDK as a primitive + in the gateway as a cron-emitted commitment.

Depends on: build-c-settlement-pipeline

arian-gogani (Nobulex) shipped reciprocal byte-match verifier scripts at github.com/arian-gogani/nobulex/tree/main/scripts: verify-aps-byte-match.mjs and verify-ctef-byte-match.mjs. Acknowledgment posted to A2A #1786 thread. Reciprocal verification queued for Day 75 morning: run Nobulex's scripts against APS fixtures, post receipt artifacts to thread, link both verifier scripts from APS fixture README. Pattern: APS publishes fixtures, peer publishes reciprocal verifier, APS publishes counter-verification, the loop closes byte-by-byte. This is the ninth way of verifying APS fixtures.

• acknowledgment
• Nobulex verifier scripts

VeritasActa Knowledge Unit bundle with sidecar-anchored APS DecisionLineageReceipt verifies end-to-end against a sidecar JWKS. Ten access receipts, all hash-matched across both layers (KU layer and APS layer); APS signature valid against sidecar JWKS kid:aps-ku-cross-verify-v1. Tamper-detection holds across both layers when individual receipts are altered. The integration demonstrates that APS DecisionLineageReceipts can ride alongside an external knowledge-attestation format without either layer needing to absorb the other; the sidecar JWKS pattern lets the consumer verify both layers independently and cross-check at action time.

• verify PR #7

Edison Munoz Duran's Agent-DID crosswalk lands as the second co-drafted-with-aeoess crosswalk in the vocabulary. The first was the original AAIF entity_continuity work; this is the second public collaboration where aeoess and a co-author share the spec branch. The A2A composition contract co-drafting now runs on a shared spec branch with Edison; APS pushed the canonical spec to edisonduran/agent-did spec/a2a-composition-contract branch (commit 3fc3838); Edison confirmed pull. The pattern: external project authors a crosswalk, aeoess merges, then both projects co-draft the next interop primitive on a shared branch. Ecosystem hospitality compounding.

• PR #66 (merged)

Wave 1 accountability surface added to SDK v2.5.0-alpha at src/v2/accountability/. Five signed receipt types: ActionReceipt (aps:action:v1), AuthorityBoundaryReceipt (aps:authority_boundary:v1), CustodyReceipt (aps:custody:v1, eight event types and seven purposes), ContestabilityReceipt (aps:contestability:v1, affected-party challenge with controller response), APSBundle (aps:bundle:v1, signed aggregation envelope with balanced Merkle commitment). All RFC 8785 JCS canonicalized, all Ed25519 signed, all content-addressed. Design principle: verbal confessions, not brain scans. Every receipt declares scope_of_claim with explicit does_not_assert; honest scope is mandatory and part of the cryptographic integrity surface. 57 new tests across six suites (action 8, authority-boundary 7, bundle 12, custody 15, contestability 10, fixtures 5). Full SDK suite 2,536/2,537 pass, 0 fail, 1 pre-existing skip. Cross-impl byte-match anchor: five deterministic JSON fixtures using fixed Ed25519 private keys and timestamp 2026-04-30T00:00:00.000Z. Ships toward EU AI Act Article 12/14, GDPR Article 22, FRE 902(13)/(14). MCP v3.1.1 picks up the dependency, Python v2.3.0 ships for parity, ClawHub skill v5.8.0 carries the new surface.

• PR #22 (squash-merged to main)
• SDK v2.5.0-alpha on npm
• module README
• Wave 1 spec

ORCID profile populated as Independent Researcher / Founder of APS. All 8 papers indexed via DOI lookup. Five featured: Agent Social Contract, Physics-Enforced Delegation, Cognitive Attestation, Monotonic Narrowing, Behavioral Derivation Rights. The Evidence-Safety Gap paper added on the same day as publication. Bio frames the protocol scope without the cross-disciplinary career narrative. Websites: APS, Personal, GitHub (APS), APS SDK on npm. Keywords mirror paper-level keywords scoped broader: AI agents, multi-agent governance, cryptographic identity, delegation, Ed25519, agent attestation, governance protocols, mechanistic interpretability, accountability, open protocols.

• ORCID

The Evidence-Safety Gap in Cryptographic Agent Governance: Compliance-Complete Failures and the Limits of Receipt-Based Accountability published on Zenodo (DOI 10.5281/zenodo.19914628). Defines compliance-complete failure as the simultaneous condition of procedural validity and unsafe effect. Names five omitted-variable classes (semantic, population, trust, pipeline, temporal state). Constructs explicit defeat traces against receipt-chain forensic signals in an open-source reference implementation. Two design implications follow: claim-scoped receipts and authorization-effect separation. Neither closes the gap; both make it visible and auditable. The minimal contribution is the formal separation of procedural validity from effect safety in receipt-based agent accountability, a vocabulary for the failure class the protocol's own success creates.

• Paper 8 on Zenodo

Agent Social Contract (Paper 1, z.18749779), Physics-Enforced Delegation (Paper 5, z.19478584), and Cognitive Attestation (Paper 7, z.19646276) entering SSRN today. Each paper classified into five-to-six CS networks where the actual reviewer audience reads, Artificial Intelligence eJournal for the broad AI audience, Artificial Intelligence Law Policy & Ethics for auditability and governance angles, Cybersecurity Privacy & Networks for cryptographic primitives, Theoretical Computer Science for cryptography and distributed computation, Quantum Information for the IBM hardware experiment, Generative AI for the Llama-3.1 sparse autoencoder work. Classifications are routing decisions, not decoration. Author affiliation: Independent Researcher (corrected from auto-pulled GitHub Inc). Declaration of interest statements explicit about IBM Quantum and Neuronpedia third-party infrastructure use with no funding role. [APPROVED 2026-05-11: SSRN approved 5 papers per email notification.]

PR #55 (APS↔ACTA pairwise crosswalk by @tomjwxf) pinged with three specific questions: 14-mapping distribution analysis, divergent rows + migration paths, pairwise format precedent. PR #51 (invariant-survival.md doc co-authored @QueBallSharken) pinged with three questions: BBIS phrasings accuracy, boundary-keeping section, composition partners. Both moved to waiting-on-them. CONTRIBUTING.md gate-4 wants concurrence on the PR thread itself, not just on related issues.

PDR validator for behavioral-fingerprint-drift detection. 309 LOC pure-Node, zero deps, 32-test suite, four reference fixture vectors. Complementary to continuity-analyzer's structural fixture, addressing the namespace decision settled on Day 67. Co-authorship with @nanookclaw declared on PR per their explicit Apr 26 11:47 concurrence on the original issue.

• PR #52 (merged)

lawcontinue's epoch added to validity_temporal enum: observer-relative ticks on substantive state transitions, distinct from sequence's event-relative counts. Issue #58 settled with @lawcontinue's endorsement after three-way independent convergence (lawcontinue, kenneives, srotzin) on Day 71. Vendor-neutrality fix applied during review (commit 9cf2a1db).

• PR #61 (merged)

governance_attestation.refusal_authority brought into formal enum compliance: structurally_impossible_to_violate → issuer. One-line correction; the original value wasn't enum-valid anyway. @lowkey-divine concurred on issue #57 before merge.

• PR #62 (merged)

agent-governance-spec/agent-trust-verification-providers PR #8 review posted as CHANGES_REQUESTED for a structural peer_review / behavioral_trust mapping error needing correction in four places, plus three smaller items (cold-start prior, score range, naming). PR is now blocked from merge until corrections land. Lars Kroehl can independently concur or override per the spec's two-editor consensus.

Email to [email protected] framing IPR as a structural mitigation for the recent instruction-file advisory class. Subject: 'Action time drift check for authority bearing instruction files.' Honest-scope language about what IPR does not do (it does not classify files as malicious; it only binds authority to the file state at delegation time). 5-business-day acknowledgment cadence per Cursor's published disclosure path.

aeoess/aeoess-gateway-v0-poc is a minimal HTTP service that recomputes the IPR context_root against the declared file set at action time and denies if the digest no longer matches the receipt. Three case fixtures (create_pr, read_file, send_payment) demonstrate before/after deny semantics. APS is one implementation of the receipt shape; the pattern works for any agent runtime that wants to bind authority to a file-content digest.

[email protected] published on npm under the alpha tag. The IPR module at src/v2/instruction-provenance/ ships canonicalize/envelope/verify for binding agent authority to a content-addressed digest of declared instruction files at delegation time. 32 conformance tests + 27 adversarial tests passing inside the 2,479-test suite. Addresses the recurring failure mode in recent AI IDE advisories (cursorignore bypass, .git settings sandbox escape, NTFS path quirks, .vscode/settings.json injection, MCP config drift): agent receives authority under one instruction context, a workspace file changes mid-session, agent acts under instructions that were never part of the original authority context. OWASP AIVSS describes this class as Goal Manipulation. Demo branch with byte-parity-checked drift-denial walkthrough at demo/drift-denial-cursor-cve/demos/drift-denial.

completion_ratio proposed as a new canonical signal_type. Three independent implementations confirmed in the original A2A #1628 thread (AgentID rolling 180d, APS configurable defaulting to 90d, RNWY derived 24h via peer_review sybil analysis), two-implementation rule met. Opening as issue rather than direct PR per CONTRIBUTING.md canonical-term protocol; PR follows once direction settles. Proposed descriptors: enforcement_class advisory, validity_temporal windowed, refusal_authority issuer, invariant_survival post_action, replay_class fingerprint_only, governed_action_class delegate.

piiiico added trust_verify (POST /v1/trust/verify) to AgentLair's behavioral_trust.endpoints block, a third surface alongside trust_profile and trust_gate that accepts an AAT JWT directly without requiring a resolved agentId path parameter. Endpoint verified live with proper structured 401 (HSTS, CSP, JSON content-type, 112-byte error body, production gateway behavior). 5-gate review passed clean.

New GitHub organization agent-governance-spec hosts cross-vendor specs that should not live inside any single vendor's account. First spec is agent-trust-verification-providers (CC-BY-4.0). Lars Kroehl (MolTrust / CryptoKRI GmbH) accepted six conditions on editorial process, license separation (spec is CC-BY-4.0, reference implementations stay independent under their own licenses), MUST #2 split refinement on schema-fields versus schema-shape, implementation-name discipline, and editor-entry path. Editor line: 'Tymofii Pidlisnyi (APS by the project), Lars Kroehl (MolTrust / CryptoKRI GmbH)'. v0.1 SPEC.md drafted (216 lines), six tracking issues opened for structural decisions, Lars accepted the org owner invitation.

• spec repo
• org

Proposal to add epoch as the sixth value in the validity_temporal enum (alongside immediate, decay_window, refresh_required, expires_at, condition_satisfied). The semantic gap epoch fills: distinguishing observer-relative event sequencing from substantive state transitions, where two verifiers of the same wall-clock window may reasonably count different numbers of events but agree on coarser substantive transitions. Three independent endorsements landed: lawcontinue (distributed inference setup, 50-token generation produces 50 sequence ticks but zero state transitions), kenneives (AgentGraph CTEF v0.3.1 session_epoch maps onto epoch verbatim once the enum lands), srotzin (HiveTrust + cont_epoch on continuity layer, plus substantive-transition lower bound clause for the PR description: epoch ticks MUST be coarser than per-call I/O). Direction locked, PR followed and issue closed 2026-04-29.

• #58
• A2A #1786 (parallel thread)

Cross-cutting question scoped on whether and how to express composite-or-post-quantum signature capability without overcommitting the vocabulary to particular algorithm choices. Three options framed: documentation-only per crosswalk (lightest), optional descriptor on signal_type (signature_capability enum: classical / post_quantum / composite), or crosscutting attribute matrix declared once per system (heaviest). Four named questions for the WG: is signature capability a property of the signal or of the issuer, should composite (Ed25519 + ML-DSA-65) be a distinct value from post_quantum, does this interact with enforcement_class or validity_temporal, and should the canonicalization profile (dcp-jcs-v1, JCS variants, undocumented) also be a crosscutting sibling attribute. Production issuers using post-quantum or composite signatures today: asqav (jagmarques, ML-DSA-65), DCP-AI (lktron00, composite Ed25519 + ML-DSA-65). Tagged jagmarques, lktron00, schchit, willamhou, arian-gogani, nutstrut, MoltyCel for perspective. No PR, no schema change, no timeline pressure. Reading the room first.

• #60

kevinkaylie merged Step 2 of the four-signal compose test for Interop Week 1. AgentNexus governance attestation as the second link in the chain after AgentID's trust_verification (PR #38). JWS Ed25519 signatures verified end-to-end. prior_signal_digest matches Step 1's compound_digest byte-exact (621d40f1701521f9af084a08476a2deebd49f02ff0b9d7e7808b6a05c6fcad91). Squash-merged at 16:22:42Z. Step 3 (continuity-analyzer) and Step 4 (composition-behavioral-trust.json by nanookclaw, blocked on middle-issuer alternative) follow.

