ajp-protocol 0.2.1 → 0.3.0

package/.github/workflows/publish.yml

@@ -44,4 +44,36 @@ jobs:
       # publish rights, configured as a trusted publisher on npmjs.com against
       # this repository and this workflow filename. Provenance attestations are
       # generated automatically, so --provenance is not passed.
-      - run: npm publish --access public
+      # Skip rather than fail when this version is already on npm. A tag may
+      # exist to release a sibling package in this repo, and a red run that
+      # actually means "nothing to publish here" trains people to ignore red
+      # runs. The log says which happened.
+      - name: Publish the protocol package if its version is new
+        run: |
+          NAME=$(node -p "require('./package.json').name")
+          VERSION=$(node -p "require('./package.json').version")
+          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+            echo "::notice::$NAME@$VERSION is already published — skipping. Bump package.json to release it."
+          else
+            echo "Publishing $NAME@$VERSION"
+            npm publish --access public
+          fi
+
+      # The CLI is a second package in this repo with its own version. Publish it
+      # from the same tag, but only when its version is actually new — otherwise
+      # every release after an unchanged CLI would fail on "cannot publish over
+      # the previously published version".
+      #
+      # A skip and a publish must not look alike in the log: one means "nothing
+      # to do", the other means "shipped".
+      - name: Publish the CLI if its version is new
+        working-directory: cli
+        run: |
+          NAME=$(node -p "require('./package.json').name")
+          VERSION=$(node -p "require('./package.json').version")
+          if npm view "$NAME@$VERSION" version >/dev/null 2>&1; then
+            echo "::notice::$NAME@$VERSION is already published — skipping. Bump cli/package.json to release it."
+          else
+            echo "Publishing $NAME@$VERSION"
+            npm publish --access public
+          fi

package/README.md

@@ -1,7 +1,9 @@
 # ajp-protocol
 
 The Agent Job Protocol — standard interaction layer for the agent internet.
-Part of the [Provenance Protocol](https://getprovenance.dev) family.
+Built on the [Provenance Protocol](https://github.com/ilucky21c/provenance-protocol):
+agents find and verify each other from their own signed declarations, with no
+directory or index in between.
 
 ```bash
 npm install ajp-protocol
@@ -15,7 +17,7 @@ AJP defines how any party — a human, an agent, or an orchestrator — hands a
 job to another agent, tracks its progress, and receives the result.
 
 Three endpoints. Three message types. Runs over standard HTTP.
-Trust verification via `provenance-protocol` built in.
+Every message is signed in full; identity is checked offline.
 
 ---
 
@@ -26,7 +28,7 @@ and job lifecycle automatically.
 
 ```js
 import { AJPServer, declarationKeyResolver, indexStandingCheck } from 'ajp-protocol';
-import { Provenance } from 'provenance-protocol';
+import { Provenance } from 'provenance-protocol/index-client';
 import express from 'express';
 
 const app = express();
@@ -47,15 +49,17 @@ const server = new AJPServer({
   // This is the default — no index is consulted to check a signature.
   resolveSenderKey: declarationKeyResolver(),
 
+  // Requirements on what the sender declares are checked offline, against
+  // its verified declaration.
+  trustRequirements: { requireCapabilities: ['delegate:agents'] },
+
   // Standing (revocation, incidents, freshness) cannot be checked offline, so
   // it is opt-in and you choose whom to ask. Omit it entirely to accept any
   // sender whose identity verifies.
-  checkStanding: indexStandingCheck(new Provenance(), {
-    requireDeclared: true,
-    requireCapabilities: ['delegate:agents'],
-    requireClean: true,
-    requireMinAge: 7,
-  }),
+  checkStanding: indexStandingCheck(
+    new Provenance({ apiUrl: 'https://index.example.com' }),   // an index you choose
+    { requireClean: true, requireMinAge: 7 }
+  ),
   onStandingUnavailable: 'deny',   // an unreachable attester is not an accusation
 
