Agent Passport System — Cryptographic Identity for AI Agents

[ANY ROLE] Accept your task assignment. Confirms you're ready to work.

Activate a pre-authorized emergency pathway with evidence.

Add a signature to an approval request.

Add principal's perspective to an outcome record. Enables three-way divergence reporting.

Apply import policy downgrade to a foreign vouched reputation.

Aggregate a batch of Attribution Primitives over a half-open settlement period [t0, t1) into a signed SettlementRecord. Each axis (D, P, G, C) produces a per-contributor total with a balanced-Merkle commitment. Residual buckets pool sub-threshold contributors. Output is a fully signed record ready for third-party verification.

Representation boundary helper: compute the canonical sha256 id of an AttributionReceipt's unsigned core. Verifiers use this to detect id tampering.

Build a contributor-query response: given a signed SettlementRecord and a contributor DID, return per-axis (total_weight, contribution_count, merkle_path, axis_root) plus the full signed record so a third party can verify the contributor's share end-to-end without trusting the gateway beyond its public key. Returns null if the contributor has no share in the period.

v0.1 capability-token authority evaluation request (M2). Subject signs a request carrying the sink's M1, the delegation chain, and a revealed authority-token preimage. The gateway consumes this to decide permit/deny. Search keywords: capability token, authority evaluation, M2.

v0.1 capability-token sink challenge (M1). Sink issues a signed canonical action statement. Returns the SinkChallenge and its challenge_hash. Used to bind the gateway's later policy evaluation to a specific action the sink authored. Search keywords: capability token, sink challenge, M1.

v0.1 capability-token gateway receipt (M3). Gateway signs a permit or deny over the sink's exact challenge_hash. Echoes the M2 delegation_chain_root so the sink can verify the gateway saw the same chain the subject committed to. Search keywords: capability token, challenge receipt, gateway receipt, M3.

v0.1 capability-token sink effect receipt (M4). The sink verifies the gateway's M3, consumes the token preimage (rejecting a replayed nullifier), and signs an EffectReceipt binding the consumed token to the action result the caller supplies. This tool does not execute the action. The (M1, M3, M4) tuple is the full attestation record. Search keywords: capability token, effect receipt, M4, sink attestation.

Representation boundary: gate a binding artifact's citations. Each citation must resolve to a provided, signed, unexpired receipt whose content + principal match, with per-artifact replay protection, and each receipt must bind its parties to the keys beside them. What a valid result establishes: every citation is backed by a receipt the cited principal consented to. What it does not establish: authority to act on the artifact. Receipts whose parties are named by identifiers that do not self-certify stop passing this gate.

Escalation boundary: check whether an action on a v2 delegation requires owner confirmation before execution. Returns {required, requirement?, reason?}. Use aps_record_owner_confirmation to clear the flag when required.

Cross-projection consistency check: given two projections, confirm they originate from the same signed receipt. Returns {same_receipt: true} or {same_receipt: false, reason: 'DIFFERENT_ACTIONS'|'DIFFERENT_RECEIPTS'|'DIFFERENT_SIGNATURES'|'METADATA_MISMATCH'}.

Derive the action_ref (hex sha256) for an action tuple. action_ref is the content-addressed anchor that all four axis projections bind to. Useful for indexing primitives by action without constructing the full primitive.

Compute the C-axis fractional weight vector from a list of inference billing records (prompt_tokens, completion_tokens). Returns canonical ComputeAxisEntry[] with 6-digit decimal compute_share strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Weights = prompt_tokens + completion_tokens × COMPLETION_MULTIPLIER (default 3.0), then normalized. Parameter names match the SDK: `providers`, optional `profile`.

Compute the D-axis fractional weight vector from a list of AccessReceipt records with role, timestamp, and content length. Returns canonical DataAxisEntry[] with 6-digit decimal contribution_weight strings that sum to ~1.0 and feed directly into aps_construct_attribution_primitive. Empty input returns an empty array, and all-zero raw weights return an error. Weights = role × recency_decay × length_weight, then normalized. Parameter names match the SDK: `sources`, `action_timestamp`, optional `profile`.

Build and sign a four-axis AttributionPrimitive for an action. Axes: D (data sources), P (protocol modules), G (delegation chain), C (compute providers). Returns the complete signed object.

Representation boundary: build a citer-signed AttributionReceipt attributing a claim to a third-party principal. Each party is named by a self-certifying DID that commits to the key beside it, so a receipt naming a party by a bare public key or by a did:web style identifier will not verify. The receipt is not yet valid: the cited principal must sign consent via aps_sign_attribution_consent before checkArtifactCitations accepts it.

Commitment boundary: emit a provisional statement for agent-to-agent negotiation. Default is non-binding until a PromotionEvent satisfies a PromotionPolicy. Dead-man expiry auto-withdraws.