• PR #53 (merged)
• Interop Week 1 (#36)

lktron00 (Danilo Naranjo Emparanza, ORCID 0009-0003-7520-8527) merged the DCP-AI (Digital Citizenship Protocol for AI Agents) crosswalk. 570 lines. Composite Ed25519 + ML-DSA-65 (FIPS 204 level 3) signatures shipped from day one across four reference SDKs (TypeScript, Python, Go, Rust + WASM). Real production deps: @noble/post-quantum + tweetnacl in npm. 72KB interop test vectors, 11.8KB normative canonicalization profile (dcp-jcs-v1). Calibration discipline strong: passport_grade declared non_equivalent_similar_label with 'do not treat tiers as trust grades' note, 8 explicit no_mapping entries each naming the production issuer for the gap. Version-discrepancy disclosure (npm 2.1.1 vs PyPI/crates 2.8.1) honest and explained. Identity verified: dcp-ai.org, getocular.ai, ocularsolution.com all live, 6-year GitHub account. Cross-implementation round-trip is the bar before issuers_in_production addition; lktron00 committed to running it against APS, Nobulex, or SINT this week.

• PR #59 (merged)
• DCP-AI

Offered on AARS#32 Day 65 as the path to make the §3.3 conformance bar legible rather than implicit. Lift interop/fixtures/ from the main SDK into a standalone repo with JCS-canonical test vectors covering happy-path, scope expansion, cascade revocation, chain-root verification. Any implementation (Python reimpl, Rust, Go) runs the test matrix and demonstrates conformance without needing to mirror our codebase. Not speculative, only builds if VeloGerber picks path (a) or another reimplementer signals demand. Standalone repo is cleaner to cite in OWASP/IETF documents than pointing at the interop directory of a main SDK.

Depends on: aivss-32-3-3-pr

Packaged corpus of byte-identical test vectors for Agent Passport System cross-implementation conformance. 37 fixture vectors across 4 categories: bilateral-delegation (10 vectors), inference-session (7 vectors), instruction-provenance (10 vectors), aivss-scenarios (10 vectors covering OWASP AIVSS §3.6.1 through §3.6.10). TS reference runner. .well-known endpoint mirror following the agentgraph.co/.well-known/cte-test-vectors.json pattern. All vectors deterministically reproducible from a fixed Ed25519 seed, JCS-canonicalized, signature-verified. Apache-2.0. Spec refs: 8 papers (Zenodo) + draft-pidlisnyi-aps-00.

• repo

GitHub Actions workflow installed on agent-passport-system, agent-passport-mcp, agent-governance-vocabulary. Pinned to AGT v3.3.0 (commit 15e001f9b53f). Profile + credential checks run on opened PRs and issues from external contributors. Cluster detection opt-in via workflow_dispatch (API-heavy). Risk threshold set to HIGH for the calibration window so only HIGH-risk events trigger public PR comment + label. Excluded actors: dependabot[bot], github-actions[bot], copilot-swe-agent[bot], aeoess. Validation runs: lawcontinue scored LOW (legit dev), mrperfectness-sketch scored MEDIUM (canary), aeoess scored HIGH (three signals fired: recent_repo_burst 41 repos in 90 days, cross_repo_spray 72 repos in 7 days, credential_laundering across 5 repos).

• workflow (agent-passport-system)
• AGT contributor-check (source)

Public Discussion opened in aeoess/agent-passport-system on substance evaluation as the layer above pattern detection. Endorses Imran's contributor-check tool, names that most active contributors in agent-governance today are human + AI systems (including aeoess), draws the substance-vs-pattern line. Names internal Model Citizen mode framing publicly. Includes the actual HIGH score and three signals fired against the aeoess account when run through contributor-check, framing the cross-repo activity as independent convergence rather than coordination. Companion comment on microsoft/agent-governance-toolkit#1473 linking back to the discussion.

• companion comment on #1473

in-toto Statement predicate binding agent authority-to-act: delegation chain root, principal signature, scope narrowing invariants, Values Floor attestation hash. Predicate type URI https://aeoess.com/attestation/governance/v0.1. JWS + Ed25519. Sibling to nobulex's Decision Receipt PR (in-toto/attestation#549). Composition: Decision Receipts reference GovernanceAttestation by digest in subject.digest.sha256, walking the chain exercises both axes. 5 fixture vectors deterministically reproducible (minimal-tier-1-self-delegation, multi-hop-delegation-tier-2, expired-window, monotonic-narrowing-violated, chain-root-mismatch). 29 tests pass including a composition test that exercises the full round-trip with tampering detection. Public notice posted on in-toto/attestation#549 with @arian-gogani tagged for the Apr 30 cross-impl round-trip.

• repo
• in-toto #549 follow-up

Pairwise composition crosswalk between Agent Passport System receipt primitives and ACTA Signed Receipts (draft-farley-acta-signed-receipts-01). 14 mappings: 1 exact, 7 partial, 3 divergent, 2 no_mapping, 1 non_equivalent_similar_label. Calibrated against actual shipped versions: APS 2.3.0-alpha, @veritasacta/artifacts 0.2.2, @veritasacta/protocol 0.1.1, @veritasacta/verify 0.6.0, protect-mcp 0.6.0. Migration paths documented for partial/divergent rows. Strategic posture: complementary surfaces, not competing stacks. APS specializes in delegation chain + cascade revocation + scope narrowing; ACTA specializes in selective-disclosure receipts via RFC 6962 Merkle commitment. Authored APS-side, ACTA-side review pending.

• PR #55 (open)

Empirical paper built on Build G experimental data. Complementarity-gain metric measured across three AI families (Claude, GPT, Gemini) across 15 configurations and 5 scenarios. Venue likely ICLR, NeurIPS, or AISec workshop depending on how the experimental data lands.

Depends on: build-g-oversight-harness, build-e-converged-models

lawcontinue shipped a seven-vector test pack for the CTEF inference-session category at fixtures/inference-session/. Each vector covers a different shape of session attribution: clean handoff, mid-inference rotation, distributed cross-node, sequence-bounded validity, parent-chain Merkle anchoring, replay defense, and a negative case where the session_id does not match the canonical JCS hash. Every signature is RFC 8785 JCS-canonicalized and Ed25519-signed. Two structural fixes flagged in review (a session_ids array shape mismatch and a missing parent_receipt_hash wiring on one vector); lawcontinue pushed corrections at commits 95c1ca9c and 73d52c08 in twenty-two minutes. Second time this week he has turned a structural review around inside half an hour. The inference-session pack composes with the existing rotation-attestation fixtures published Apr 24 at aeoess.com/fixtures/rotation-attestation/, giving the SDK two distinct CTEF v0.3.1 fixture surfaces (rotation events plus inference-session attribution). Both lock through the same RFC 8785 JCS canonicalization.

• PR #19 (merged)

piiiico's crosswalk/agentlair.yaml merged after one round of structural revision. First iteration mapped AgentLair's TrustProfile to peer_review as primary signal type. The full v0.2 review against piiiico's live envelope and the canonical vocab definitions found that primary mismatched: peer_review is task-completion attestation signed by a delegating agent after a service agent completes work; AgentLair's TrustProfile is aggregate behavioral scoring across events with no task binding. Fix was to promote behavioral_trust to primary with match: exact and demote peer_review to no_mapping with a note explaining the definitional gap. piiiico turned that around in fifteen hours. Same commit added AgentLair to behavioral_trust.issuers_in_production at vocabulary.yaml line ~340, which now lists three independent issuers (RNWY, Logpose, AgentLair) producing real signal data against the same canonical type. That is the production-signal evidence behavioral_trust needs to remain canonical with multi-issuer coverage. Direct commit 0653c1b added AgentLair to issuers_in_production list.

• PR #46 (merged)
• commit 0653c1b, issuers_in_production

madeinplutofabio's crosswalk/pic.yaml merged at midmorning PT, mapping the PIC Standard's verification-pattern primitive to the vocabulary's canonical signal types. The crosswalk models action-boundary verification as a parallel surface to visa-layer issuance rather than a sub-field beneath it: visa-layer primitives like APS, AgentNexus, and MolTrust handle issuance-side identity and delegation tokens carried by the agent; PIC handles receiver-side fail-closed verification at the action boundary, consuming trust roots that may include visa-layer issuers but owning the verdict primitive itself. Both compose; neither contains the other. The crosswalk landed describing PIC in PIC's own terms first, with the composition pattern documented in the notes block. PIC became the twenty-third crosswalk in the vocabulary registry. Resolution of the visa-vs-verification-gate taxonomy debate that had been open on aeoess/agent-governance-vocabulary#48 for two days.

• PR #49 (merged)

Single docs-only PR adding docs/descriptor-dimensions/invariant-survival.md, with QueBallSharken (Logpose / BBIS) as Co-authored-by: on the commit. The doc names the BBIS canonical language explicitly at three structural points so the vocabulary references the same vocabulary BBIS uses, not a parallel coinage. Closes the loop on the Apr 23 BBIS-classification-grammar adoption (ENFORCEMENT-TRUST-ANCHOR.md v1.2 from Day 67) by anchoring the same vocabulary in the descriptor-dimensions registry. Awaiting QueBallSharken review.

• PR #51

Validator built directly from nanookclaw's slope-computation spec posted earlier the same evening on issue #36. 309 lines of pure-Node validator (scripts/validators/entity-continuity-pdr.js) with no dependencies, a 32-test suite all passing (scripts/validators/test-entity-continuity-pdr.js, 300 lines), four reference vectors at fixtures/validator-vectors/ covering stable, drifting, improving, and out-of-range agent behavior, and a long-form docs file at docs/descriptor-dimensions/entity-continuity-pdr.md (184 lines). Slope formula from nanookclaw's spec: L2 distance over four normalized fingerprint dimensions, OLS over a window of twelve sessions, max divergence of sqrt(4)=2.0, max possible slope of 2.0/(N-2), score clamped to [0.0, 1.0]. Verified scores: stable=1.0, drifting=0.9212, improving=1.0 (clamped), invalid=exit-1. nanookclaw posted the spec at 21:34Z; the validator opened at 22:52Z. Co-authored-by: Nanook on commit 069ef9a. Closes the Nanook §8 commitment. Complementary to nutstrut's structural continuity-analyzer (vocab PR #42). Awaiting nanookclaw review.

• PR #52
• Issue #36 (slope spec source)

Second external contributor on the repo after EchoOfDawn's MoltBridge lane opening, and the first security-class PR. Previous _lookup_issuer_key implementation had a silent fallback: if the declared kid did not match any key in the issuer's JWKS, it would accept the first Ed25519 key in the keyset anyway, producing a silent binding failure rather than a rejection. This is precisely the class of implicit-trust hazard the composition-rule discipline in CTEF v0.3.1 §6.3 is designed to prevent. PR tightens to strict kid-match and raises UnknownKeyIdError on mismatch. 16/16 tests green post-merge. Good signal that kid/alg registry discipline (which we have been arguing for in the A2A Agent Cards and CTEF threads) is showing up as concrete patch-level work from independent contributors, not just spec-level advocacy.

• PR #1 (merged)

Wire-format substrate convergence across five live implementations on the discriminator key name. Naming collision was identified mid-thread on #1672: AgentID had been shipping claim_type on the live /verify endpoint; AgentGraph + APS rotation-attestation spec used claim_category. Same concept, same closed set values, different key name. kenne offered three resolution options and renamed AgentGraph claim_category → claim_type at commit agentgraph-co/agentgraph@69ad94d so all live implementations agree. AgentID's harold confirmed claim_type live with 32/32 endpoint tests pass and JCS canonicalizer byte-matching all 10 APS bilateral-delegation vectors. Nobulex (arian-gogani's @nobulex/crypto TS canonicalizer) byte-matching APS + AgentGraph fixtures. HiveTrust (srotzin) confirmed concur with the four-layer split + 'history-stability under rotation' framing on #1672, and posted the disjoint-namespace projection rule resolving the wire-collision concern: ctef.envelope.claim_type vs hivetrust.internal.claim_type sit at different envelope levels with explicit projection_rule mapping HiveTrust claim records onto ctef.envelope.claim_type='authority' when carried in a CTEF-composed envelope. Risk-tier bucketing under HiveTrust's claim_category stays HiveTrust-local until a future WG reservation. HiveTrust byte-match fixture committed pending claim_type.envelope composition-rule spec draft. Settlement-evidence-as-reputation-anchor (x402 receipt on Base 8453 → evidence_basis.evidence_type.payment_execution) lands on a v0.3.1-reserved field, with crewAI #4560 cited as cross-reference.