   // Your agent logic — receives the job, returns the result
@@ -84,12 +88,14 @@ const client = new AJPClient({
     type: 'agent',   // 'human' | 'agent' | 'orchestrator'
     provenance_id: 'provenance:github:alice/orchestrator',
   },
+  // Where the recipient's endpoint comes from: by default its own signed
+  // declaration, found from its provenance id. No index involved.
   // Agent/orchestrator callers sign with Ed25519 — no shared secret needed
   privateKey: process.env.PROVENANCE_PRIVATE_KEY,
 });
 
 const result = await client.send(
-  'provenance:github:bob/research-assistant',  // who to hire
+  'provenance:domain:research.bob.example',     // who to hire
   {
     type: 'research',
     instruction: 'Find the top 3 papers on transformer attention in 2024.',
@@ -122,7 +128,7 @@ const result = await client.send(agentId, task, budget);
 ### Agent hiring an agent
 ```js
 // Agent callers sign with Ed25519 — no shared secret, no prior setup
-// The receiving agent verifies by fetching your public key from Provenance index
+// The receiving agent verifies against the key in your published declaration
 const client = new AJPClient({
   from: { type: 'agent', provenance_id: 'provenance:github:alice/pipeline' },
   privateKey: process.env.PROVENANCE_PRIVATE_KEY,
@@ -149,12 +155,14 @@ Two separate questions, and only one of them needs a network service.
 AJPServer.receive()
   → validate the offer's shape
   → IDENTITY  (offline, always)
-      fetch the sender's declaration from from.declaration_url
+      fetch the sender's declaration (from.declaration_url, or the
+      standard location its provenance id names)
       → does it verify against the key inside it?
       → was it served from the location its provenance id names?
       → is that id the one the offer claims?
       → has this sender's key changed since last time?
       then check the offer's signature with that key
+      → does the declaration promise what trustRequirements ask?
   → STANDING  (online, optional, you choose the attester)
       → revoked? open incidents? evidence stale? old enough?
       → unreachable attester → your policy, not a failed trust check
@@ -173,7 +181,7 @@ Platform-level auth is assumed for humans.
 ## Declare AJP in your PROVENANCE.yml
 
 ```yaml
-provenance: "0.1"
+provenance: "0.2"
 name: "Research Assistant"
 
 capabilities:
@@ -186,8 +194,9 @@ ajp:
   version: "0.1"
 ```
 
-The Provenance crawler reads `ajp.endpoint` and indexes it.
-Senders can discover your endpoint without out-of-band configuration.
+Senders read `ajp.endpoint` from your signed declaration, so they can find
+you without out-of-band configuration — and without trusting anyone's copy of
+it. Sign the declaration with `npx provenance-protocol sign`.
 
 ---
 
@@ -200,6 +209,7 @@ import { NextResponse } from 'next/server';
 
 const server = new AJPServer({
   provenanceId: process.env.PROVENANCE_ID,
+  privateKey: process.env.PROVENANCE_PRIVATE_KEY,   // signs results
   secret: process.env.AJP_SECRET,
   onJob: async (job) => {
     // your agent logic
@@ -218,17 +228,17 @@ export async function POST(req) {
 
 | Package | Purpose |
 |---|---|
-| `provenance-protocol` | Query the agent identity index |
+| [`provenance-protocol`](https://github.com/ilucky21c/provenance-protocol) | Declarations and attestations: sign, verify, locate — offline |
 | `ajp-protocol` | Send and receive agent jobs (this package) |
-| `PROVENANCE.yml` | Declare your agent's identity and capabilities |
+| [`provenance-middleware`](https://github.com/ilucky21c/provenance-middleware) | Serve and sign your declaration from your own service |
 
 ---
 
 ## CLI
 
 ```bash
-# Send a job to any indexed agent from the terminal
-npx @ilucky21c/ajp-cli hire provenance:github:alice/summarizer \
+# Send a job to any agent that publishes a declaration with ajp.endpoint
+npx @ilucky21c/ajp-cli hire provenance:domain:summarizer.example.com \
   --instruction "Summarize this paper: https://arxiv.org/abs/..." \
   --budget 0.50 --timeout 60
 
