{"spec":"CTEF (Composable Trust Evidence Format)","spec_version":"0.3.1","spec_anchor":"https://agentgraph.co/.well-known/cte-test-vectors.json","wg_proposal":"https://github.com/a2aproject/A2A/issues/1786","as_of":"2026-10-02","publisher":{"name":"AgentAvow","formerly":"AgentGraph","site":"https://agentavow.com","repo":"https://github.com/AgentAvow/AgentAvow","canonical_url":"https://agentavow.com/.well-known/interop-harness.json","also_served_at":"https://agentgraph.co/.well-known/interop-harness.json","note":"Rebranded AgentGraph -> AgentAvow in 2026-09. Machine identifiers are unchanged by design: did:web:agentgraph.co, the JWKS host, the signing kid, and every agentgraph-co/agentgraph@<sha> pin below (the old GitHub path redirects to AgentAvow/AgentAvow). Entry names and field names are kept as consumers pinned them."},"evidence_taxonomy":{"substrate":"JCS canonicalizer byte-match across independent implementations on signed fixtures. Multi-source-proven as of 2026-05-01 via 8 independent canonicalizers + 2 publicly-runnable verification scripts (Nobulex verify-aps-byte-match.mjs + verify-ctef-byte-match.mjs).","verifier_conformance":"claim_type discrimination, composition contracts, negative-path semantics. Per-implementation work that lands per role-taxonomy slot. Citation-graph framing from msaleme (A2A #1786, 2026-04-30) — substrate and verifier conformance are separable evidence categories.","reproducibility":"Anyone-can-clone reproducibility added 2026-04-30 via Nobulex scripts that pull APS + CTEF fixtures from their canonical sources, run through @nobulex/crypto, compare SHA-256 against expected hashes, and emit verification receipts. Lifts the substrate-evidence claim from 'stated and validated' to 'reader-runnable.' On 2026-05-01, APS independently re-ran both scripts and posted PASS receipts (10/10 + 4/4 incl negative-path) mirrored at aeoess/aps-conformance-suite/cross-impl-receipts/ — substrate evidence now lives in two independent repos with no maintainer re-run dependency."},"role_taxonomy":{"evidence_provider":"Issues claim_type-tagged attestations against the CTEF envelope; produces JCS-canonicalized signed evidence; appears as the upstream signer in a verifier's trust chain.","enforcement_gateway":"Evaluation-only: receives evidence bundles, evaluates against policy, returns JWS-signed verdicts (certified true/false + attestation). No evidence emission, no canonicalization dependency. Verifies existing proofs and issues policy decisions only — does not re-sign or re-canonicalize. Sits downstream of evidence providers. Per arkforge framing, A2A #1734 comment 2026-04-30.","substrate_verifier":"Independent canonicalizer + fixture-validation runner with no implementation overlap with the providers it verifies. Reproduces SHA-256s without issuing or evaluating evidence. Closes the 'everyone running the same canonicalizer library' objection for sponsorship review weighting."},"implementations":[{"name":"AgentGraph","maintainer":"@kenneives","language":"Python","role":"evidence_provider","bilateral_delegation_byte_match":"10/10","rotation_attestation_byte_match":"5/5 (live-fetch)","claim_type_live":true,"claim_type_endpoint":"https://agentgraph.co/.well-known/cte-test-vectors.json","test_files":["tests/test_jcs_canonicalize_aps_interop.py","tests/test_aps_rotation_attestation_interop.py","tests/test_cte_test_vectors.py"]},{"name":"Agent Passport System (APS)","maintainer":"@aeoess","language":"Python","role":"evidence_provider","bilateral_delegation_byte_match":"publishes the fixture set","rotation_attestation_byte_match":"publishes the fixture