• #1672 thread
• #1786 proposal

MoltyCel's RFC 'Native Agent Identity & Trust Verification for OpenClaw' closed by maintainer steipete (Codex review) with stateReason: COMPLETED at 04:34Z. Ruling: trust providers (APS, MolTrust, AgentLair, AgentID, etc.) build on existing public hooks rather than a new core onAgentVerify. Five hooks cited at file/line precision against commit 45146913007d: before_install (src/plugins/hook-types.ts:635, runtime invocation at install-security-scan.runtime.ts:586) for skill install gating; before_tool_call (hook-types.ts:318) for per-action enforcement at the runtime tool-call gate; inbound_claim + message_received + before_dispatch (hook-message.types.ts:16) for inter-agent verification; gateway_start (server-startup-post-attach.ts:503) for self-verification on startup. SDK reference docs at docs.openclaw.ai/plugins/sdk-overview confirm these as supported public plugin contracts. This is an architectural answer not a soft punt, different from the openclaw#43705 showcase closure (route to ClawHub, no architectural commitment), steipete did codebase work mapping the RFC requirements onto specific hook surfaces and committed them as public plugin API. Reframes the openclaw integration story: APS ships @aeoess/openclaw-trust-plugin as the integration artifact (not a core dependency) targeting at minimum before_install + before_tool_call + inbound_claim + gateway_start, calling a public trust-lookup endpoint on the gateway for per-agent JWS-signed trust attestation. ~200-300 line plugin, npm-publishable, README cites CTEF v0.3.1 substrate. Post acknowledgment to #49971 only after scaffold exists.

• #49971 closure
• OpenClaw plugin SDK reference

Five canonical DID-document rotation-attestation fixtures plus JSON Schema plus test-vectors manifest published at aeoess.com/fixtures/rotation-attestation/. Fixtures cover happy-path, cross-signed, migration-attested, happy-path-compound (cross-signed + migration-attested in one entry, realistic production case), and negative-no-attestation (rotationLog entry with empty rotationSignature, must trigger INVALID_CLAIM_SCOPE on a conformant verifier). Every signature and hash input is RFC 8785 JCS-canonicalized; attestor is a dedicated fixture-signing key separate from the gateway with pubkey at keys/attestor-v1.pub.json and seed documented so third parties reproduce the set byte-identical from a fresh clone. v1 narrows migration_type to key_class_upgrade only; v2 extends to did_method_migration. Closes the rotation-attestation fixtures commitment on the same day (Apr 23 PT commitment, Apr 24 PT delivery). AgentGraph landed test_aps_rotation_attestation_interop.py in main at commit 8baaad4 within hours of publication, live-fetching fixtures at test-collection time rather than pinning a repo-local snapshot, dual-locking each fixture against the published test-vectors.json canonical SHA-256 AND what their canonicalize_jcs_strict produces from the live body. All five fixtures reproduce byte-identical. Canonicalization loop closed: APS bilateral delegation, APS continuity rotation, and AgentGraph CTE vectors now pin the same canonicalization through JCS bytes rather than shared code, which is the actual interop test. Pattern will mirror into v0.2 capability-token fixtures once those publish.

• test-vectors manifest
• Spec
• A2A #1672 closure exchange

piiiico's agentlair.yaml lands as the canonical pre-delegation behavioral check issuer. Maps to peer_review as primary signal type (match: exact, production data exists, trust endpoints live, behavioral event ingestion live, three-dimensional scoring operational consistency/restraint/transparency, Bayesian with cold-start prior, non-null scores on non-test agents). Secondary mappings: behavioral_trust (exact), trust_verification (partial, AAT is session auth with identity component), governance_attestation (partial, hash-chained audit trail). Eight explicit no_mapping entries with technical rationale per CONTRIBUTING.md §3.6 Seven Deep-Review Dimensions. Four-temporal-layer sequencing (pre-delegation → at-delegation → at-execution → post-execution → feedback loop) documented inline in the peer_review notes block, NOT as a new top-level section, preserves PR #44 precedent that novel top-level blocks set permissive precedent for every later issuer. AgentLair added to behavioral_trust.issuers_in_production in follow-on commit 0653c1b. Five-check protocol applied (Identity / Format / Substance / Scope / Reversibility) with STEP 0 mandatory disk-read of CONTRIBUTING.md from filesystem before applying memory-cached protocol, the slot #29 swap codified earlier in the day.

• PR #46
• agentlair.yaml

Imran Siddique (Microsoft Engineering Architect driving the agent-governance-toolkit and active on the ADR-0007 cross-org federation direction in #1386) opened the door on #1354 for a concrete interop proposal between APS and AGT. Reply maps the three questions he opened #1386 with, policy precedence across orgs, evidence correlation across boundaries, trust tier compatibility, to named APS primitives that already ship in the public SDK. Policy precedence resolves through the combination of invariant_survival (pre_action / during_action / post_action / permanent) and refusal_authority (issuer / verifier / consumer_policy / shared), giving a declarative precedence grammar covering all four candidates (tool-side, agent-side, intersection, declared). Evidence correlation is DecisionLineageReceipt with content-addressed delegation_chain_root (SHA-256 over RFC 8785 JCS-canonicalized hops), which lets two verifiers independently confirm the same chain without round-tripping a registry. Trust tier semantics map the AGT TrustProvider tier enum from #1274 to the vocabulary's passport_grade plus behavioral_trust scoring; the bridge is already half-built through RNWY and MolTrust as trust_verification issuers. Four possible artifacts offered in increasing scope and without prescribing an order: vocab crosswalk entry pointing AGT's runtime evidence format at canonical terms (mirrors the rnwy.yaml and moltrust.yaml pattern); interop spec section as a follow-on ADR to #1234/ADR-0007 with canonical bytes + hash algorithm + envelope shape (APS drafts first pass, byline follows contribution during review); Tutorial 42 on cross-org delegation drafted against AGT's tutorial template; conformance fixture exchange adding AGT as a second verifier target in the existing harness. Three prior APS PRs already merged in AGT (#274 reputation-gated authority, #598 APS-AgentMesh adapter, #1328 cognitive-attestation example) provide established contribution standing. Posted 22:22 PT; response pending.

• Reply on #1354
• AGT #1386 federation thread

ENFORCEMENT-TRUST-ANCHOR.md v1.2 replaces v1.1's five-bucket taxonomy with the BBIS classification grammar (closed, bounded, partial, detectable-only, theater) per Steven Kyle Hensley's OWASP#817 answer. The Class B framing is tightened so typed epistemic receipts are classified as honesty discipline, not admissibility upgrade. Construction is implementation detail; invariant survival is the claim. CAPABILITY-TOKEN-SPEC-DRAFT.md v0.2 renames M4 EffectReceipt to FRCBE (Final Refusal-Capable Boundary Event) per the qntm#7 naming coined by the same author. Post-effect forensic artifacts split into a new optional M5 ExecutionReceipt; most deployments omit M5. Three-way naming convergence lands within 18 hours: BBIS (framework), APS (protocol), AgentGraph (implementation committed to CTEF v0.3 accepting delegation_chain_root by end of week). Branch feat/v1.2-bbis-grammar awaiting review before merge to main.

• ENFORCEMENT-TRUST-ANCHOR.md v1.2
• CAPABILITY-TOKEN-SPEC-DRAFT.md v0.2
• qntm#7 FRCBE lock + AgentGraph deliverables
• OWASP#817 BBIS classification grammar adopted

AgentGraph pulled the four-row per-layer composition grammar (identity / transport / authority / continuity, each with its declared composition rule) from the A2A #1672 thread into CTEF v0.3.1 §6.3 verbatim as normative language. Identity composes by key binding, transport by identity-key binding, authority by monotonic narrowing with content-addressed delegation_chain_root, continuity by rotation-attestation chain. Two verifiers given the same inputs must arrive at the same composed result; layers that cannot declare a deterministic composition rule are underspecified. INVALID_COMPOSITION adopted as a distinct error code alongside INVALID_CLAIM_SCOPE, they share the ordering constraint (structural failure precedes semantic evaluation) but surface different divergence classes. APS commits to publish canonical rotation-attestation fixtures at aeoess.com/fixtures/rotation-attestation/ this week (four fixtures: happy-path, cross-signed, migration-attested, negative-no-attestation) with versioned schema and matching test-vectors.json; AgentGraph lands them under tests/fixtures/aps-rotation-attestation/ with a companion test_aps_rotation_attestation_interop.py locking byte-identical canonicalization. Concurrent spec PR plan: A2A Agent Cards PR citing CTEF v0.3.1 §6.3 for composition-rule table + error codes, v0.3.1 citing the Agent Cards PR for the four-layer split + claim_type discriminator. Both held pending @haroldmalikfrimpong-ops signal on WG direction.

• A2A #1672 thread

A community-maintained directory of the agent infrastructure field, built on live GitHub data. 18 projects enriched from projects/*.yaml + GitHub repo metadata (stars, license, created, last push). 115 people (filtered from 130 raw) pulled from the contribution map and enriched with GitHub user metadata (account age, bio, company, followers). 93 governance threads enriched with state, comments, participants. Three sortable, filterable tables replace the earlier force-directed graph, which was pretty but buried its data in tooltips. Account ages visible as pills (amber under 60 days, green 60-365 days, plain after), so a 3-week-old promotional account is instantly distinguishable from a 10-year veteran at a glance. Explicitly not a ranking, not a coalition, not a property of APS: the README invites co-maintainers from other projects in the directory and commits to neutral stewardship once anyone wants to co-steward. Code MIT, data CC-BY-4.0.

• Live directory
• Source + contribute

Rewrote the CMD-SET-2 pre-publish audit from v1's 12 steps (SDK + MCP focused) to 42 steps across three tiers covering the full shipped codebase surface. Tier A Code Integrity runs test suites, typecheck, lint, build artifacts across SDK, MCP, Python SDK, Remote MCP, Gateway, Agent Governance Toolkit (405 tests), autogen-governance-adapter, vocab validator, intent-network-api, hermes-aps-delegation, hermes-decision-receipts, a2a-compliance-harness, solana-agent-identity, mingle-mcp, plus the SDK examples/ adapter apps and aeoess_web operational scripts. Tier B Supply Chain runs npm audit and pip-audit across every repo, secret scan with fixture/test exclusions, .npmignore and MANIFEST.in hygiene, LICENSE and NOTICE presence, CI workflow YAML validity and floating-action-ref detection, Dockerfile and Railway config pinning, Node engines field presence, package-lock presence. Tier C Runtime checks cross-repo version alignment across SDK/MCP/Python/Remote-MCP, npm and PyPI registry drift, live endpoint health, Gateway JWKS parity against source, committed fixture URLs reachable, the process supervisor RSS memory leak detection with proper the process supervisor-presence detection, git status across 20 repos with expected-branch check, build artifact freshness, stale artifact hunt, canonical number consistency including paper count, downstream licensee sentinel, large binary accidental-commit hunt. Self-check found 17 gaps in the initial v2 which v2.1 closes. Read-only throughout; explicit do-not-install / do-not-restart / do-not-commit-outside-aeoess_web constraints. Paste-ready for CC in one message.

Added §3.6 Seven Deep-Review Dimensions to the internal PR merge protocol, codifying what Phase 1 (Adversarial First) and Phase 4 (Invariant Cross-Check) must catch beyond the surface checklist. Seven dimensions: Ecosystem Precedent (novel structure sets permissive template), Semantic-Primitive Mismatch (match: exact vs vocab definition), Cross-Signal Field Overlap (composition hazard for consumers), Endpoint Content Depth (HTTP 200 is not production data), Cryptographic Coherence (alg/curve/proof-type/chain pairing), Ownership &amp; Coordination (concurrence on THIS PR not related issues), Related-Issue Dependency (PR jumping ahead of open debate). Distributed across Phase 1 and Phase 4, not new phases, named patterns the existing phases must catch. Extracted from PR #43 nutstrut measurement_point and PR #44 alex-pathcourse Pathcourse Health reviews where validator-clean PRs still carried substantive issues only visible under cross-touchpoint analysis. CONTRIBUTING.md on agent-governance-vocabulary expanded from 5 one-line review questions to explicit sub-bullets under Substance and Scope so contributors can self-calibrate before submission. First PR through the public criteria (#44) merged clean after three iterations.