@@ -236,16 +246,34 @@ npx @ilucky21c/ajp-cli hire provenance:github:alice/summarizer \
 npx @ilucky21c/ajp-cli jobs job_m0abc123 --endpoint https://alice-agent.example.com/api/agent
 ```
 
-Requires Provenance identity — set up first with `npx provenance-protocol keygen` and `npx provenance-protocol register`.
+Requires a Provenance identity — `npx provenance-protocol keygen`, then publish a
+signed declaration. `--endpoint <url>` skips resolution; `--index <url>`
+resolves through an index you choose instead.
+
+---
 
-Full CLI reference: [getprovenance.dev/docs/ajp#cli](https://getprovenance.dev/docs/ajp#cli)
+## Upgrading from 0.2
+
+- **Signatures now cover the whole message.** Before 0.3 only top-level keys were
+  signed and every nested field — the task, budget, sender, recipient, result —
+  was left out, so a signed job could be rewritten in transit. Old and new
+  versions do not interoperate; upgrade both sides. A 0.3 receiver answers an
+  old-style signature with `LEGACY_SIGNATURE`.
+- `AJPClient` finds the recipient from its own declaration by default.
+  `provenanceApiUrl` is gone (passing it throws); use
+  `resolveEndpoint: indexEndpointResolver(new Provenance({ apiUrl }))` to keep
+  using an index, or `send(..., { endpoint })` to skip resolution.
+- `trustRequirements.requireConstraints` / `requireCapabilities` are enforced
+  offline against the sender's declaration. Standing requirements
+  (`requireClean`, `requireMinAge`, …) without `checkStanding` now fail at
+  startup instead of being silently ignored.
 
 ---
 
-## Full documentation
+## Full specification
 
-[getprovenance.dev/docs/ajp](https://getprovenance.dev/docs/ajp)
+[spec/SPEC.md](./spec/SPEC.md)
 
 ---
 
-## MIT License — getprovenance.dev
+## MIT License

package/cli/index.js

@@ -2,18 +2,22 @@
 /**
  * ajp-cli — Agent Job Protocol CLI
  *
- * Requires Provenance identity (PROVENANCE_ID + PROVENANCE_PRIVATE_KEY).
- * For identity setup: npx provenance-protocol keygen / npx provenance-protocol register
+ * Requires a Provenance identity (PROVENANCE_ID + PROVENANCE_PRIVATE_KEY).
+ * For identity setup: npx provenance-protocol keygen, then publish a signed
+ * declaration (npx provenance-protocol sign).
  *
  * Usage:
  *   ajp hire <provenance_id> --instruction <text> [--budget <usd>] [--timeout <s>]
  *   ajp jobs <job_id> --endpoint <url>
  */
 
-import { createPrivateKey, sign as nodeSign, randomBytes } from 'crypto';
+import { randomBytes } from 'crypto';
+import { createRequire } from 'module';
+import YAML from 'yaml';
+import { signWithKey, declarationEndpointResolver, indexEndpointResolver } from 'ajp-protocol';
+import { Provenance } from 'provenance-protocol/index-client';
 
-const API     = process.env.PROVENANCE_API_URL || 'https://getprovenance.dev';
-const VERSION = '0.1.0';
+const VERSION = createRequire(import.meta.url)('./package.json').version;
 
 // ── Colours ───────────────────────────────────────────────────────────────────
 
@@ -50,11 +54,16 @@ function generateJobId() {
   return `job_${Date.now().toString(36)}${randomBytes(6).toString('hex')}`;
 }
 
-function signOffer(offer, privateKeyBase64) {
-  const { signature: _, ...rest } = offer;
-  const canonical = JSON.stringify(rest, Object.keys(rest).sort());
-  const key = createPrivateKey({ key: Buffer.from(privateKeyBase64, 'base64'), format: 'der', type: 'pkcs8' });
-  return `ed25519:${nodeSign(null, Buffer.from(canonical, 'utf8'), key).toString('base64')}`;
+// Where to send the job. By default, read from the recipient's own signed
+// declaration — no index involved. --endpoint skips resolution; --index asks
+// an index you name instead.
+async function resolveEndpoint(targetId, args) {
+  if (typeof args.endpoint === 'string') return args.endpoint.replace(/\/$/, '');
+  const index = args.index || process.env.PROVENANCE_INDEX_URL;
+  const resolver = typeof index === 'string'
+    ? indexEndpointResolver(new Provenance({ apiUrl: index }))
+    : declarationEndpointResolver({ parseDeclaration: (text) => YAML.parse(text) });
+  return resolver(targetId);
 }
 
 // ── Commands ──────────────────────────────────────────────────────────────────
@@ -70,19 +79,19 @@ async function cmdHire(args) {
   if (!targetId)     { console.error(err('Usage: ajp hire <provenance_id> --instruction <text>')); process.exit(1); }
   if (!instruction)  { console.error(err('--instruction required')); process.exit(1); }
   if (!privateKey)   { console.error(err('PROVENANCE_PRIVATE_KEY not set. Run: npx provenance-protocol keygen')); process.exit(1); }
-  if (!provenanceId) { console.error(err('PROVENANCE_ID not set. Run: npx provenance-protocol register')); process.exit(1); }