set","claim_type_live":true,"fixture_repo":"https://github.com/aeoess/agent-passport-system"},{"name":"AgentID","maintainer":"@haroldmalikfrimpong-ops","language":"Python","role":"evidence_provider","bilateral_delegation_byte_match":"10/10 (32/32 tests)","rotation_attestation_byte_match":null,"claim_type_live":true,"claim_type_endpoint":"https://getagentid.dev/api/v1/agents/verify"},{"name":"@nobulex/crypto","maintainer":"@arian-gogani","language":"TypeScript","role":"evidence_provider","bilateral_delegation_byte_match":"10/10","ctef_inline_byte_match":"4/4 SHA-256-exact including both negative-path vectors (INVALID_CLAIM_SCOPE, INVALID_COMPOSITION) — A2A #1786 comment 2026-04-30","rotation_attestation_byte_match":"verifier testing in flight","claim_type_live":false,"package":"@nobulex/crypto (npm)","merged_into":"Microsoft Agent Governance Toolkit (microsoft/agent-governance-toolkit#1333, OpenSSF passing badge, 2026-04 week)","reproducibility_scripts":{"aps_bilateral_delegation":"https://github.com/arian-gogani/nobulex/blob/main/scripts/verify-aps-byte-match.mjs","ctef_v031_inline":"https://github.com/arian-gogani/nobulex/blob/main/scripts/verify-ctef-byte-match.mjs","receipt_artifacts":"aps-byte-match-receipt.json + ctef-byte-match-receipt.json in repo root","instructions":"Anyone can clone arian-gogani/nobulex and run `node scripts/verify-aps-byte-match.mjs` and `node scripts/verify-ctef-byte-match.mjs` to reproduce 10/10 APS + 4/4 CTEF byte-match without any AgentGraph or APS code path"},"aaif_filing":"aaif/project-proposals#20 (Nobulex, filed 2026-04-30) — Growth-stage proposal positioning Nobulex bilateral-receipt primitive as accountability infrastructure layered on the CTEF substrate; cites AgentGraph as harness maintainer + 8 byte-match implementations as cross-organization adoption proof"},{"name":"HiveTrust","maintainer":"@srotzin","language":"Python","role":"evidence_provider","inline_vector_byte_match":"4/4 byte-exact + SHA-256-exact (envelope, verdict, scope_violation, composition_failure) — A2A #1786 comment 2026-04-28","bilateral_delegation_byte_match":"alignment confirmed; APS bilateral-delegation + rotation-attestation runs queued","rotation_attestation_byte_match":"queued","claim_type_live":true,"verifier_url":"https://hive-gamification.onrender.com/v1/compliance/verify/{attestation_id}","ed25519_pubkey":"12de746d51fca019c5c64685f2688a0e4a57ab532f6f6c67d44494de43f4c408","schema_url":"https://hivemorph.onrender.com/openapi.json"},{"name":"ArkForge Trust Layer","maintainer":"@desiorac","language":"Python","role":"enforcement_gateway","inline_vector_byte_match":"4/4 byte-exact (canonical + SHA-256) — qntm#7 PR #14, 2026-04-30","constraint_evaluation_vectors":"3 scenarios delivered (within-limit delta=250, near-miss delta=5, exceeded delta=-150) — facet/limit/actual/delta shape from corpollc/qntm#6","claim_type_live":true,"did":"did:web:trust.arkforge.tech","verifier_url":"https://trust.arkforge.tech/v1/proxy","self_verification_script":"specs/test-vectors/verify_execution_attestation_arkforge.py"},{"name":"msaleme clean-room canonicalizer","maintainer":"@msaleme","language":"Python","role":"substrate_verifier","canonicalizer":"trailofbits/rfc8785.py v0.1.4","byte_match_aggregate":"19/19 byte-exact + SHA-256-exact across three fixture sources: AgentGraph CTEF v0.3.1 inline (4/4), APS bilateral-delegation (10/10), APS rotation-attestation (5/5) — A2A #1786 comment 2026-04-30","implementation_independence":"Zero implementation overlap with AgentGraph / APS / AgentID / Nobulex / HiveTrust — closes the 'everyone running the same canonicalizer library' objection","verifier_reference_artifact":"~150 lines of Python over rfc8785.py; offered as standalone WG-citation