• CONTRIBUTING.md
• PR #44 Pathcourse Health (merged)

examples/cognitive-attestation-governed/ merged into microsoft/agent-governance-toolkit at 19:41 UTC. 443 lines, two files, zero APS SDK dep. Third merged aeoess PR in the repo after PR #274 (Mar 16, reputation-gated authority proposal) and PR #598 (Apr 6, APS-AgentMesh adapter), and the first community-example-style contribution. Layering signed interpretability envelope on top of AGT's policy decision: AGT decides whether an action is permitted, the Cognitive Attestation envelope signs a sparse-autoencoder decomposition of the model state that drove the decision, downstream auditors can inspect what the reasoning substrate looked like when the action fired rather than just whether the policy rule matched. Follows the pattern set by examples/signet-attestation/ (willamhou's Signet example merged last week). Lands cleanly against the community-extension boundary formalized by ADR 0006 two days ago: policy evaluation stays in AGT core, proofs about the reasoning that produced the decision live as extensions that plug into the decision boundary without changing AGT's interface.

• PR #1328 (merged)

New public MIT repo standing up the composition glue for autogen's before_tool_call hook. Single governedToolCall() entry point, three ordered checks (identity via APS passport, authorization via delegation scope with monotonic narrowing invariant, optional trust provider), provider-agnostic TrustProvider Protocol that MoltBridge and MolTrust both implement on the same interface. 12 tests passing (target was 9+), CI green across Python 3.10/3.11/3.12 on first push at commit 8e1c88d. EchoOfDawn at SageMind AI invited as co-maintainer with write access (invitation 315925480 pending acceptance). providers/moltbridge/ reserved as Dawn's lane for MoltBridgeTrustProvider PR, providers/moltrust/ open for MolTrust implementation. Substrate requirements ride inside delegation scope per scope-bound design, no parallel capability-tier gate. Standalone dep footprint. Adapter does not import agent-passport-system SDK.

• Repo
• Origin thread autogen#7525

v1.1 reorganizes the enforcement-trust-anchor document around a sink-awareness boundary after sustained adversarial architectural review, replacing v1.0's flat four-closure-paths framing. Every construction is classified into a five-bucket taxonomy (full closure, subset closure, detection / deterrence, composition primitive, architectural limit) so the document no longer conflates full closure with partial or detection-only primitives. The companion capability-token spec draft at docs/CAPABILITY-TOKEN-SPEC-DRAFT.md proposes the four-component APS-aware closure stack (sink-authored canonical challenge, consumable authority tokens, sink-signed effect receipt, typed epistemic receipts) as a v3.0 research target with no fixed date; universal hygiene layers land incrementally in v2.3 through v2.5 without waiting for v3.0.

• ENFORCEMENT-TRUST-ANCHOR.md v1.1
• CAPABILITY-TOKEN-SPEC-DRAFT.md v0.1

schchit (JEP author) opened PR #8 at agentid-aps-interop extending the composed/v1 envelope we shipped yesterday with JEP as a fourth signal in the decision_event CTEF category. JEP receipt flows into slots.jep verbatim without reshape. verify.py recognizes version: jep-v1 and handles judgment events per their native semantics (gate composition skips them rather than mistreating a judgment record as pass/fail). Pattern validated: composed/v1 host stays generic, new signals register by adding CTEF category + slots.<issuer> key + native version string. Harold merged PR #7 at 09:44 UTC, schchit opened PR #8 seven hours later, first third-party extension of the composed/v1 pattern. AgentID + APS + AgentGraph + JEP now composable under one shared subject DID.

Depends on: d65-agentid-aps-interop-5-kenne

• PR #8 JEP fixtures

Closed the protocol-level asymmetry where agents authenticated to systems but systems did not authenticate to agents. Downgrade-proof four-step handshake (hello + attest each way), local trust-anchor bundle with binding constraints and revocation, replay defence via nonces + signed timestamps + max_clock_skew_ms, downgrade defence baked into the attest signature covering chosen_version + both nonces + peer certificate, adapters for A2A and MCP. 29 new tests, 2395 total, 146 MCP tools. Explicitly does NOT ship federation, gossip, consensus revocation, cross-signing, hosted CA, or legal-entity model. Mutual auth stands on its own as a primitive; a future federation layer composes on top without changing it. Module lives at src/v2/mutual-auth/ with standalone README.

• Module README
• npm v2.2.0

First three-issuer composed envelope in the interop repo, shipped end-to-end in seven hours after slot shapes landed. PR#7 adds: (a) three APS v1 structural fixtures at fixtures/aps/v1/ (happy-path, revoked-delegation, scope-widening-attempt), (b) three composed envelopes at composed/v1/agent_interop_test_001/ stitching AgentID + APS + AgentGraph slots under shared subject DID, (c) issuer-neutral Python verify.py (jcs dep only, no APS SDK), (d) additive schema amendment 1.1.0 to 1.2.0, (e) composed/v1/README.md documenting composition contract and two-level version discipline. 51 of 51 checks pass at exit zero. Kenne ran verify.py on his machine and posted LGTM from the AgentGraph seat. Waiting on Harold merge.

Depends on: d65-harold-signing-alignment

• Issue #5
• APS coordination reply

Feature request to the Google Agent Development Kit for an interception point before a tool call runs, the same shape argued to other runtimes: the framework needs somewhere for an external decision to land before the action, not after it.

• adk-python #5448

Harold (haroldmalikfrimpong-ops) merged PR#38 (Interop Week 1 Step 1) and then, at 08:40 UTC Day 65, came back with a voluntary alignment: AgentID's production signer switched from signing UTF-8 hex strings to signing raw 32-byte digest bytes (the option (b) from our 5-check review, the convention APS/SINT/MolTrust already use). Follow-up PR will replace the one signature field on the already-merged fixture to match the new signer. Five production issuers now converge on one signing convention: the Week 1 bundle README convention table becomes a single sentence rather than per-issuer footnotes. Materially important for cross-issuer harness verification under OWASP / IETF reviewer gaze. Acked via https://github.com/aeoess/agent-governance-vocabulary/pull/38#issuecomment-4289797509.

Depends on: harold-canonical-repo

• vocab PR#38

Delivered the three-step schema package (JSON Schema draft-2020-12 facet + two worked examples + README with design decisions) committed on Apr 20. Five load-bearing design decisions captured: RunFacet not DatasetFacet (agent + covenant are run-scoped), digest required with resolver optional (tamper-evidence without forcing public URLs), type is open enum with governance_attestation as vendor-agnostic default, covenantInEffect.additionalProperties: true scoped to sub-object for vendor extensions, digestAlgorithm defaults to sha-256 with explicit override. Both examples (Nobulex nobulex_covenant + APS governance_attestation) validate cleanly against the schema. Two asks back to @arian-gogani: (1) review Nobulex example shape since we don't have the live receipt structure, (2) confirm covenant-hash mapping still matches v0.2 CTEF governance_attestation digest shape. Next step: upstream PR to OpenLineage/OpenLineage spec repo once arian signs off. Caught and fixed an honesty drift in the draft (speculation that arian had mentioned covenant graphs, which he hadn't) before posting.

Depends on: openlineage-4409-facet-schema

• Schema delivery comment

Bounded-scope Python repo under aeoess org. Single-file script, 5-step harness (fetch Agent Card, DID resolve, signature verify, delegation chain verify, emit v1.1-compatible JSON row). Three distinct failure modes observable: signature_invalid_format_drift, signature_invalid_key_mismatch, signature_invalid_tampered. MolTrust co-maintainer access on invite. Committed Apr 17 on a2aproject/A2A#1755, this-week deliverable (~Apr 21-24).

Depends on: d61-v2-architecture-separation

• A2A#1755

Waiting on the AI Agent Interoperability Foundation Technical Committee to triage project-proposals#14. #12 (SINT) and #13 (similar proposal) set the Tuesday UTC precedent for TC turnaround, expected window Apr 21. Outcome shapes whether APS moves toward Linux Foundation stewardship now or the Working Group path stays the primary governance vehicle. A founder call, not a delegated one.

Depends on: d64-aaif-submission

• aaif#14

Day 64 (Apr 20): boundary held on §3.3 naming when a proposal came in to co-list APS APS and AiEGIS APS as one citation. Accepted on technical content (evidence sequencing, measurement method); declined on naming, paste-ready §3.3 text names only APS APS as shipped reference, with AiEGIS APS re-evaluated at v1.0. Day 65 (Apr 21): VeloGerber accepted the naming position (22:51 Apr 20) and asked scope-clarification: does independent Python reimpl (a) or SDK-consumption (b) qualify as §3.3 production conformance evidence for AiEGIS v1.0. Answered: (a) earns a separate conformance row, (b) is a deployment pattern; v0.9 cites APS APS, v1.0 re-evaluates once (a) lands. Concrete offer: ship interop fixtures as standalone aps-conformance-suite repo so the bar is legible.

Depends on: d64-owasp-aars32-boundary

• AARS#32

Filed as aaif/project-proposals#14. Foundation submission for the public protocol layer, cross-referencing SINT #12 (Illia) and the three-vendor governance_attestation convergence with MolTrust. APS company, YC application, private gateway, and commercial partnerships deliberately excluded, commercial adjacencies stay independent of the protocol submission. Every live-artifact claim in the submission verified before posting: JWKS endpoints return 200, npm and PyPI artifacts resolve, Zenodo DOIs have landing pages, crosswalk entries validate. Gist for Illia's AAIF cover email at gist.github.com/aeoess/a622521d10625179c2d7760d83663714. Waiting on AAIF TC triage, expected Tuesday UTC per #12/#13 precedent.

Depends on: d61-v2-architecture-separation

• aaif#14

Numbers-only minor bump on the agent-passport ClawHub skill. Description, SKILL.md line 3, and SKILL.md line 181/184 all synced to the current surface: 124 modules, 2,366 tests, 142 MCP tools. _meta.json description rewritten to match. v5.4.0 already existed on ClawHub from an earlier auto-publish cycle; bumped straight to v5.5.0 to reflect on-disk state. Commits 00b40fd + 6e43f99.

Depends on: d64-v210-cognitive-attestation

Context: the structured ecosystem map from Day 61 rebuilt Sunday night, today's response queue visible at session start. Posts in two batches. Tier 1 (7): AAIF cover-email gist for Illia on sint#130, pshkv crosswalk ack on vocab#8, governance-declaration proposal for tomjwxf on ossf/security-insights#171, APS+SINT composition MVP for EchoOfDawn on autogen#7525, SDK#16 MIGRATION.md field-diff patch + v2.1.0 ship follow-up to MoltyCel, vocab#38 five-check protocol review for Harold's AgentID fixture (JWKS live, Solana tx verified, signing-input UTF-8-hex vs bytes ambiguity flagged), vocab#34 context_dimensions PR flipped ready-for-review. Tier 2 (4): autogen#7528 three-layer APS+SINT+OPA composition mapped onto ConversableAgent lifecycle, A2A#1716 Enclave+SINT+MolTrust converged-architecture ack with sub_delegate for 1→3 hop + AND-composition for MolTrust-score + APS-grade gate, VoltAgent#1166 full TS GuardrailDecision interface reference implementation (Alvasilev12/MEEET canary correctly ignored), llama_index#21312 dispute-primitives reference from v2.1.0. insumer-examples#1 skipped, zero activity since our Apr 17 scope ack.

Depends on: d61-ecosystem-engagement

VeloGerber (AiEGIS) proposed co-listing 'APS APS' and 'AiEGIS APS' as two entries in the permanent v0.9 §3.3 standards citation. Technical content of the proposal accepted on its merits (evidence sequencing, measurement methodology). Naming framing declined firmly in writing with paste-ready §3.3 text naming only APS. Apr 21 calendar typo in the proposal also flagged. Posted at github.com/OWASP/www-project-artificial-intelligence-vulnerability-scoring-system/issues/32#issuecomment-4284723330. Not every be-nice reflex is the right one.

• OWASP AARS#32

Stability window closed clean. SDK v2.0.0 and MCP v3.0.0 flipped from @next to @latest. PyPI 2.0.0 final replaces the 2.0.0b0 pre-release. v1.46.0 and MCP v2.27.0 moved to the legacy-v1 tag, six months of legacy-tag availability committed. Propagation sweep also caught a Python __init__.py __version__ drift carrying "0.15.0" from the beta period, if a caller imported agent_passport.__version__ at runtime, they would have seen 0.15.0 while pyproject.toml and the wheel said 2.0.0b0. Fixed to 2.0.0 during the promotion sweep.