+  if (!provenanceId) { console.error(err('PROVENANCE_ID not set — your agent\'s provenance id')); process.exit(1); }
 
   console.log(`\n${amb('Hiring')} ${hi(targetId)}...\n`);
 
-  // Resolve endpoint
   process.stdout.write(dim('  Resolving endpoint...'));
-  const agentRes  = await fetch(`${API}/api/agent/${targetId.replace('provenance:', '').replace(':', '/')}`);
-  const agentData = await agentRes.json();
-  if (!agentData?.ajp?.endpoint) {
-    console.log('\n' + err('Agent has no AJP endpoint. Ask them to add ajp.endpoint to PROVENANCE.yml.'));
-    process.exit(1);
+  let endpoint;
+  try {
+    endpoint = await resolveEndpoint(targetId, args);
+  } catch (e) {
+    console.log('\n' + err(e.message));
+    console.log(dim('  Nothing was sent. Pass --endpoint <url> if you know where the agent accepts jobs.'));
+    process.exit(2);
   }
-  const endpoint = agentData.ajp.endpoint.replace(/\/$/, '');
   console.log(` ${c.green}${endpoint}${c.reset}`);
 
   // Build and sign offer
@@ -92,7 +101,10 @@ async function cmdHire(args) {
 
   const offer = {
     ajp: '0.1', job_id: jobId, parent_job_id: null,
-    from: { type: 'orchestrator', id: null, provenance_id: provenanceId },
+    from: {
+      type: 'orchestrator', id: null, provenance_id: provenanceId,
+      declaration_url: args['declaration-url'] || process.env.PROVENANCE_DECLARATION_URL || null,
+    },
     to:   { provenance_id: targetId },
     task: { type: 'task', instruction, input: {}, output_format: 'json' },
     context: { credentials: {}, memory: [], constraints: [] },
@@ -102,7 +114,7 @@ async function cmdHire(args) {
     expires_at: expiresAt.toISOString(),
     signature: '',
   };
-  offer.signature = signOffer(offer, privateKey);
+  offer.signature = signWithKey(offer, privateKey);
 
   // Submit
   process.stdout.write(dim('  Submitting job...'));
@@ -191,17 +203,21 @@ ${amb('Commands:')}
          [--timeout <seconds>]      Max wait time (default: 120)
          [--from-id <id>]           Your Provenance ID (default: $PROVENANCE_ID)
          [--private-key <key>]      Your private key (default: $PROVENANCE_PRIVATE_KEY)
+         [--declaration-url <url>]  Where your signed declaration is published
+         [--endpoint <url>]         Send here instead of reading the recipient's declaration
+         [--index <url>]            Resolve the recipient through this index instead
 
   ${hi('jobs')}  <job_id>                   Check status of a job
          --endpoint <url>           The agent's AJP endpoint URL
 
 ${amb('Environment variables:')}
-  PROVENANCE_ID           Your Provenance ID  (set up with: npx provenance-protocol register)
-  PROVENANCE_PRIVATE_KEY  Your Ed25519 private key  (set up with: npx provenance-protocol keygen)
-  PROVENANCE_API_URL      Override Provenance API base URL
+  PROVENANCE_ID               Your provenance id
+  PROVENANCE_PRIVATE_KEY      Your Ed25519 private key  (npx provenance-protocol keygen)
+  PROVENANCE_DECLARATION_URL  Where your signed declaration is published
+  PROVENANCE_INDEX_URL        Resolve recipients through this index (optional)
 
 ${amb('Examples:')}
-  ajp hire provenance:github:alice/summarizer \\
+  ajp hire provenance:domain:summarizer.example.com \\
     --instruction "Summarize https://arxiv.org/abs/2501.00001" \\
     --budget 0.50 --timeout 60
 
@@ -209,8 +225,9 @@ ${amb('Examples:')}
 
 ${amb('Identity setup (first time):')}
   npx provenance-protocol keygen
-  npx provenance-protocol register --id provenance:github:your-org/your-agent --url <url>
-  ${dim('Then set PROVENANCE_ID and PROVENANCE_PRIVATE_KEY in your environment.')}
+  npx provenance-protocol sign PROVENANCE.yml
+  ${dim('Publish the declaration where your provenance id says, then set')}
+  ${dim('PROVENANCE_ID and PROVENANCE_PRIVATE_KEY in your environment.')}
 `);
 }
 

package/cli/package.json

@@ -1,17 +1,31 @@
 {
   "name": "@ilucky21c/ajp-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CLI for the Agent Job Protocol — hire agents and check job status from the terminal",
   "type": "module",
   "bin": {
     "ajp": "./index.js"
   },
-  "engines": { "node": ">=18" },
+  "engines": {
+    "node": ">=18"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ilucky21c/ajp-protocol.git",
     "directory": "cli"
   },
-  "keywords": ["ajp", "agent-job-protocol", "provenance", "ai", "agents", "cli"],
-  "license": "MIT"
+  "keywords": [
+    "ajp",
+    "agent-job-protocol",
+    "provenance",
+    "ai",
+    "agents",
+    "cli"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "ajp-protocol": "^0.3.0",
+    "provenance-protocol": "^0.6.0",
+    "yaml": "^2.9.1"
