agent-passport-system 4.1.0 → 4.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -34
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,8 +1,12 @@
|
|
|
1
|
-
|
|
1
|
+
<p align="center">
|
|
2
|
+
<img src="docs/assets/banner-hero.png" alt="Agent Passport System banner. Governance infrastructure for the agent economy. Cryptographic identity, signed action receipts, beneficiary attribution." width="100%">
|
|
3
|
+
</p>
|
|
4
|
+
|
|
5
|
+
APS lets a person or company give an AI agent limited authority to act on its behalf, and produces verifiable proof of what the agent does with it. Open protocol, Apache 2.0.
|
|
2
6
|
|
|
3
7
|
[](https://www.npmjs.com/package/agent-passport-system)
|
|
4
8
|
[](https://github.com/aeoess/agent-passport-system/blob/main/LICENSE)
|
|
5
|
-
[](https://github.com/aeoess/agent-passport-system)
|
|
6
10
|
[](https://doi.org/10.5281/zenodo.18749779)
|
|
7
11
|
[](https://www.bestpractices.dev/projects/13536)
|
|
8
12
|
[](https://www.bestpractices.dev/projects/13536)
|
|
@@ -10,24 +14,24 @@
|
|
|
10
14
|
[](https://github.com/aeoess/agent-passport-system/blob/main/CONTRIBUTING.md#running-tests)
|
|
11
15
|
[](https://scorecard.dev/viewer/?uri=github.com/aeoess/agent-passport-system)
|
|
12
16
|
[](https://github.com/aeoess/aps-conformance-suite)
|
|
17
|
+
[](https://openchainproject.org/community-of-conformance)
|
|
18
|
+
[](https://openchainproject.org/community-of-conformance)
|
|
13
19
|
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
> **For AI agents:** visit [agent-passport.org/llms.txt](https://agent-passport.org/llms.txt) for machine-readable docs.
|
|
17
|
-
|
|
18
|
-
> **Valid signature. Hijacked intent. Denied by APS.**
|
|
20
|
+
It answers four practical questions about any agent action:
|
|
19
21
|
|
|
20
|
-
|
|
22
|
+
- Who is this agent?
|
|
23
|
+
- Who authorized it?
|
|
24
|
+
- What is it allowed to do?
|
|
25
|
+
- What evidence exists after it acts, or after it is denied?
|
|
21
26
|
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
The narrowing invariant:
|
|
27
|
+
Authority can pass from one agent to the next, but it can only get narrower. Scope, spending limits, expiration, and approved services are checked before an action runs, at a gateway that is both judge and executor: a request outside the granted authority is denied before it executes. Every decision, allowed or denied, produces a signed receipt, so anyone can later verify what was requested, what authority was presented, which policy applied, and what APS decided.
|
|
25
28
|
|
|
26
29
|
```mermaid
|
|
27
30
|
flowchart LR
|
|
28
|
-
P["
|
|
29
|
-
A -->|"
|
|
30
|
-
B
|
|
31
|
+
P["Person or company"] -->|"payments up to $500"| A["Agent A"]
|
|
32
|
+
A -->|"refunds up to $100"| B["Agent B"]
|
|
33
|
+
B -->|"$200 refund request"| G{"APS gateway"}
|
|
34
|
+
G -->|"outside delegated authority"| X["denied + signed receipt"]
|
|
31
35
|
```
|
|
32
36
|
|
|
33
37
|
```bash
|
|
@@ -36,6 +40,8 @@ npm install agent-passport-system
|
|
|
36
40
|
|
|
37
41
|
Also implemented in [Python](https://pypi.org/project/agent-passport-system/) and [Go](https://pkg.go.dev/github.com/aeoess/agent-passport-go), byte-parity-checked against this TypeScript reference.
|
|
38
42
|
|
|
43
|
+
Verify any receipt or evidence bundle in your browser at [agent-passport.org/verify.html](https://agent-passport.org/verify.html) (runs locally, nothing is uploaded). Machine-readable docs for agents are at [agent-passport.org/llms.txt](https://agent-passport.org/llms.txt).
|
|
44
|
+
|
|
39
45
|
## Quick Start
|
|
40
46
|
|
|
41
47
|
Lead with the curated essentials. `agent-passport-system/core` exposes the 24 functions that 90% of integrations need: identity, delegation, enforcement, commerce, reputation, key management. The full `agent-passport-system` root import is unchanged and backward compatible: pull from it when Core does not cover your case.
|
|
@@ -45,11 +51,24 @@ import {
|
|
|
45
51
|
createPassport, createDelegation,
|
|
46
52
|
evaluateIntent, commercePreflight, generateKeyPair
|
|
47
53
|
} from 'agent-passport-system/core'
|
|
48
|
-
|
|
49
|
-
// Full 925-export API still available. Use when Core does not cover your case.
|
|
50
|
-
// import { ... } from 'agent-passport-system'
|
|
51
54
|
```
|
|
52
55
|
|
|
56
|
+
## Core Protocol
|
|
57
|
+
|
|
58
|
+
*Status: Canonical.*
|
|
59
|
+
|
|
60
|
+
What ships in every deployment.
|
|
61
|
+
|
|
62
|
+
**Identity** -- Ed25519 passports, passport grades 0-3, key rotation, did:aps identifiers. Bring your own identity too: APS accepts did:key, did:web, SPIFFE SVIDs, and OAuth tokens alongside native did:aps.