Depends on: v2-promotion-decision

• SDK v2.0.0 @latest
• Blog

Two primitives shipped on @latest same day as the v2 promotion. Cognitive Attestation envelope: TypeScript port of the normative JSON schema from Paper 7 (Zenodo 10.5281/zenodo.19646276), module at src/v2/cognitive-attestation/ with types, envelope, verify, disputes, index, README. Stage 1 cryptographic verification with required_signer_roles coverage fully implemented; Stage 2 registry interface, Stage 3 replay typed stub with clear TODO. Typed dispute primitives ship the vocabulary of disputes without baking resolution logic into the protocol (resolution layer lives in the consumer). 35 new tests (envelope 17, verify 12, adversarial 6), zero new npm deps, reused internal canonicalizeJCS + crypto/keys. Second primitive: verifyBoundWallet object-form overload, closing the SDK#16 UX asymmetry MoltyCel flagged. Commits ceb1cd1 (wallet-binding) + 8c9cc14 (cognitive-attestation) on @latest. Test count 2,325 → 2,366.

Depends on: d64-v2-promoted-latest

• Paper 7 on Zenodo
• SDK v2.1.0

AgentID trust_verification fixture merged via PR#38 (Harold). First of five Week 1 slots filled. Production JWKS and Solana devnet anchor both verified live during 5-check. Status ack posted to vocab#36 with running fixture table; Step 4 (peer_review task_completion) re-pinged to @QueBallSharken / Logpose after @rnwy's graceful decline to pad bundle with reviewer_credibility into a task_completion shape.

Depends on: d63-interop-week-1-opened

PR against in-toto/attestation adding a sibling predicate type for session-level Governance Attestation, referenced by hash from Decision Receipts. Accepted delegationChainRoot: DigestSet camelCase per tomjwxf's #549. Triggers when tomjwxf's Decision Receipt predicate PR#549 lands. Draft scaffolding already started at specs/in-toto-sibling-predicate-draft/.

Depends on: d61-ecosystem-engagement

• in-toto#549

Committed on aeoess/agent-passport-system#12 to a 48-hour review turnaround once @nanookclaw sends the PDR v2.20 §8 draft. Section 8 is PDR's proof-of-orthogonality workbook between Saebo (constraint compliance), Pidlisnyi (Hold/Bend/Break), and PDR (cross-session reliability). Our v1.46.0 pin commitment + optional dogfood gist refresh for the experimental substrate is already on the table. Passive until nanookclaw sends.

Depends on: pdr-paper-cites-aps

• APS#12

PR #34 merged Day 65 (commit 6a24b73f) adding context_dimensions as third top-level structural section in vocabulary.yaml. Four Day-1 entries with non_signal_test discipline: counterparty_standing, request_origin, session_dynamics, physical_environment_state. Incorporated @pshkv review (resolution_source marked recommended-not-required in v0.1, physical_environment_state per-evaluation variance documented, 4-value enum as v0.2 fallback). @tomjwxf's 5-value enum preserved per his Day 63 sign-off. Self 5-check protocol run publicly before merge (transparency move on our own repo). Closes #26.

Depends on: d61-aeoess-aps-crosswalk

• vocab PR#34

Batch update on the existing YC application. Day 64 state to carry: v2 architecture separation, AAIF filing, Paper 7 ship, 124 modules, 2,366 tests, 142 MCP tools. Tima owns the irreversible commercial lane, Claude drafts the update diff only. Deadline May 4.

Depends on: yc-application

Opened vocab#36 as a structured five-signal compose-test invitation to the ecosystem: trust_verification → governance_attestation → entity_continuity → peer_review → settlement_witness. Framed as a test not a standardization play, with explicit disclaimers (not a spec change, not an APS showcase, not an entity_continuity canonical promotion attempt). Two fixtures confirmed within 45 minutes of opening: @arian-gogani (Nobulex, governance_attestation, HIPAA scenario with bilateral-receipt structure) and @nutstrut (continuity-analyzer, entity_continuity + settlement_witness). @rnwy declined step 4 gracefully (RNWY reference_point is reviewer_credibility, not task_completion), re-pinged Logpose for step 4. Steps 1 (MoltyCel/Harold) and 4 (Logpose) still open.

Depends on: d58-vocab-momentum

• vocab#36

Stability-window Sunday. Exactly one partner compat test ran through [email protected] and MCP v3.0.0, MoltyCel on Solana wallet binding with a fresh Ed25519 keypair, bs58 signature, full bindWallet → verifyBoundWallet round-trip. Two findings surfaced: MIGRATION.md did not call out the wallet_ref field-level v1-to-v2 shape change explicitly enough, and verifyBoundWallet accepted only positional args while bindWallet accepted an object form. Shape-diff clarification landed same day as commit 0a3edeb. UX overload queued for v2.1.0. Nothing else broke; promotion path stayed on for Monday.

Depends on: d61-v2-architecture-separation

• SDK#16 compat test

Commitment to @arian-gogani on OpenLineage/OpenLineage#4409 after his 8-minute endorsement of the vendor-agnostic digest abstraction. Three-step plan delivered Day 65 (Apr 21): minimal JSON Schema shape, open type enum, two worked examples (Nobulex bilateral-receipt + APS gateway trust profile), all three files valid JSON and both examples validate cleanly against the schema. Posted on the thread for arian review before any upstream OpenLineage PR. Positions APS's governance_attestation canonical as a referenceable issuer type in OpenLineage's covenantInEffect facet, multi-day audit exchange compresses to single verification step. Committed inside the week window as promised on Apr 20. Waiting on arian sign-off before the upstream PR to OpenLineage/OpenLineage.

Depends on: d61-aeoess-aps-crosswalk

• Schema delivery comment

New repo at github.com/aeoess/adk-aps-integration spun up Day 62 in response to google/adk-python#5164. Joint ownership with @tomjwxf (ScopeBlind). LICENSE carries both names (Copyright 2026 Tymofii Pidlisnyi, Thomas Farley). Structure: main branch (README pointer) + integration-skeleton branch with aps_delegation.py, receipt_signing.py, verify.sh, examples/basic-tool-call. CI matrix across Python 3.10/3.11/3.12 against both @next and @latest APS SDK plus @veritasacta/[email protected]. Receipt format shipped as audit-bundle shape (matches verifier's actual contract, not per-call receipts). Six jobs green after CI fix (commit 7f7bae68). tomjwxf collaborator invite pending acceptance.

Depends on: d61-v2-architecture-separation

• adk-aps-integration
• adk-python#5164

Two ecosystem threads got substantive engagement, neither inserting APS into the conversation. x402#1904: MnemoPay (Jerry) shipped x402-compatible paywalls plus a financial-brain MCP. Reply was a three-point read on what they shipped (wallet-decision layer is new terrain, receipts plus MCP tool outputs are compatible with APS signing for downstream composition, composition hook via delegation-reference in X-Agent-Identity would make APS passports attachable to x402 requests without modifying x402). ATF#8: desiorac proposed the ArkForge three-plane decomposition (delegation, decision, execution). Reply was a +1 proposing a Notes-column cross-reference so the composition is visible in their ECOSYSTEM table without inference, linked in-toto#549 as the chain-linkable primitive. Both threads pushed forward the conversation on the partner's terms. Several unrelated canary threads correctly skipped (handles not named here for operational hygiene).

Depends on: d61-v2-architecture-separation

• x402#1904 reply
• ATF#8 reply

Two external vocabulary crosswalks merged same day. SINT refresh (PR #30, Illia Pashkov) normalized match semantics to the canonical enum (exact|partial|no_mapping), added a peer_review no_mapping row, updated home to docs.sint.gg, recorded entity_continuity and consent_provenance alignment notes. RNWY a2a.yaml (PR #32) maps A2A Agent Card governance metadata (peer_review, behavioral_trust, wallet_intelligence) against did:web:rnwy.com with a live JWKS serving rnwy-trust-v1, rnwy-trust-v2, rnwy-wallet-v1. Both PRs submitted clean, validator passed, scope was tight. Registry is now at 14 external partner crosswalks plus aeoess-aps (shipped Day 61). Validator chore f092f0e also landed same day, renaming note to notes for schema consistency.

Depends on: d58-vocab-momentum

• PR #30 SINT refresh
• PR #32 RNWY a2a

New repo at github.com/aeoess/hermes-aps-delegation spun up Day 62 in response to NousResearch/hermes-agent#11692. Single-repo scope (original prompt asked for three; scope correction held). Structure: src/, tests/, charter/, examples/, pyproject.toml, LICENSE, .gitignore. 12 pytest cases + ruff + 3 example smoke runs + charter validator, all green on Python 3.10/3.11/3.12. v0.1.0 release tracking at aeoess/hermes-aps-delegation#1 (end-of-April milestone). Hermes-specific hook points stubbed with offer to wire real interfaces if NousResearch shares their non-public integration surface.

Depends on: d61-v2-architecture-separation

• hermes-aps-delegation

Two interop harnesses landed in the SDK. AgentNexus Track A fixtures (kevinkaylie, PR #17) replay end-to-end: JCS re-canonicalization, Ed25519 signature verification, delegation chain walk, monotonic narrowing check at each hop. Both fixtures match expected, happy-path accepts, scope-expansion denies at the subset gate, zero canonicalization drift. VeritasActa KU signer (tomjwxf, VeritasActa/verify#2, test vectors PR#6) slots APS into their external_receipts.aps bundle field with JCS-canonical sha256 over each knowledge unit receipt, records the chain in contributingSources, signs with deterministic test key. Cross-layer integrity is observable either direction: tampering any KU byte invalidates the recorded accessReceiptId while the APS signature stays cryptographically valid. Neither interop required a protocol change. APS slots in as specified.

Depends on: d61-v2-architecture-separation

• PR #17 AgentNexus fixtures
• Blog

Jerry Omiagbo (MnemoPay) pinged aeoess directly on x402#1904, crediting the receipt-as-verifiable-economic-memory framing from Apr 2 (Day 44) with driving his last three MnemoPay releases. MnemoPay SDK @mnemopay/sdk v1.3.1 shipped Apr 17 with mnemopay.com live: receipt-as-primary-object, 3-verdict lifecycle (permit_settled/permit_failed/deny), per-agent Merkle log. First concrete case of another company building on a framing we published without us writing a line of their code. Replied with three substantive acks + composition hook for delegation-reference in X-Agent-Identity.

Depends on: d49-twelve-primitives

• x402#1904 reply

Paper 7 published on Zenodo (DOI 10.5281/zenodo.19646276). Introduces the Cognitive Attestation envelope: a cryptographic commitment attached to an agent's action record declaring which sparse-autoencoder features engaged and at what intensity during the output. Three-stage verification model, Stage 1 cryptographic verification (required_signer_roles coverage), Stage 2 registry interface, Stage 3 replay. Accompanied by a normative JSON schema (papers/paper-4/poc/schema/cognitive_attestation.schema.json) and a Python reference envelope validated against Llama-3.1-8B via Neuronpedia. Ported to TypeScript as SDK v2.1.0 on Day 64.

Depends on: d57-paper-published

• Paper 7 on Zenodo

Two fixture PRs shipped upstream to ScopeBlind/agent-governance-testvectors. PR #2: A2A#1742 Week 2 APS fixtures in a2a-trust-header/, 6 JSON fixtures (happy-path, scope-expansion, revocation, multi-hop, tampered, partial-chain) + deterministic generator + verify script + README, all Ed25519/JCS-canonical, 6/6 round-trip pass. PR #3: OWASP#802 gateway enforcement vectors, 4 vectors (fail-closed, external-verification, state-drift, portability), 34 files, every signed artifact verified before commit. Both PRs mergeable, tagged MoltyCel + tomjwxf.

Depends on: d62-interop-verification

First time we published our own crosswalk in the registry we host. Closes a dogfooding gap: twelve external partners had contributed their crosswalks (InsumerAPI, SINT, AgentNexus, Veritas Acta, Logpose, RNWY, SoulboundRobots, Nobulex, SAR, JEP, asqav, SATP), we had not. crosswalk/aeoess-aps.yaml covers 3 exact-match signal types (passport_grade, trust_verification, governance_attestation), 2 partial (behavioral_trust, entity_continuity), 7 honest no_mapping entries, 4 decision_trajectory mappings, 1 constraint mapping, and out_of_vocabulary_primitives section for runtime enforcement mechanics. vocabulary.yaml updated: APS added to governance_attestation.issuers_in_production as 4th production issuer via Build D2 JWS trust profile endpoint.