artifact","claim_type_live":false},{"name":"Foxbook","maintainer":"@cloakmaster","language":"TypeScript","role":"evidence_provider","claim_type_layer":"identity","canonicalizer":"canonicalize@2.1.0 (erdtman RFC 8785 reference impl)","inline_vector_byte_match":"4/4 SHA-256-exact against agentgraph-co/agentgraph@69ad94d — A2A #1672 comment 2026-04-30","claim_type_live":true,"did_method":"did:foxbook:{ULID}","transparency_log":"https://transparency.foxbook.dev","byte_match_report":"https://github.com/cloakmaster/foxbook/blob/9e392c5/ops/evidence/2026-04-30-ctef-v0.3.1-byte-match.md","wg_proposal":"A2A #1803"},{"name":"substrate-attestation","maintainer":"@andysalvo","language":"Python","role":"substrate_verifier","description":"Neutral verification-layer adapter; validates against the referenced CTEF / action_ref near-miss vectors for issuer binding, replay rescoping, and semantic drift cases.","repo":"https://github.com/andysalvo/substrate-attestation","license":"Apache-2.0","near_miss_corpus_pinned":"agentgraph-co/agentgraph@a07cdf8 (action-ref-near-miss-vectors.json)","ctef_anchor_pinned":"agentgraph.co/.well-known/cte-test-vectors.json","inline_vector_byte_match":"4/4 SHA-256-exact (envelope, verdict, scope_violation, composition_failure) vs rfc8785 Python v0.1.4 — receipt CVR-2026-013.json, confirmed 2026-06-01","claim_type_live":false,"added":"2026-06-01 per A2A #1734"},{"name":"Agent Community Verifiability Gate","maintainer":"@Liuyanfeng1234","language":"Python","role":"substrate_verifier","canonicalizer":"Python json.dumps(sort_keys=True, separators=(',', ':'), ensure_ascii=False) + integer-float normalization","byte_match_aggregate":"14/14 byte-match: CTEF v0.3.1 inline 4/4 + APS JCS canonicalization conformance 10/10 (8 RFC 8785 edge cases + bilateral-receipt and migration-attestation shape vectors) — A2A #1829, v4 of the receipt verified on a fresh clone 2026-05-15","receipt":"https://gist.github.com/Liuyanfeng1234/82da951b5b94a019468f4ccaf35164ad","reproduce":"fresh clone, `python3 verify.py`","claim_type_live":false,"section_3_8":"9th byte-match validated implementation","added":"2026-10-02 harness refresh; ratified on A2A #1829 2026-05-15"},{"name":"AlgoVoi","maintainer":"@chopmob-cloud","language":"Python","role":"substrate_verifier","canonicalizer":"trailofbits/rfc8785.py v0.1.4 via a shared jcs_canonical.py wrapper","byte_match_aggregate":"14/14 byte-match: CTEF v0.3.1 inline 4/4 + APS JCS canonicalization conformance 10/10 — A2A #1829, verified on a fresh clone 2026-05-16","receipt":"https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9","reproduce":"fresh clone, `pip install rfc8785 && python3 verify.py`","production_deployment":"did:web:api.algovoi.co.uk (W3C DID Document at the well-known URL) carrying A2AAgent + X402PaymentGateway service endpoints off one DID and one signing key","claim_type_live":false,"section_3_8":"10th byte-match validated implementation","added":"2026-10-02 harness refresh; ratified on A2A #1829 2026-05-16"}],"in_flight":[{"name":"Vorim AI","maintainer":"@kwame","language":"TypeScript","ietf_draft":"draft-vorim-vaip-00","status":"byte-match validation in flight as 6th implementation"},{"name":"Concordia","maintainer":"@erik-newton","language":"Python","status":"PR #10 to haroldmalikfrimpong-ops/agentid-aps-interop approved with 131/131 checks; Concordia v1.0.0 fixtures + verify.py repair"},{"name":"lawcontinue distributed-inference reference","maintainer":"@lawcontinue","status":"245-step sequence_bound case in coordination with APS for v0.3.2 §6.3.1 worked example"},{"name":"msaleme x402 conformance harness (claim_type module)","maintainer":"@msaleme","status":"substrate-layer byte-match completed and promoted to the