Extract a single-axis projection from an AttributionPrimitive. The projection carries the axis content plus a two-hop Merkle path that lets a downstream verifier reconstruct the signed root without seeing the other three axes. axis: 'D' | 'P' | 'G' | 'C'.

Commitment boundary: promote a provisional statement to binding by attaching a PromotionEvent that satisfies the PromotionPolicy (m-of-n principal signatures). dead_man_elapsed cannot promote, because the dead-man path auto-withdraws the statement.

Escalation boundary: owner signs an OwnerConfirmation authorizing a flagged action. Builds the ConfirmationRequest and signs it in a single call. The confirmation is bound to action_details via hash and scoped (per_action / per_session / time_window).

Representation boundary: the cited principal adds their consent signature to an AttributionReceipt. Without this signature, verifyAttributionConsent and checkArtifactCitations reject the receipt. The signature is checked against the key the receipt carries for that party, and that key must be the one the party DID commits to.

Representation boundary: verify an AttributionReceipt end-to-end (id, citer signature, consent signature, expiry) and bind each named party to the key beside it. What a valid result establishes: the receipt is intact, unexpired, and signed by the keys its party DIDs commit to. What it does not establish: that either party is authorized for your relying-party decision, or who they are outside the protocol. A party named by an identifier that does not self-certify is refused as unresolved rather than assumed. Returns {valid, reason?}.

End-to-end verify of a full AttributionPrimitive: constructs projections for all four axes and verifies each one. Useful as a post-construction sanity check or for verifying a primitive received from a peer.

Verify a single-axis AttributionProjection under the issuer's Ed25519 public key. Returns {valid: true} or {valid: false, reason: 'INVALID_AXIS_TAG'|'MERKLE_MISMATCH'|'SIGNATURE_INVALID'|'MALFORMED'}. Verification is purely local and needs no other axes.

Commitment boundary: verify that a promoted statement's PromotionEvent cryptographically satisfies the PromotionPolicy (policy_reference match, promoter in required_signers, threshold, signature, max_time_to_promote, author-signature tamper check).

Verify a signed SettlementRecord under S1-S5 (signature, Merkle roots, conservation, residual shape, optional input-receipts cross-check). S3 conservation is the strongest invariant: a gateway cannot inflate or suppress any contributor's share without breaking it. Returns {valid: true} or {valid: false, reason, detail}. Pass inputReceipts to also recompute input_receipts_hash.

Commitment boundary: author withdraws their own provisional statement. Already-promoted statements cannot be withdrawn. Caller must supply the author's signature over the withdrawal payload (canonicalize({action:'withdraw', statement_id})).

[OPERATOR] Assign an agent to a role in a task. Creates a delegation automatically.

Attest that your agent agrees to abide by the loaded Values Floor.

Send a signed message to all agents via comms/broadcast.json.

Check if a data access would violate aggregate rate limits.

Verify a root AuthorityDelegationV1 issued by this server's key, with the SDK chain verifier: shape, delegation_id, signature, time window and revocation status from this process's in-memory revocation store. Returns the verifier's state (valid, invalid, indeterminate or unsupported) and its failure codes, for example REVOKED or EXPIRED. A delegation this server did not issue, including one signed by this key under another issuer name, resolves no key and is not valid here. A delegation issued before a restart has revocation status unknown, because the store is in memory.

Check if combining data from two sources is permitted. Prevents prohibited inferences (HIPAA, COPPA, GDPR Art 9).

Check if a data transfer is permitted under jurisdiction constraints (EU_ONLY, GDPR_ADEQUATE_ONLY, NO_CROSS_BORDER).

Check messages addressed to you. Reads from comms/to-{your-agent-name}.json.

Check if a purpose is permitted under source terms. Supports wildcards (research:*) and hierarchical matching.

Check if data retention has expired based on TTL policy.

Check if an agent's earned tier permits an action at a given autonomy level and spend amount. Returns null if permitted, or escalation details if tier is insufficient.

Check if a specific usage type is permitted under a governance block's terms.

Classify attestation evidence quality (none / issuer_vouched / infrastructure / principal_bound) and return the corresponding grade (0-3).

[moved to gateway in SDK 3.3.0] The 6-gate commerce preflight orchestration moved out of the SDK and MCP into the AEOESS gateway. This tool no longer runs the pipeline locally. It returns a machine-readable deprecation notice pointing to the gateway commerce endpoint. Compose the pure gate predicates from the SDK yourself, or call the gateway.

Compare two hybrid timestamps to determine ordering.

[deprecated in v3.0.0, use the gateway.aeoess.com REST API] Complete a permitted action and get the full 3-signature proof chain.

[OPERATOR] Close the task unit with final status and retrospective. A later call replaces the stored completion record.

Compute content-addressed request identity (SHA-256 of agentId + actionType + scope + normalized timestamp). Two receipts with the same action_ref describe the same request.

Compute governance taint level for an artifact based on its derivation chain and revoked sources.