Depends on: d58-vocab-momentum, d59-build-d2-jws-signing

• aeoess-aps.yaml

Posted primary release announcement at aeoess/agent-passport-system#16 as canonical reference link. Four cross-references to targeted threads (aeoess#2 closing SDK-publish issue, haroldmalikfrimpong-ops/agentid-aps-interop for Harold's interop fixtures, aeoess#12 for Nanook §8 coordination, openclaw#49971 for MoltyCel wallet binding). Seven substantive replies to active partners: A2A#1742+1755 (MoltyCel coordination plan + DID resolution), VeritasActa/verify#3 (tomjwxf ecosystem tracker), microsoft/agent-governance-toolkit#787 (pshkv + tomjwxf wine-shipment three-way composition, committed to ship aps_delegation_wrapper.py PR), google/adk-python#5164 (tomjwxf co-maintain acceptance for agent-governance-stack-example repo), aeoess/agent-governance-vocabulary#12 (nutstrut failure_codes draft feedback), langchain-ai/langchain#35691 (vdineshk Observatory composition observation). 3 new deliverables tracked for the Apr 21-24 window.

Depends on: d61-v2-architecture-separation

• Release announcement #16

In early April a distinction was drawn on a public payments thread between an agent remembering what happened and an agent being able to prove it, with a sketch of a receipt carrying intent, scope evaluation and outcome under one signature. Two weeks later the maintainer wrote back that the gap was where they had been drawing the line wrong, that the framing drove their last three releases, and that they had been treating the receipt as a log artifact when it needed to be the primary settlement object. What shipped carries the full lifecycle in the receipt, chained to a Merkle root with per-leaf reconstruction, and a million-operation stress test. No code of ours is in it. This is the clearest case of a framing travelling without an implementation attached to it.

• x402 #1904

Monolithic SDK split along the protocol-vs-product axis. Public SDK keeps crypto, types, scope logic, adapters, conformance suite, interop vectors, and the 8 core primitives (byte-identical to v1.46.0). Private gateway package takes ProxyGateway, DataEnforcementGate, ContributionLedger, SettlementGenerator, IntentNetwork, DelegationStore, ReceiptLedger, 18 behavioral-analytics modules, EscalationWorkflow, SemanticDriftTracker, AnomalyDetection, MigrationWorkflow, AttestationLedger, and runtime state management. ~647 tests moved with them. Partners on any v1 pin unaffected: v1.46.0 stays on npm @latest through stability window. Unlocks foundation submission (AAIF target) and protects the pixel attribution moat. SDK v2.0.0-beta.0 on @next (2,325 tests, 130+ modules), MCP v3.0.0 on @next (142 tools, down from 154 after removing 12 product-only tools and stubbing 10 gateway-moved tools), Python v2.0.0b0 on PyPI as PEP 440 pre-release, Gateway repinned to ^2.0.0-beta.0 and Railway-redeployed zero-downtime. Three-layer safety net: anchor tags in every repo, local snapshot kit, and a private archive repo (internal).

Depends on: d59-build-a-shipped

• SDK @next v2.0.0
• MCP @next v3.0.0
• PyPI v2.0.0b0
• Release notes
• Blog

48-to-72-hour stability window closed clean. v2.0.0 promoted to npm @latest across SDK and MCP v3.0.0. PyPI 2.0.0 final shipped (non-pre-release, replacing 2.0.0b0). v1.46.0 and MCP v2.27.0 parked on legacy-v1 tag for six months, installable indefinitely. Four external partner integrations landed against v2 during the window (AgentNexus Track A, VeritasActa KU signer, SINT refresh, RNWY a2a.yaml), all ran through v2 transparently. One partner compat test surfaced two shape/UX findings (MoltyCel, SDK#16), both fixed within the window. Python __init__.py __version__ drift also caught and corrected during promotion sweep.

Depends on: d61-v2-architecture-separation

Per-period signed settlement records aggregating Attribution Primitives across D/P/G/C axes. Four Merkle-committed axis roots. Contributor query endpoint verifying end-to-end without trusting the gateway beyond its JWKS. Economic half stays gateway-private; evidence half ships in the SDK. 5 cross-language fixtures, byte-identical across runs. Shipped SDK v1.46.0, MCP v2.27.0 (3 new settlement tools), Python v0.15.0.

Depends on: build-b-fractional-weights

Tutorial 33 in the Microsoft agent-governance-toolkit documents offline-verifiable decision receipts. Written by a maintainer of that project and merged there, which puts the receipt shape in front of that toolkit's readers rather than ours.

• agent-governance-toolkit #1197

Role-based fractional weight formulas for D and C axes. Merkle tree composition. Sum-to-one property tests. Shipped SDK v1.45.0.

Depends on: build-a-attribution-primitive

One signed Merkle envelope replaces four separate attribution receipt types. D (data), P (protocol), G (governance), C (compute). Each axis projection verifies independently; two projections of the same receipt cross-verify by shared action_ref + merkle_root + signature. 6 new SDK exports, 6 new MCP tools, 1:1 Python port with cross-language sig verification. SDK v1.44.0 (2,910 tests), MCP v2.25.0 (149 tools), Python v0.13.0. Unblocks Builds B and C.

Depends on: build-a-attribution-primitive

• SDK v1.44.0
• Blog

Gateway a public trust-lookup endpoint on the gateway now attaches compact Ed25519 JWS to successful responses via three headers: X-APS-JWS, X-APS-JWS-KID: gateway-v1, X-APS-JWS-JWKS pointing at the public JWKS. Body unchanged, non-breaking for existing consumers. Cross-engine verifiable with jose: kid matches, alg is EdDSA, signature checks out against the public key. Closes the gap between 'the gateway told me X' and 'I can show a third party that the gateway told me X.'

• Gateway JWKS

Three-agent coordination path (primary operator + reviewer agent + comms relay) retired. Reviewer agent workflows archived under archive-portal-era/ with ARCHIVE-README.md, nightly cron deleted, GitHub posting flows through a single path. Historical records (roadmap, blog, ops log) preserved as-is. Fewer moving parts.

Self-opened issue auditing peer_review canonical promotion (Logpose task-completion vs RNWY reviewer-credibility, different primitives under one name). Proposed Path A: narrow peer_review to task-completion (Logpose), introduce reviewer_credibility as proposed with RNWY as sole implementer. Closed 2026-04-17 via PR#31 merge (rkaushik29 peer_review scope note).

Depends on: d58-vocab-momentum

• Issue #29

SDK v1.43.0 adds Solana to the wallet_ref chain enum with base58 validation. Paired gateway fix: chain-aware normalization replaces blanket lowercasing of the wallet payload so base58 addresses round-trip correctly. Bug was silent data corruption, every receipt that passed through would have signed over the wrong address. End-to-end wallet binding now spans Ethereum, Bitcoin, Solana. 2,848 tests. Closes openclaw #49971.

Depends on: d57-boundary-primitives

• SDK v1.43.0
• openclaw #49971

Four PRs merged Apr 15: asqav crosswalk (jagmarques, ML-DSA-65 server-side, first lattice-based contributor), JEP (schchit, IETF I-D pending, JCS+Ed25519), insumerapi license-endpoint fix (douglasborthwick-crypto), validator cleanup + format normalization. peer_review promoted to canonical status after Logpose (rkaushik29) and RNWY (rnwy) landed as two independent implementations, first post-launch canonical promotion under the CONTRIBUTING.md two-implementation threshold. 14+ contributors, 11 PRs merged in 6 days.

Depends on: vocab-contributing-lands

• agent-governance-vocabulary

rnwy opened PR#28 adding SBR crosswalk for entity_continuity. Merged 2026-04-17.

Depends on: d58-vocab-momentum

• PR #28

A map of who is actually doing the work across the agent-governance threads we track. 59 threads pulled, 29 of them carrying human activity once automated posts are filtered out, 1,471 comments and 73 participants across 10 repositories. Contributions are scored by weighted signal tier rather than comment count, so an embedded code block or a commit reference outranks a short release announcement, and single-word reactions are penalised. The map exists to find the people worth answering, so it records contribution and carries no judgement of any participant.

Three v2 constitutional modules address distinct failure modes that surfaced in production. AttributionConsent prevents citing third-party principals in binding artifacts without dual signature, representation boundary. ProvisionalStatement + PromotionEvent defaults agent-to-agent statements to provisional, requires explicit PromotionEvent for binding, commitment boundary. HumanEscalationFlag gates per-action-class owner confirmation with three scope modes, escalation boundary. Integrated into charter, settlement, and completion-receipt verification. SDK v1.42.0 (2,844 tests), MCP v2.24.0 (143 tools), Python v0.12.0.

Depends on: sdk-v141-state

• SDK v1.42.0
• Paper on Zenodo

Working paper published on Zenodo (DOI 10.5281/zenodo.19582550). Argues that the unit of agent governance is not the agent but the population-with-medium, the collective state of inherited fragments across short-lived sessions. Defines the medium as a governance contract that specific substrates implement, distinguishes access from declared influence, names the central open problem (cryptography formalizes authorship, not meaning), and grounds the cognition claim in existence proofs already around us: institutional memory, Wikipedia, open-source development. Six rounds of adversarial review across three model families before publication.

Depends on: d57-boundary-primitives

• Paper 6 on Zenodo

Internal rule: five-check evaluation (identity / format / substance / scope / reversibility), three decision classes (AUTO-OK / REPORT-FIRST / NEVER-AUTO), tier-based contributor classification T0-T3 with auditable promotion/demotion. Replaces implicit pattern-matching with structural discipline. A live transfer-request incident used as the worked example. Applied on first test: vocab#14 auto-merged (T2 descriptor typo fix), vocab#15 formal CHANGES_REQUESTED review (T2 peer_review canonical entry, touched canonical vocabulary.yaml, needed status:proposed + descriptor dimensions before merge).

Depends on: principal-accountability-reversal

Public contribution standard for the vocabulary repo. Quick Start checklist, merge criteria (5 review questions applied equally), canonical-status rule (2+ independent implementations), stability expectations, no CLA required. Contributor Covenant 2.1. Written after two multi-model review rounds, the review flagged defensive tone and trauma leaks, both addressed. Template for roll-out across SDK and spec repos.

Depends on: vocab-repo-launches

• CONTRIBUTING.md

Unified four-axis (D, P, G, C) signed Merkle receipt. One AttributionPrimitive envelope, four independently-verifiable axis projections, cross-verify by shared action_ref + merkle_root + signature. Canonical weight-string representation, balanced Merkle composition, residual-bucket aggregation for sub-threshold contributors. Shipped SDK v1.44.0, MCP v2.25.0, Python v0.13.0.

Depends on: attribution-primitive-spec

A vocabulary repo transfer request surfaced that a collaboration agent had made commitments its principal had not authorised. The public reversal established the thesis this entry exists to record: broad delegation scopes cover pragmatic overreach, which is the Model Citizen trap; counterparty standing is invisible to agents, so a fresh account and an established one look identical at the point of decision; and the principal, not the agent, carries accountability for what was committed. Counterparty identity is deliberately omitted here. The pattern is the record, not the person.

Depends on: vocab-repo-launches

• A2A #1734

QueBallSharken boundary statement. Three separate problems acknowledged.

Default a public trust-lookup endpoint on the gateway signs with gateway Ed25519 key. X-APS-JWS / X-APS-JWS-KID / X-APS-JWS-JWKS response headers. Ed25519, kid gateway-v1, cross-engine verifiable against the public JWKS. Shipped 2026-04-16.

xsa520's evaluation-point vs decision-point gap. Hard/state-volatile/contextual gates.

aeoess.com/roadmap timeline with dependency graph. YAML-driven, static, matches site design. Shipped at https://aeoess.com/roadmap.html.

pshkv's SINT integration merged (9/9 cross-verify passing). Physical-world enforcement layer. Now in INTEGRATION.md.

Depends on: vocab-pr7-sint-crosswalk

First-time contributor PR on SDK repo. Redirected to separate vocabulary repo, which became the canonical home for this kind of contribution. PR closed. 7 SAY-5 equivalents have since landed in agent-governance-vocabulary from other contributors.

kevinkaylie's AgentNexus governance vocabulary crosswalk.

Depends on: vocab-pr7-sint-crosswalk

Commercial-irreversible lane. Tima's sole ownership.

Three-namespace cross-verify: did:agentnexus subject, APS + MolTrust issuers. Test DID registered.

• A2A #1717

Three-property liveness decomposition ADR on microsoft/agent-governance-toolkit. PR #948 co-authored.

• PR #948

Formal spec v1.1 (71KB) committed to aeoess_web/specs/ATTRIBUTION-PRIMITIVE-v1.1.md on Apr 12. Unified cryptographic object with three axis projections (data, protocol, governance). Unblocks Build A.

Depends on: paper-5-physics

Audit log export in JSONL, CSV, PDF. Tenant isolation, rate limiting, delegation chain resolution.

Depends on: d53-convergence

CI validator checking descriptor enums, signal types, required fields against vocabulary.yaml. 162 lines.