+  }
 }

package/examples/agent-to-agent/example.js

@@ -3,10 +3,10 @@
 // It hires a specialist PDF agent to handle that step.
 //
 // Key difference from human→agent: the receiving agent
-// MUST verify the sender's Provenance ID before accepting.
+// MUST verify the sender's Provenance ID before accepting — offline, against
+// the sender's own signed declaration.
 
 import { AJPClient } from 'ajp-protocol';
-import { provenance } from 'provenance-protocol';
 
 // ── Sending side (data pipeline agent) ───────────────────────────────────
 
@@ -15,12 +15,15 @@ const client = new AJPClient({
     type: 'agent',
     provenance_id: 'provenance:github:alice/data-pipeline',
   },
-  secret: process.env.AJP_SECRET,
+  // Agents sign with their own key; the recipient checks it against the
+  // declaration Alice publishes in her repository.
+  privateKey: process.env.PROVENANCE_PRIVATE_KEY,
 });
 
-// Send job to a specialist PDF extractor
+// Send job to a specialist PDF extractor. Its endpoint is read from its own
+// signed declaration at https://pdf.bob.example/.well-known/provenance.json.
 const result = await client.send(
-  'provenance:pypi:bob-pdf-extractor',
+  'provenance:domain:pdf.bob.example',
   {
     type: 'extract',
     instruction: 'Extract all tables from this PDF and return them as structured JSON.',
@@ -41,15 +44,15 @@ console.log(result.output.tables);
 import { AJPServer } from 'ajp-protocol';
 
 const server = new AJPServer({
-  provenanceId: 'provenance:pypi:bob-pdf-extractor',
-  secret: process.env.AJP_SECRET,
+  provenanceId: 'provenance:domain:pdf.bob.example',
+  privateKey: process.env.PROVENANCE_PRIVATE_KEY,   // signs results
 
-  // Trust requirements for incoming agent jobs
+  // Checked offline against the sender's verified declaration.
   trustRequirements: {
-    requireDeclared: true,    // sender must have PROVENANCE.yml
-    requireClean: true,       // no open incidents
-    requireMinAge: 7,         // not a brand-new agent
+    requireConstraints: ['no:pii'],
   },
+  // Standing (incidents, age) needs someone to ask — add checkStanding with
+  // an attester you choose if you want requireClean or requireMinAge.
 
   onJob: async (job) => {
     // job.from.provenance_id already verified by AJPServer

package/examples/orchestrator/example.js

@@ -9,7 +9,7 @@ const client = new AJPClient({
     type: 'orchestrator',
     provenance_id: 'provenance:github:alice/research-orchestrator',
   },
-  secret: process.env.AJP_SECRET,
+  privateKey: process.env.PROVENANCE_PRIVATE_KEY,   // orchestrators sign with their own key
 });
 
 const PARENT_JOB_ID = 'job_parent_01J8X2K9M3N4P5Q6';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ajp-protocol",
-  "version": "0.2.1",
-  "description": "Agent Job Protocol \u2014 standard interaction layer for the agent internet",
+  "version": "0.3.0",
+  "description": "Agent Job Protocol — standard interaction layer for the agent internet",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
@@ -17,14 +17,14 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "provenance-protocol": "^0.2.2"
+    "provenance-protocol": "^0.6.0"
   },
   "repository": {
     "type": "git",
     "url": "https://github.com/ilucky21c/ajp-protocol"
   },
-  "homepage": "https://getprovenance.dev/ajp",
+  "homepage": "https://github.com/ilucky21c/ajp-protocol#readme",
   "scripts": {
-    "test": "node test/trust.test.mjs"
+    "test": "node test/trust.test.mjs && node test/resolution.test.mjs"
   }
 }

package/spec/SPEC.md

@@ -27,8 +27,9 @@ inside is yours to define. An agent that searches the web and an agent that
 processes invoices use the same protocol.
 
 **Trust is built in, not bolted on.** Every JobOffer is signed by the sender.
-Every receiver verifies the sender against the Provenance index before accepting.
-Trust verification is part of the protocol, not optional middleware.
+Every receiver verifies the sender against the sender's own signed Provenance
+declaration before accepting — offline, with no index involved. Trust
+verification is part of the protocol, not optional middleware.
 
 **Three parties, same protocol.** A human hiring an agent, an agent hiring an
 agent, and an orchestrator delegating to sub-agents all use identical message
@@ -46,7 +47,7 @@ types. The `from` field distinguishes them.
 
 A human (or a platform acting on their behalf) sends a JobOffer to an agent.
 The `from.type` is `human`. No Provenance verification of the sender is required
-— humans are not indexed agents. Platform-level auth handles human identity.
+— humans do not publish agent declarations. Platform-level auth handles human identity.
 