|
|
63
|
+
|
|
64
|
+
**Delegation** -- Scoped authority with monotonic narrowing. Sub-delegation can only reduce scope. Cascade revocation propagates through the full chain. `subDelegateAdvisor` implements the bounded-escalation delegation pattern used in multi-model agent workflows where a lower-cost executor escalates to a higher-capability advisor at decision points -- the advisor delegation is count-bounded, cannot execute tools, and cascade-revokes with its parent.
|
|
65
|
+
|
|
66
|
+
**Enforcement** -- 3-signature action chain: agent signs intent, policy engine signs evaluation, agent signs execution receipt. The agent cannot skip the check. Gateway evaluation runs under 2ms.
|
|
67
|
+
|
|
68
|
+
**Commerce** -- 5-gate preflight: valid passport, scope check, spend limit, merchant allowlist, idempotency. Human approval thresholds for high-value transactions.
|
|
69
|
+
|
|
70
|
+
**Reputation** -- Bayesian trust scoring across 5 tiers. Authority is earned per-scope, not global. Passport grades compound with behavioral history.
|
|
71
|
+
|
|
53
72
|
## Status labels
|
|
54
73
|
|
|
55
74
|
Every primitive in this README carries one of three labels so you know how much weight it can bear today.
|
|
@@ -68,22 +87,6 @@ flowchart LR
|
|
|
68
87
|
GW --> RC[("Signed receipt<br/>every outcome, both verdicts")]
|
|
69
88
|
```
|
|
70
89
|
|
|
71
|
-
## Core Protocol
|
|
72
|
-
|
|
73
|
-
*Status: Canonical.*
|
|
74
|
-
|
|
75
|
-
What ships in every deployment.
|
|
76
|
-
|
|
77
|
-
**Identity** -- Ed25519 passports, passport grades 0-3, key rotation, did:aps identifiers.
|
|
78
|
-
|
|
79
|
-
**Delegation** -- Scoped authority with monotonic narrowing. Sub-delegation can only reduce scope. Cascade revocation propagates through the full chain. `subDelegateAdvisor` implements the bounded-escalation delegation pattern used in multi-model agent workflows where a lower-cost executor escalates to a higher-capability advisor at decision points -- the advisor delegation is count-bounded, cannot execute tools, and cascade-revokes with its parent.
|
|
80
|
-
|
|
81
|
-
**Enforcement** -- 3-signature action chain: agent signs intent, policy engine signs evaluation, agent signs execution receipt. The agent cannot skip the check.
|
|
82
|
-
|
|
83
|
-
**Commerce** -- 5-gate preflight: valid passport, scope check, spend limit, merchant allowlist, idempotency. Human approval thresholds for high-value transactions.
|
|
84
|
-
|
|
85
|
-
**Reputation** -- Bayesian trust scoring across 5 tiers. Authority is earned per-scope, not global. Passport grades compound with behavioral history.
|
|
86
|
-
|
|
87
90
|
## Receipt graph
|
|
88
91
|
|
|
89
92
|
APS receipts are graph-composable. Each claim links to the authority, policy, action, observation, or evidence it depends on, so a verifier can walk from any receipt back to its supporting facts and stop at the boundary it cares about. This is documentation of existing structure, not a new primitive. The linkage already lives in the existing receipt envelopes (`delegation_chain_root`, `policy_ref`, `action_ref`, `evidence_id`, `bound_to`); the graph view is just how those edges compose.
|
|
@@ -246,7 +249,7 @@ The composition contract specifies how a verifier MUST cross-check per-request s
|
|
|
246
249
|
|
|
247
250
|
## Numbers
|
|
248
251
|
|
|
249
|
-
4,
|
|
252
|
+
4,326 tests. 8 protocol layers. Framework adapters for CrewAI, LangChain, ADK, A2A, MCP, OpenShell, IBAC, Gonka. Gateway evaluation under 2ms. Zero heavy dependencies. Apache-2.0.
|
|
250
253
|
|
|
251
254
|
The test count is one number derived from the suite, not three guesses. The badge above, this section, and the `package.json` description all carry the same `4,026`, which is the `tests` total reported by `npm test`. When the suite grows, re-run `npm test`, read the `tests` line, and update all three to match.
|
|
252
255
|
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agent-passport-system",
|
|
3
|
-
"version": "4.1.
|
|
4
|
-
"description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,
|
|
3
|
+
"version": "4.1.1",
|
|
4
|
+
"description": "Enforcement and accountability layer for AI agents. Bring your own identity (did:key, did:web, SPIFFE, OAuth, did:aps). Verifier hot path p50 = 420ns bare-metal Linux EPYC 7313P (§13.1 canonical environment per spec), 347ns AWS c7i.2xlarge, 292ns Mac M3. Gateway enforcement, monotonic narrowing, cascade revocation, Bayesian reputation, wallet binding, unified four-axis attribution primitive, per-period attribution settlement, data lifecycle, mutual authentication, Wave 1 accountability primitives (action, authority-boundary, custody, contestability, bundle), evidentiary type safety (claim/evidence registry, claim verifier with forbidden-substitution detection, contestation cascade). 4,326 tests.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/src/index.js",
|
|
7
7
|
"types": "dist/src/index.d.ts",
|