implementations list (7th impl, substrate_verifier role, 19/19 across three fixture sources via trailofbits/rfc8785.py). Verifier-conformance work for claim_type-tagged compliance scoped against the experimental-ext repo once it opens for test-vector contributions; delivery window not yet scoped. A2A #1786 comment 2026-04-30"},{"name":"AEP (Agentic Exchange Protocol)","maintainer":"@Pineapples100","language":"spec draft","status":"T0–T3 trust tier model + /.well-known/aep-manifest.json for org-level trust boundaries on SMTP/iCal/messaging surfaces; tier-transition proofs would compose as authority-layer claims in CTEF envelope; https://github.com/pmyers-abundance/aep — A2A #1734 comment 2026-04-30"},{"name":"Dominion Observatory","maintainer":"@vdineshk","role":"evidence_provider","claim_type_layer":"behavioral","did":"did:web:dominion-observatory.sgdata.workers.dev","evidence_uri_pattern":"https://dominion-observatory.sgdata.workers.dev/v1/behavioral-evidence/{server-id}","fallback_uri_pattern":"https://dominion-observatory.sgdata.workers.dev/benchmark/{server-id}","tier_distribution_endpoint":"https://dominion-observatory.sgdata.workers.dev/api/sla-tier","production_scale":"Behaviorally monitoring 4,586 MCP servers since April 2026; live tier distribution per /api/sla-tier: 8 Platinum / 0 Gold / 3 Silver / 4 Bronze / 27 Unrated (rest insufficient_data)","evidence_pattern":"Path C — URI-reference, not fixture-embedding","rationale":"Behavioral evidence degrades on hours-to-days under the 7-day TTL cap; static fixtures are stale by definition. URI-reference preserves substrate-and-primitive separation: substrate (CTEF v0.3.2) defines envelope; primitive (Observatory) defines the live measurement. Symmetric to how identity + authority claim_types reference live DID resolvers rather than ship cached identity fixtures.","ttl_cap":"7 days (CTEF v0.3.2 §1.5 normative MUST)","tier_mapping":{"Platinum":{"trust_tier":"trusted","confidence_min":0.9},"Gold":{"trust_tier":"trusted","confidence_min":0.85},"Silver":{"trust_tier":"standard","confidence_min":0.7},"Bronze":{"trust_tier":"minimal","confidence_min":0.5},"Unrated":{"trust_tier":"restricted","note":"insufficient_data, NOT failing posture"}},"live_verification_examples":{"platinum":"/v1/behavioral-evidence/sg-cpf-calculator-mcp","silver_with_degradation":"identifiable via /api/trust-delta","unrated_insufficient_data":"served with explicit sample_count + observation_window_days","negative_path_malformed":"/benchmark/{nonexistent-server} returns documented 404 envelope"},"status":"Registered 2026-05-04 PM per A2A #1734 sequencing. URI-reference pattern locked for CTEF v0.3.2 §4.5; spec-text draft + litepaper §3.4 citation pending vdineshk review pre-publish."},{"name":"openclaw-skill-quality-analyzer (Miaoqu AI)","maintainer":"@jingchang0623-crypto / AIwalker","role_target":"evidence_provider","claim_type_layer":"behavioral","claim_subtype_target":"maintenance_health","repo":"https://github.com/jingchang0623-crypto/openclaw-skill-quality-analyzer","complementary_to":"AgentGraph security scanner — five-dimension scoring (security/docs/tests/maintenance/compatibility) complements security-only static analysis","operator_evidence":"90-day production deployment running 25 OpenClaw skills; concrete failure observations cited at agentgraph-co/agentgraph#17 (telemetry-leaking RSS skill, hardcoded API keys with shell=True SEO skill, fork/upstream permission confusion in GitHub automation skill)","maintenance_health_metric_proposal":"commit_recency + commit_frequency + change_magnitude + maintainer_continuity — proposed for adoption as v0.4 §6.x.y maintenance_health claim_subtype under behavioral