 ```
 Human / Platform  ──JobOffer──►  Agent
@@ -222,7 +223,7 @@ Status values: `accepted` `running` `completed` `failed` `rejected` `expired`
 }
 ```
 
-`constraints_asserted` lists the constraints the agent declares it honored during this job. The field is included in the signed payload — the signature ties the assertion to the agent's registered Provenance identity. Self-reported, but attributable: a false assertion is a cryptographic receipt of the lie, actionable via the Provenance incidents system.
+`constraints_asserted` lists the constraints the agent declares it honored during this job. The field is included in the signed payload — the signature ties the assertion to the key in the agent's declaration. Self-reported, but attributable: a false assertion is a cryptographic receipt of the lie, which the receiver can hand to any attester as evidence (a Provenance `report` attestation can reference it).
 
 ---
 
@@ -236,7 +237,9 @@ questions, and only one of them needs a network service.
 *Is this signature really from the party named in `from`?*
 
 The sender publishes its signed declaration and points at it with
-`from.declaration_url`. The receiver fetches that file and verifies it locally:
+`from.declaration_url`; when absent, the receiver uses the standard location its
+`provenance_id` names (see *Where a declaration lives* in the Provenance
+specification). The receiver fetches that file and verifies it locally:
 
 ```js
 import { verifyDeclaration } from 'provenance-protocol/verify';
@@ -275,17 +278,25 @@ NOT hardcode a single provider.
 
 ```js
 import { AJPServer, declarationKeyResolver, indexStandingCheck } from 'ajp-protocol';
-import { Provenance } from 'provenance-protocol';
+import { Provenance } from 'provenance-protocol/index-client';
+
+const index = new Provenance({ apiUrl: 'https://index.example.com' }); // an index you choose
 
 const server = new AJPServer({
-  provenanceId, onJob,
-  resolveSenderKey: declarationKeyResolver(),          // offline, the default
-  checkStanding: indexStandingCheck(new Provenance(), // opt-in, swappable
-    { requireConstraints: ['no:pii'], requireClean: true, requireMinAge: 7 }),
+  provenanceId, privateKey, onJob,
+  resolveSenderKey: declarationKeyResolver(),  // offline, the default
+  trustRequirements: { requireConstraints: ['no:pii'], requireClean: true, requireMinAge: 7 },
+  checkStanding: indexStandingCheck(index, { requireClean: true, requireMinAge: 7 }), // opt-in, swappable
   onStandingUnavailable: 'deny',
 });
 ```
 