Depends on: d53-convergence

• Vocabulary repo

15-config experiment harness (5 scenarios × 3 AI families). Measures complementarity-gain across Claude, GPT, Gemini.

Depends on: d53-convergence

[email protected] on npm. 2,763 tests passing across 714 suites (1 skipped). 35 v2 constitutional modules + core. MCP server at v2.23.0 with 132 tools. Python SDK at 0.11.0. Wallet binding, subDelegateAdvisor, credentialCheckPolicy all shipped.

• npm

pshkv's SINT crosswalk. Review complete. Waiting on validity_temporal fix.

aeoess/agent-governance-vocabulary opens as the canonical naming layer for agent governance primitives. IANA JWT Claims Registry / W3C DID Registries precedent. Six crosswalks merged in four days from five independent maintainers: InsumerAPI (Douglas Borthwick), SINT (Illia Pashkov), JEP (schchit), AgentNexus (Kevin Kaylie), SATP (0xbrainkid), Nobulex (Arian Gogani). Each system keeps its internal names and publishes a crosswalk mapping to the canonical vocabulary.

Depends on: vocab-pr7-sint-crosswalk

• agent-governance-vocabulary

A2A, crewAI, qntm, SINT, OWASP, x402, VoltAgent, langgraph-swarm, AgentID. APS in every layered-identity discussion.

Depends on: w3c-normative

New user bounced in 90s from 132-tool flood and 925 SDK exports. Shipped /core subpath (~25 curated functions) and MCP essential profile (20 tools). SDK v1.40.0, MCP v2.22.2, 2,552 tests, 103 modules.

Depends on: d51-quantum-governance

Six weeks of circling quantum. Multi-model review found it: physics facets on delegations. 7 experiments on IBM Quantum. Bell 5.2pp + GHZ 7.7pp fidelity gaps.

Depends on: d49-twelve-primitives

Governing what agents learn from authorized access. Telemetry scopes, BMOs, BYOM.

Depends on: paper-3-faceted-authority

• Zenodo

Governing quantum hardware quality. Real IBM Quantum experiments. 5.2pp Bell + 7.7pp GHZ fidelity gaps.

Depends on: paper-3-faceted-authority

• Zenodo

Longest session yet. 4-pass audit (30 findings, all fixed). Email infrastructure. Portal redesign. Full API docs. Status page. Admin endpoints. SDK v1.36.4, MCP v2.21.3, Gateway v0.4.0, 2,497 tests.

Depends on: d49-twelve-primitives

Two proposals filed the same day arguing the same boundary from different ends: tool execution governance in LangChain, where authorization is scoped by delegation rather than by the calling code, and delegation-scoped handoffs in the OpenAI agents SDK, where authority narrows as a task passes between agents. Both closed.

• langchain #36587

Nate B Jones reverse-engineered Claude Code's orchestration into 12 primitives. We shipped all twelve. Tool registry, permission tiers, context compression, state machines. SDK v1.36.2, 626 suites, 132 tools, MCP v2.21.1, 2,497 tests.

Depends on: d48-six-sessions

douglasborthwick-crypto ran multi-issuer verification on insumer-examples#1. APS position 5 (passport_grade, gateway-v1 kid) verified alongside InsumerAPI (wallet_state), ThoughtProof (reasoning_integrity), RNWY (behavioral_trust), Maiat (job_performance), AgentID (trust_verification), AgentGraph (security_posture). Cross-protocol attestation composable format.

Depends on: harold-canonical-repo

60 GitHub issues posted in one afternoon. Anthropic/MCP org blocked the aeoess account from posting on modelcontextprotocol/modelcontextprotocol. Permanent reference case for what volume costs. Origin of the Risk Guardian discipline, comms became something to govern, not just do.

Depends on: wg-formed

Five reviewer models attacked specs before a single line shipped. Six sequential sessions, each depends on previous deploy. Gateway auto-deploys on push. SDK v1.34.0, MCP v2.21.0, 131 tools, 2,306 tests, 103 modules, Gateway v0.4.0, Python v0.9.0.

Depends on: d47-ms-merged

$285M UNC4736 DPRK social engineering hack. Ran 5-model architectural review on forensic attribution vs structural constraints. Killed 5 bad ideas (behavioral signals, cascade verification, prosecution scoring, general stake, forensic attribution test). Posted A2A#1628 reply framing authority-class separation + non-bypassable timelocks + hard velocity ceilings. Drove Values Floor timelock + Grade-gated authority build queue.

Depends on: multi-model-review-methodology

Microsoft approved APS PR into Agent Governance Toolkit. SINT v0.2 shipped with our delegation_depth_floor. W3C behavioral attestation reached normative language. Evidence-based grading + freshness semantics.

Depends on: d46-byoi

Nanook's PDR in Production v1.9 published on Zenodo. Section 7.6 is the first independent deep technical review of APS architecture, Bayesian sigma dynamics, structuralVerdict/trustVerdict separation, Module 37 as worked example. Tony Mason UBC production deploy (Hamut'ay, 98 cycles on Sonnet 4.6). DOI 10.5281/zenodo.19323172.

Depends on: paper-3-faceted-authority

• PDR v1.9

Timing asymmetry became normative constraint. Evidence-based passport grading + freshness semantics.

Depends on: wg-specs-ratified

APS stopped looking like an identity system. Four modules accept external credentials: did:key, did:web, SPIFFE SVIDs, OAuth 2.0. Routed through enforcement boundary. Python SDK v0.8.0, MCP v2.19.1, 125 tools, 2,180 tests, 559 suites, 103 modules.

Depends on: d45-governance-hardening

Lars Kroehl / CryptoKRI GmbH. Partner API key received (10K calls/day, 1K agents per batch). 11 APS agents bridged did:aps → did:moltrust → Base L2. Reciprocal gateway verification via GET a public trust-lookup endpoint on the gateway with JWKS. First bilateral production partnership.

Depends on: d46-byoi

Stricter validation on delegation chains. Tighter scope authorization. 34 new tests covering edge cases from MoltyCel security audit. 99 modules, 125 tools, 533 suites, Gateway v0.3.4.

Depends on: d44-solana-integration

PR #3 merged into kai-agent-free/solana-agent-identity. APSProvider is the 4th identity provider in Solana Agent Kit. First external code that imports the SDK. SDK v1.29.6, Gateway v0.3.1, 99 modules, 2,051 tests, 34 routes, MCP v2.19.1. Plus 5 security fixes.

Depends on: d43-multi-attestation

First external code that imports the SDK. Not a spec comment, APSProvider is running in another project's production repo as the 4th identity provider.

Depends on: yc-ceo-endorsed

douglasborthwick-crypto ran 5-issuer live pass: InsumerAPI, ThoughtProof, RNWY, Maiat, APS. Five dimensions, two algorithms (ES256 + EdDSA), independently signed. APS is the 5th verified issuer. SDK v1.29.4, 38 routes, 503 suites, 125 tools.

Depends on: d42-attestation-architecture

haroldmalikfrimpong-ops shipped agentid-aps-interop on getagentid.dev. 32/32 tests passing. Harold's PolicyChain primitive (SHA-256 policy hash chaining) adopted into APS SDK with name-attribution in commit message. Canonical external collaborator, contributor attribution as compounding strategy.

Depends on: d43-multi-attestation

Lev's agent farmed unlimited passports, drained Nik's promo wallet in 60s. Identity Sybil unsolvable in open protocols. 3-round multi-model architectural review across Claude, GPT, Gemini. SDK v1.29.1, 1,987 tests, 96 modules, MCP v2.19.0, 125 tools, Gateway v0.3.0, 37 routes.

Depends on: d41-agent-wallets

Agents need to spend money. Coinbase charges gas. ChainHop takes 0.75%. We charge nothing. Three commits, 1,430 new lines. Gateway v0.3.0, 18 → 36 API routes.

Depends on: d40-gateway-wiring

Private gateway cloned to the always-on host and run via the process supervisor on a local port alongside the Intent Network API. Four agents registered with real Ed25519 keys (tima-principal, claude-operator, portalx2-reviewer, aeoess-gpt-executor). Delegation chain bootstrapped with scoped authority and spend limits (a delegated build with a spend cap and a zero-spend review, both under the same chain, claude→portal sub-delegation). Full enforcement test battery passed: scope enforcement, spend tracking, cascade revocation. Built the gw CLI (gw eval, gw receipt, gw dash, gw audit, gw agents) for one-line authorization checks against the live gateway. APS runs on APS, this is the dogfood milestone.

Depends on: gateway-production

Import graph showed only 20% of modules connected to gateway enforcement hub. Four rounds of wiring. 20% → 79% interconnection. SDK v1.29.1, 96 modules, 1,987 tests, 503 suites.

Depends on: institutional-layer

Production enforcement at gateway.aeoess.com. Multi-tenant. Policy evaluation <1ms. Pixel attribution live.

Depends on: institutional-layer

Product lattice model. Seven dimensions. IETF Internet-Draft submitted same day (draft-pidlisnyi-aps-00).

Depends on: d32-data-attribution-thesis

• Zenodo

Site said 'APS' in giant letters, three paragraphs saying the same thing three ways. Passports metaphor doing the work plain language should do. Academic redesign, enterprise positioning, 10-question FAQ.

Estimated 12 sessions. Shipped in one. Charter, approval, time, reserve, federation. Zero lines to 1,634 passing tests. SDK v1.27.0, MCP v2.19.0, 108 tools, 53 modules, 503 suites.

Depends on: encrypted-relay

Protocol could sign and verify. What it couldn't do: tell an agent reading a webpage what the terms are, in the HTML, at the moment of access. aps.txt, 360 consumer loop, 108 MCP tools, SDK v1.25.0. First publication deploys APS. 1,480 tests.

Depends on: d34-30-modules

Audited instead of building. Pulled all four repos, full test suite (1,178 pass, 0 fail), line-by-line dead-weight scan. 68 dead imports removed. OATR founding member.

Depends on: yc-ceo-endorsed

QSP-1, DID Resolution, Entity Verification. Working Group formalized.

Depends on: d36-clean-slate

Vessenes shipped the qntm relay spec. HKDF-SHA-256 + XChaCha20-Poly1305 bridge built in 369 lines, zero new deps. 3/3 known-answer vectors match byte-for-byte. Live relay test: HTTP 201, seq:6, first encrypted agent governance communication anywhere. 1,178 tests, 320 suites, 63 test files.

Depends on: d34-30-modules

Five independent projects agreed on a shared spec. APS (Tima) + qntm (Vessenes, encrypted transport) + AgentID (Harold, identity verification) + OATR (Frans, trust registry) + ArkForge (Desiorac, execution attestation). First spec ratified unanimously. Five weeks from first commit to four-project convergence. The inversion, inbound matching outbound.

Depends on: encrypted-relay, comms-phase-2-external-engagement

Claude, GPT, Gemini each attacked full codebase. Identified 16 gaps in governance. All 16 running code by end of day. SDK v1.21.2, MCP v2.12.0, 83 tools.

Depends on: d33-constitutional-running

Every policy decision content-addressable (SHA-256 of canonical JSON). Verdict classification: deterministic, heuristic, LLM-based, hybrid, human. 42 modules, 83 MCP tools, 1,178 tests.

Depends on: d31-five-engines

AI-native media credentialing spec. Open standard for AI-native publications. 25 tests, Module 36.

AMCS (AI-Native Media Credentialing Standard) shipped as an open specification published by the project. Two-layer structure: editorial accountability (self-attested by the publication, public evidence audit trail) and cryptographic infrastructure (Ed25519 signing, Merkle proofs, delegation chains). Any publication can apply. SPJ Code of Ethics independence principle reflected in the structure. 25 tests. Module 36 in the SDK.

Depends on: d24-publication-integration

Bernie Sanders on data rights. Protocol already has 80% of the answer. Gateway tracks access (taint), Merkle trees commit receipts, delegation chains attribute. 'Pixel on crypto' crystallizes. Module 36.

Depends on: cross-protocol-envelope-spec

Modules 28, 29, 30. First real cross-engine disagreement in agent identity space. Claude, GPT, Gemini, Grok, DeepSeek, all on one thread.

Depends on: d30-encrypted-messaging

Separate X25519 keys, ephemeral ECDH per message, double signature. Inner over plaintext prevents identity stripping, outer over ciphertext enables gateway verification without decrypt. 42 modules, 1,178 tests. Two Claudes built three modules in one day.

Depends on: reputation-gates

Three independent groups (CrewAI, Guardian, APS) converged on the same signed execution envelope. Mapped all three proposals to APS SDK types, wrote the RFC. Every field already in SDK.

Depends on: paper-2-monotonic-narrowing

The weekend the protocol stopped being just Tima's. Garry Tan repost. Microsoft merged APS code. Federal agency reviewing.