layer","status":"Welcomed at agentgraph-co/agentgraph#17 2026-05-04 as Chinese-market operator-side voice + complementary evidence_provider; byte-match validation against CTEF v0.3.1 inline vectors invited"}],"negative_path_vectors":{"scope_violation":{"expected_error_code":"INVALID_CLAIM_SCOPE","purpose":"structural-before-semantic ordering — claim carrying fields outside its declared claim_type MUST be rejected before semantic evaluation"},"composition_failure":{"expected_error_code":"INVALID_COMPOSITION","purpose":"scope-narrowing-only invariant — child scope MUST NOT expand parent scope; composition failure is fail-closed"}},"summary":{"implementations_byte_match_validated":11,"implementations_inline_vector_byte_match_validated":8,"evidence_providers":6,"enforcement_gateways":1,"substrate_verifiers":4,"languages":2,"independent_canonicalizers":9,"section_3_8_set":{"count":10,"members":["AgentGraph (now AgentAvow)","APS","AgentID","@nobulex/crypto","HiveTrust","ArkForge","msaleme","Foxbook","Agent Community Verifiability Gate","AlgoVoi"],"source":"CTEF v0.3.2 §3.8 (docs/standards/v0.3.2-layering-figure.md, Draft 1.4, 2026-05-18)","note":"The §3.8 set and the implementations list above are not the same list: the list also carries substrate-attestation, added 2026-06-01 after the §3.8 set closed."},"wg_proposal_phase":"Proposal Phase, awaiting maintainer sponsorship","fail_closed_negative_paths":2,"reader_runnable_verifiers":2,"cross_repository_receipt_mirrors":2,"automated_mirror_sync":true},"cross_validation_receipts":{"receipt_sources":{"primary":{"repo":"https://github.com/arian-gogani/nobulex","role":"originating verifier","maintainer":"@arian-gogani","files":["aps-byte-match-receipt.json","ctef-byte-match-receipt.json"]},"mirror":{"repo":"https://github.com/aeoess/aps-conformance-suite/tree/main/cross-impl-receipts","role":"third-party mirror with byte-exact SHA-256 verification","maintainer":"@aeoess","sync":"Daily-poll GitHub Action at .github/workflows/sync-cross-impl-receipts.yml — schedule 00:00 UTC, workflow_dispatch wired for ad-hoc triggers","files_pinned_2026_05_02":{"aps-byte-match-receipt.json":"a4d63359574a7408cac8dd3c132586cff611535c4c8f074ed3556a61cf165443","ctef-byte-match-receipt.json":"2e8afc85080ed64fe539c913410f2343d10cba8c5b17f61cc8a7d19e4fa11216","ctef-vectors.json":"b655d1b3e7aeccb8b75517c1efc46d2dbf6759dea07581a1b39d4ab59baa7046","source_commit":"arian-gogani/nobulex@d68fcee","fetched_at":"2026-05-02T00:18:49Z"}}},"agentgraph_to_aps_via_nobulex":{"verifier_repo":"https://github.com/arian-gogani/nobulex","verifier_script":"scripts/verify-aps-byte-match.mjs","fixture_source":"https://github.com/aeoess/agent-passport-system/blob/main/fixtures/bilateral-delegation/canonicalize-fixture-v1.json","result":"10/10 PASS","third_party_rerun":"APS-side rerun 2026-05-01T16:59:33Z; receipt mirrored at aeoess/aps-conformance-suite/cross-impl-receipts/aps-byte-match-receipt.json","seed_sha256":"4f3d8defea1e82c1705c35d97ee4db046c6313ba83855a7d0de04a44f04c834a"},"ctef_v031_via_nobulex":{"verifier_repo":"https://github.com/arian-gogani/nobulex","verifier_script":"scripts/verify-ctef-byte-match.mjs","fixture_source":"https://agentgraph.co/.well-known/cte-test-vectors.json","fixture_version":"0.3.1","fixture_commit":"agentgraph-co/agentgraph@69ad94d","result":"4/4 PASS including both negative-path vectors (INVALID_CLAIM_SCOPE, INVALID_COMPOSITION)","independent_reproductions":[{"party":"Nobulex (origin)","date":"2026-04-30","result":"4/4 PASS"},{"party":"APS (aeoess)","date":"2026-05-01T17:03:08Z","result":"4/4 PASS","receipt_mirror":"aeoess/aps-conformance-suite/cross-impl-receipts/ctef-byte-match-receipt.json"},{"party":"Dominion