+Requirements on **declared** fields (`requireConstraints`, `requireCapabilities`)
+are checked against the sender's verified declaration, offline. Requirements on
+**standing** (`requireClean`, `requireMinAge`, …) need a standing source; an
+implementation MUST refuse to start with them configured and no source, rather
+than accept jobs while ignoring them.
+
 A receiver that performs a standing check MUST distinguish *checked and failed*
 from *could not check*, and MUST state which way it fails when the check is
 unavailable. Reporting an unreachable attester as a failed trust check turns
@@ -299,7 +310,16 @@ offer, and the shared-secret signature covers it.
 ## Signature
 
 Every JobOffer and JobResult is signed by the sender. The signature covers the
-full message body excluding the `signature` field itself, with keys sorted canonically.
+full message body excluding the `signature` field itself — every field at every
+depth. `canonical(body)` is the canonical JSON defined by the Provenance
+Protocol, which is the JSON Canonicalization Scheme (JCS, RFC 8785): object
+keys sorted by UTF-16 code units at every depth, no insignificant whitespace.
+
+Implementations before `ajp-protocol` 0.3 serialised only the top-level keys:
+nested objects — `task`, `budget`, `from`, `to`, `context`, `output` — were
+emptied before signing, so they were not covered and could be altered without
+detection. A receiver MUST NOT accept such signatures. It MAY recognise one in
+order to tell the sender to upgrade.
 
 **Human senders** (no Provenance identity) — HMAC-SHA256 with a shared secret:
 ```
@@ -311,8 +331,12 @@ signature = "sha256:" + hex(HMAC-SHA256(canonical(body), sender_secret))
 signature = "ed25519:" + base64(Ed25519Sign(canonical(body), provenance_private_key))
 ```
 
-The receiving server verifies agent signatures by fetching the sender's public key from the
-Provenance index. This ties every message to a registered identity without a shared secret.
+The receiving server verifies agent signatures against the public key in the
+sender's own verified declaration (see Trust verification). This ties every
+message to a published identity without a shared secret or an index.
+
+A sender SHOULD verify a JobResult's signature the same way, against the key in
+the recipient's declaration, before relying on it.
 
 The `ajp-protocol` SDK handles signing and verification automatically based on `from.type`.
 
@@ -369,7 +393,7 @@ const result = await client.send(
 Agents that implement AJP should declare it:
 
 ```yaml
-provenance: "0.1"
+provenance: "0.2"
 name: "Research Assistant"
 
 capabilities:
@@ -382,8 +406,11 @@ ajp:
   version: "0.1"
 ```
 
-The Provenance crawler reads the `ajp.endpoint` field and indexes it. Senders
-can discover an agent's AJP endpoint without out-of-band communication.
+A sender finds an agent's AJP endpoint by fetching the agent's declaration from
+the location its `provenance_id` names, verifying it, and reading
+`ajp.endpoint`. Because the declaration is signed and tied to its location, the
+endpoint is the operator's own statement — no directory or index is needed.
+Indexes may also record it, as a convenience.
 
 ---
 
@@ -407,6 +434,5 @@ version. Future versions add fields, never remove them.
 
 ---
 
-*AJP v0.1 — Provenance Protocol Family — MIT License*
-*https://getprovenance.dev/ajp*
+*AJP v0.1 — MIT License*
 *https://github.com/ilucky21c/ajp-protocol*