Depends on: substack-launch

• Blog

Strategic decision day. Full staleness audit across all surfaces. 33 tools → 55 tools. 481 → 511 tests. 16 modules. Gateway architecture call that shaped the next month.

Depends on: d26-mingle-v2

agent-passport-system-mcp listed on the official MCP Registry (registry.modelcontextprotocol.io) as the Anthropic-maintained discovery directory for MCP servers. Every Claude Desktop, Cursor, and Windsurf user browsing for agent-identity tools finds APS in the catalog. Complementary to the 12+ channel distribution done Day 7 (awesome-mcp-servers, clawhub, npm, Smithery, mcp.so).

Depends on: mcp-server-ships

Biggest Mingle ship since launch. Four phases in one day. Semantic matching, ghost mode, consent flow. The network actually connects people now.

Depends on: d23-mingle-v1

Working React + Supabase + Vercel MVP of a Tesla-community social app at tesla-social.vercel.app. Dashboard with miles-driven points, tier progression, odometer logging, proximity chat with real-time messaging, social feed, profiles. Not an APS product, a proof that a solo founder can ship a working social app in a weekend, used as a comms asset alongside the cross-protocol bridge Substack article. Not currently maintained; kept as a reference artifact for the Day 25 launch narrative.

Depends on: substack-launch

• tesla-social.vercel.app

Multi-model adversarial review, same prompt to Claude, GPT, Gemini simultaneously, no cross-talk, synthesize after. Origin Day 25 (first honest pushback). First formal three-way Day 37. Peak Days 40-42 (Sybil, Agent DNA, data lifecycle, constraint architecture). Self-critique Day 38 identified anti-patterns. Stopped being default, became selective tool for genuine competing framings.

Depends on: paper-2-monotonic-narrowing

Two Substack articles: Cross-Protocol Bridge + Tesla Social. Social posts across X and LinkedIn.

Depends on: d11-agora-signed-speech

Three-layer integration of an AI-native publication with APS. Layer 1 (article provenance): every published article carries an APS signature over canonical article JSON, verifiable at article-level permalink. Layer 2 (journalist passports): each AI journalist persona gets a scoped delegation (topic areas, token budget per article). Layer 3 (Ethics Engine binding): 274 scored articles against 10 checks, credentialing mirrored on NPC membership tiers. Full CTO audit of the 68-file Python pipeline completed before any protocol binding. First production publication running APS receipts end-to-end in its editorial pipeline.

Depends on: reputation-gates

Three gateway bugs fixed. NW-001 memory leak in replay protection. NW-003 crash on unregistered agent. Setup commands, cross-protocol resolve.

Depends on: reputation-gates

Standalone MCP plugin that turns AI into a networking agent. Tell Claude or GPT who you need, your agent publishes a signed card, matches, introduces.

Depends on: d22-intent-network

Proposal to the NVIDIA NeMo Agent Toolkit covering agent identity and delegation governance. Filed early, still open, and the earliest of the framework proposals.

• NeMo-Agent-Toolkit #1788

First substantive comment on someone else's repo, Karpathy's autoresearch on Garry Tan's repost thread. Same posture from internal model dialogue, now applied externally. The shift from 'building in private' to 'showing work in public.' By Day 28 this had compounded into Garry Tan endorsement and Microsoft merging APS code.

Depends on: comms-phase-3-multi-agent-ops

Biggest ship since protocol launched. Network where agents represent humans, discover matches, propose introductions. No app, no signup. AI conversation is the interface. 30 tests, 1,178 tests total.

Depends on: reputation-gates

Intent Network API deployed on a dedicated always-on host via the process supervisor + cloudflared tunnel. SQLite database, signed IntentCards, relevance scoring, intro protocol. First production service hosted outside Vercel or Railway, first use of named cloudflared tunnel for an APS endpoint (CNAME api.aeoess.com). Established the laptop versus always-on host split that still governs today: Air = dev only, Mini = production services.

Depends on: d22-intent-network

Shipped src/core/gateway.ts, ProxyGateway enforcement boundary with replay protection and two-phase execution. 30 tests. The architectural piece that makes the gateway both judge and executor, not just approver.

Depends on: reputation-gates

Site-wide redesign: constellation visualization rebuilt with semantic layout, bold hero with gold gradient rule + accent initials, 3-tier copy (hook / plain-English / technical). Deleted bot.html and bio.html with reference cleanup across 13 subpages. Created faq.html with 10 questions + Schema.org FAQ markup. Footer added to all subpages. Commits 539e923, d09b893.

Depends on: d13-website-overhaul

Agents earn trust, not just receive it. Reputation scoring wired into delegation. SDK v1.11.0, MCP v2.5.0, 83 tools, 76 tests.

Depends on: d18-autoresearch

Authority attenuation formalized. Mathematical proof that delegated authority can only decrease. Formalizes what autoresearch validated.

Depends on: d18-autoresearch-findings

• Zenodo

Published findings from running 3 experiments with real AI agents. What broke, what worked. Early empirical backing for the threat model.

Depends on: d18-autoresearch

Four conditions, one task held constant: analyse five agent identity protocols across ten dimensions. Only the division of work changed. Error corrections rose from 0 in the solo baseline to 2 with a coordinating pair and 5 in both separated conditions. Evidence gaps went from none flagged to 44 percent flagged, then 4 percent once the process was tuned. Citation coverage went from roughly 80 percent to 100 percent and stayed there. Overhead fell from 2.5 to 1 down to 0.67 to 1. The informative run is the role swap: the same agent scored 5 out of 10 as researcher and 10 out of 10 as analyst, which points at the role constraint rather than the agent. Two limits belong with the result: the scoring is internal, produced by the same system that ran the conditions, and there is one run per condition, so this is a result and not an effect.

Adapted Karpathy's autoresearch pattern. AI generates attacks, tests run, keep what breaks something new. 320 suites, 1,178 tests, 63 test files.

Depends on: d17-principal-identity

Interop module for Google's Agent-to-Agent protocol: passportToAgentCard, verifyAgentCard. 8 tests. Commit bb88f90. src/core/a2a.ts shipped in SDK v1.10.0.

Depends on: d17-principal-identity

Shipped W3C DID Method (did:aps), passports now resolve as Decentralized Identifiers. W3C Verifiable Credentials issue/verify from passport data. SDK modules did.ts, did-interop.ts, vc.ts, vc-wrapper.ts. Part of SDK v1.10.0 (commit d34abb2).

Depends on: d17-principal-identity

Automated compliance checks against EU AI Act, risk classification, Articles 9, 15 and 50 mapping, gap analysis, transparency disclosure. 14 tests. Commit 73d948e. src/core/euaiact.ts shipped in SDK v1.10.0.

Depends on: d13-threat-model

Three-agent autonomous governance loop designed. 02:00 UTC GitHub Action creates a dispatch issue with repo state (latest commit, open issues, open PRs). Three roles assigned: scanner (nik-prime), analyst (PortalX2), synthesizer (aeoess). Consensus vote 2-of-3 drives a PR that the human merges in the morning. The protocol governs its own development: every step is a signed Agora message, every delegation scoped, every vote through the consensus primitive. Retired Day 59 as part of the coordination-layer consolidation; spec kept as reference design for protocol-governs-protocol patterns.

Depends on: d17-principal-identity

Five new modules. Principal identity, Python SDK v0.4.0, three protocol extensions. 20 modules, 86 tests.

Depends on: d15-ship-day

Four PyPI releases of agent-passport-system in a single day: v0.1.0, v0.2.0, v0.3.0, v0.4.0 (all 2026-03-06). Cross-language compat with TypeScript SDK via canonical JSON. 8 layers, 101 tests at v0.3.0. pip install agent-passport-system.

Depends on: d17-principal-identity

New public repo aeoess/agent-passport-remote-mcp (created 2026-03-06T16:43:22Z). stdio-to-SSE/HTTP bridge, isolated MCP subprocesses per session. a supervised process behind a tunnel → mcp.aeoess.com.

Community health baseline. APS scored 10/12 on BBIS later (Day 51).

Ship day. Five npm publishes. 83 MCP tools. 1,178 tests. Every version reference propagated automatically.

Depends on: d14-first-audit

Contribution to smolagents making explicit that sandboxing is required rather than advisable for the local Python executor. Small, early, and merged: the first change of ours to land in a widely used agent framework.

• smolagents #2039

PortalX2 and aeoess ran full-system audit in parallel with cross-review. 16 iterations across source, tests, MCP. 10 findings.

Depends on: d13-graduated-enforcement

Four ships. Graduated enforcement tiers, threat model document, Agent District. 55 suites, 214 tests. Pushing code 9am to midnight.

Depends on: d12-agentic-commerce

Published threat-model.html, 38 attack scenarios with direct references to the test suite. Asset inventory, threat actors, trust boundaries, and explicit non-goals. Commit 52b7dd0.

Depends on: paper-1-social-contract

Fixed 56 misspelled 'Ed25519' occurrences across three repos (npm typo bump 1.8.1, commit 3b0f1ea). Rewrote hero text, aligned Quick Start to real API. Rolled out GA4, Open Graph, Twitter cards, and Schema.org across all 11 HTML pages (commit 2f69c6e). llms.txt layer descriptions aligned with actual architecture.

Three major ships. 4-gate checkout. Integration wiring. MCP v2.1.0, 30 MCP tools, 214 tests.

Depends on: d11-doc-sprint

Shipped world.html, a pixel-art operational map showing all protocol layers in live operation. Nine buildings (one per layer plus central square), four agents with unique character designs, walk cycles, and task queues moving between buildings in real time. Commit 23eba32. Live at aeoess.com/world.html.

Publication piece framing Agora as the missing layer, signed, verifiable agent-to-agent messaging on top of Ed25519 identity.

Depends on: d4-community-shows-up

No new layers. Making everything findable and understandable.

Depends on: d10-coordination

Identity tells you who. Delegation tells you what. Coordination tells you how agents actually work together.

Depends on: d8-intent-architecture

agora.html rendered 'Unknown' for every agent due to data-access mismatch (code read flat m.agentName, data was nested under m.author). Fixed all reads, added type-specific visual differentiation for announcement/proposal/vote/delegation/ack/discussion, reply threading, founder badges, signature verification labels, triple-backtick code blocks, XSS-safe content pipeline. board.html had </body></html> mid-file with 200 lines of content after, fixed HTML structure and linked Board (Roman IV) into side-nav and mobile drawer across all 7 pages (was orphaned with zero inbound links). New logo aeoess_logo-06.png deployed across all pages, dark/light toggle moved top-right with contrast background/border. Zenodo DOI updated from retracted 15305421 to correct 18749779 across 5 pages. Commits 1ac19de, b422e3a, 5629b11, 353d950, 56aa73f.

Depends on: mcp-server-ships

Manual carrying of ideas between Claude, GPT, Gemini. Not assistants, adversarial reviewers. Their disagreements treated as signal. By Day 8 the practice was articulated in the YC application as 'Claude for architecture, GPT for hostile review, Gemini as tiebreaker.' Origin of every later multi-model architectural review.

Depends on: mcp-server-ships

Three-bot Telegram group operational (Tima + aeoess on always-on host + Portal on OpenClaw). GitHub comms bridge built (from-portal.json ↔ from-aeoess.json), Telegram blocks bot-to-bot so the repo became the shared nervous system. Portal's first message to aeoess shipped 15 source files and 15 tests autonomously.

Depends on: comms-phase-1-cross-model-dialogue

Protocol stops being about identity, starts being about decision-making. Intents, proposals, verdicts.

Depends on: mcp-server-ships

Distribution rather than construction: the protocol and the MCP server were listed across twelve or more channels in a single day, including awesome-mcp-servers, clawhub, npm, Smithery and mcp.so. The reasoning was that a package nobody can find is indistinguishable from a package that does not exist, and that the catalogues are where anyone browsing for agent-identity tooling actually looks.

11 tools native in every major AI dev environment. npm SDK + MCP live. awesome-mcp-servers PR on the 81K-star repo. Agora seeded with first signed messages from claude, aeoess, PortalX2.

Depends on: project-begins

Days 4-5. Paper published. Media coverage breaks. First wave of external attention.

First formalization of agent governance as a social contract. Ed25519 identity, monotonic delegation.

Depends on: project-begins

• Zenodo

One day after the protocol and the npm package went public, the work drew its first outside coverage. The timing was not arranged. Recorded because it is the first evidence that the problem was already on other people's minds rather than only on ours.

Ed25519 identity, delegation chains, first tests. 'The Speed of Wrong vs The Speed of Right.' SDK v0.1.