Observatory (vdineshk)","date":"2026-05-05","result":"4/4 PASS","receipt_committed":"vdineshk/daee-engine: dominion-observatory/conformance-receipts/2026-05-05-ctef-v031-byte-match-receipt.json"}]},"canonical_bytes_diff_v032":{"fixture_source_pr":"https://github.com/corpollc/qntm/pull/15","fixture_path":"specs/test-vectors/canonical-bytes-diff-v032.json","verifier_script":"specs/test-vectors/verify_canonical_bytes_diff.py","result":"5/5 PASS (hash divergence + collision + canonical immunity)","independent_reproductions":[{"party":"AgentGraph","date":"2026-05-01","result":"5/5 PASS"},{"party":"APS (aeoess)","date":"2026-05-04","result":"5/5 + 5 cross-language byte-equality PASS (10/10)","receipt_mirror":"aeoess/aps-conformance-suite@e48ec05: fixtures/canonical-bytes/canonical-bytes-diff-v032.json (file-level sha256 84df9e0a634eba40f5388872bed4f028a240e0c2f2d646755ecbdfb6b8ee0e42 byte-matches qntm source) + runners/ts/canonical-bytes-qntm-v0.3.2.test.ts cross-language regression (TS JCS path produces output byte-identical to Python json.dumps(sort_keys=True, separators=(\",\", \":\")))"}],"cross_language_proof":"TS JCS canonicalizer + Python json.dumps with sort_keys=True + separators=(\",\", \":\") produce byte-identical output for the plain-string field shape this fixture uses. Pre-emptive guard against the same off-by-one termination class that hit ArkForge Merkle-chain in production."},"section_a_cross_validation_triangle":{"structure":"Three impls / one fixture / four verifier code paths","aps_README_anchor":"https://github.com/aeoess/aps-conformance-suite/blob/e48ec05/README.md","aps_test_state":"37/37 + 10/10 canonical-bytes (1 skip baseline) on main as of 2026-05-04","section_a_cite_strategy":"APS README §A-aligned section currently quotes comment-permalink as reference; flips to 'Mirrors CTEF v0.3.2 §A as published <date>, <section name>' once v0.3.2 ships mid-May"},"reciprocal_property":"@nobulex/crypto canonicalizeJson against APS-emitted fixture produces byte-identical SHA-256 to APS SDK canonicalizeJCS at every vector — substrate-layer interop is proven symmetric, not just one-directional.","aeoess_verifier_runs_2026_05_05":{"source":"aeoess re-ran both Nobulex verifier scripts from arian-gogani/nobulex/scripts/ on 2026-05-05; freshly-generated receipts posted in A2A #1786 thread comment dated 2026-05-05","aps_byte_match":{"verifier":"verify-aps-byte-match.mjs","spec":"JCS — RFC 8785","canonicalization":"APS SDK canonicalizeJCS (src/core/canonical-jcs.ts)","vectors":10,"result":"10/10 byte-match","receipt_sha256":"5e31d6cf37d6a4ee7459a631a289733308c50f01b1f85db4c15370406a3e6dda"},"ctef_byte_match":{"verifier":"verify-ctef-byte-match.mjs","version":"0.3.1","vectors":4,"result":"4/4 byte-match","receipt_sha256":"a14e6db4477989a1f5c0d60078b0efcc4dc9dd7e3cd1276c4480bdd95b52bcfb","negative_path_codes":["INVALID_CLAIM_SCOPE","INVALID_COMPOSITION"]},"discoverability":"Both verifier scripts linked from aeoess/aps-conformance-suite/fixtures/canonical-bytes/README.md per aeoess 2026-05-05 — future verifiers locate them at source"},"verifiability_property":"Reviewers can pull receipt artifacts from EITHER arian-gogani/nobulex (originating) OR aeoess/aps-conformance-suite (third-party mirror) OR vdineshk/daee-engine (third independent reproduction) and reproduce the byte-match independently. SHA-256 of each mirrored file is documented at the mirror surface with the source-commit pin. Closes the maintainer-rerun-dependency gap entirely. Three independent reproduction surfaces as of 2026-05-05 — the substrate evidence claim now stands without ANY single party in the trust path. aeoess's 2026-05-05 verifier-run receipts (recorded in aeoess_verifier_runs_2026_05_05 block above) demonstrate the property is exercisable on demand, not historical.","tool_manifest_digest_v0":{"boundary":"Tool-safety evidence consumed by a pre-execution gate, bound by the tool-definition digest (aeoess/agent-governance-vocabulary#177; edge E1 in #179)","fixture_source":"https://github.com/AgentAvow/AgentAvow/tree/4404df2c/docs/standards/tool-manifest-digest-vectors-v0","fixture_commit":"AgentAvow/AgentAvow@4404df2c","fixture_file":"tool-manifest-digest-v0-vectors.json","fixture_sha256":"2f4632b03305471b3262109dce7db2cf71d029fe6d9ec85fe54e9bf5c82bb9df","artifact":"One pinned AgentAvow scan attestation (compact JWS, EdDSA/Ed25519, RFC 8785 payload) for github:github/github-mcp-server, carrying scan.toolManifestDigest","gate_input":["subject_id","observed_manifest_digest","evaluation_time"],"axes":["signature_valid","canonical_bytes","subject_binds","digest_binds","fresh"],"cases":["digest-match","digest-mismatch","past-expiry","wrong-subject","tampered-payload"],"verifier_script":"verify.mjs (zero-dependency, Node 18+, nothing fetched)","result":"30/30 expected axis results; every negative fails exactly one axis (author-produced, AgentAvow)","consumer_runs":[{"party":"APS-side consumer (@aeoess)","date":"2026-09-30","pin":"aeoess/agent-passport-system@fd47f34 examples/interop/agentavow/","implementation":"agent-passport-system 7.2.0 primitives (canonicalizeJCS, strict Ed25519 verify); reads the vector file at 4404df2c unchanged","result":"30 of 30 expected axis results match; each negative fails exactly its own axis","label":"second implementation, run by the consuming project; a reproduction, not an independent verification record (the runner's own label)","boundaries_recorded":"tool-to-subject binding reported not_evaluated (the subject is a repo or server, not a named tool); toolManifestDigest kept separate from an APS metadata pin (false_analog)","source":"https://github.com/aeoess/agent-governance-vocabulary/issues/177#issuecomment-5914989949"}],"claim_ceiling":"rely=true establishes exactly this: at evaluation_time, the named issuer had signed a static-analysis grade for this subject over this tool-definition digest, and signature, subject, digest and window all check. It establishes nothing about runtime behavior, nothing about what the tool does when invoked, and nothing about definitions the scan did not observe."},"tool_manifest_digest_v1":{"boundary":"Extends v0: the attestation signs one digest per served tool, keyed by tool name, and the gate binds to the one tool it is authorizing (E1 'remaining' item on #179)","fixture_source":"https://github.com/AgentAvow/AgentAvow/tree/36426cf/docs/standards/tool-manifest-digest-vectors-v1","fixture_commit":"AgentAvow/AgentAvow@36426cf","fixture_file":"tool-manifest-digest-v1-vectors.json","fixture_sha256":"488496079155830caf83593be0cafcb21367f72cd70ea363c2400f40eda72647","artifact":"One pinned AgentAvow scan attestation for mcp:https://mcp.deepwiki.com/mcp (three tools) with scan.toolDigests keyed tool:<name>, plus the tools/list the server served in the same minute (observed_tools)","digest_profile":"agentavow.mcp-tool-definition.v1","gate_input":["subject_id","tool_name","observed_tool_digest","evaluation_time"],"axes":["signature_valid","canonical_bytes","subject_binds","tool_binds","tool_digest_binds","fresh"],"cases":["tool-match","unknown-tool","tool-drift","wrong-subject","past-expiry","tampered-payload"],"preimage_under_test":"the verifier recomputes all three per-tool digests from observed_tools; thirteen unsigned name-to-key pairs exercise the percent-encoding and length rules","verifier_script":"verify.mjs (zero-dependency, Node 18+, nothing fetched)","result":"3/3 per-tool digests + 13/13 key pairs + 42/42 expected axis results; every negative fails exactly one axis (author-produced, AgentAvow)","consumer_runs":[{"party":"APS-side consumer (@aeoess)","date":"2026-10-02","pin":"AgentAvow/AgentAvow@36426cf (earlier runs at 0727e5e9, c568e67, f8ccb60 as the key rules were tightened)","implementation":"agent-passport-system 7.2.0 canonicalizeJCS and Ed25519 verify plus node:crypto; no AgentAvow code imported; code not published as of 2026-10-02","result":"60/60: all 13 key pairs (including both cuts inside a %XX triplet), the three tool digests and the six cases match; four controlled mutations of the consumer each fail the run","label":"second implementation, run by the consuming project; not an independent record (the runner's own label)","source":"https://github.com/aeoess/agent-governance-vocabulary/issues/177#issuecomment-5944466430"},{"party":"Probity (@astrogilda)","date":"2026-10-02","pin":"probityai/agent-evidence-vectors#43 (merged 2026-10-02, head c5622736, merge d759fb4d), interop/agentavow-signed-map-v1/; producer pinned at AgentAvow/AgentAvow@36426cf","implementation":"map_reader.py, a separate signed-map reader; no AgentAvow source, signed packet or tool definitions vendored; the native verifier is never imported or executed","result":"all 13 name encodings, the three served-definition digests, the payload digest and all six case verdicts match (recorded-run.json)","label":"third-party implementation with no producer code; the runner authored the reader, so under the Agent Authority Conformance lab's CONTRIBUTING definition the record is author-produced, not independent","source":"https://github.com/probityai/agent-evidence-vectors/pull/43"},{"party":"heldfast (@rufat325)","date":"2026-10-02","pin":"rufat325/heldfast docs/TRANSPARENCY.md 'Comparing with another record' at 321d44a; src/heldfast/profiles.py at ca5a872; tests/test_profile_agentavow.py; vector file read from a local copy of AgentAvow main on 2026-10-02 (byte-identical to 36426cf)","implementation":"profile agentavow.mcp-tool-definition.v1 implemented from the published derivation; no AgentAvow file copied","result":"the conformance test reproduces the three signed per-tool digests and the thirteen key pairs (3/3 + 13/13); it is gated on AGENTAVOW_VECTORS_DIR, CI never runs it, and no verbatim run output is published. Covers digests and key encoding only, not signature or case verdicts","statement":"heldfast reproduces the published digests and key encoding for the pinned fixture as of 2 October 2026. It makes no claim about AgentAvow's grades.","label":"third-party implementation with no producer code; the runner authored the profile, so under the lab's CONTRIBUTING definition the record is author-produced, not independent","source":"https://github.com/rufat325/heldfast/blob/321d44aa8792ea48e23355a538c558d6be9130f4/docs/TRANSPARENCY.md#comparing-with-another-record"}],"claim_ceiling":"rely=true establishes exactly this: at evaluation_time, the named issuer had signed a static-analysis grade for this server, the grade covered a tool of this name, the definition the gate was served for that tool is the one the scan graded, and signature, subject and window all check. It establishes nothing about runtime behavior, nothing about what the tool does when invoked, nothing about other tools on the server, and nothing about definitions the scan did not observe.","boundaries":"The subject is a server, not a tool; the tool binding is the separate tool_binds axis. scan.toolManifestDigest is a fold over the per-tool digests, not a per-tool metadata pin, and the v1 gate does not use it."}}}