provenance-protocol 0.1.4 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +58 -8
- package/SPEC.md +483 -0
- package/package.json +19 -4
- package/schema/provenance-0.1.json +229 -0
- package/src/cli.js +249 -151
- package/src/index.d.ts +3 -0
- package/src/index.js +54 -6
- package/src/verify.d.ts +85 -0
- package/src/verify.js +277 -0
- package/test-vectors/README.md +52 -0
- package/test-vectors/signatures-0.1.json +80 -0
|
@@ -0,0 +1,229 @@
|
|
|
1
|
+
{
|
|
2
|
+
"$schema": "http://json-schema.org/draft-07/schema#",
|
|
3
|
+
"$id": "https://getprovenance.dev/schema/0.1.json",
|
|
4
|
+
"title": "PROVENANCE.yml",
|
|
5
|
+
"description": "Provenance Protocol v0.1 schema for AI agent identity files",
|
|
6
|
+
"type": "object",
|
|
7
|
+
"required": [
|
|
8
|
+
"provenance",
|
|
9
|
+
"name",
|
|
10
|
+
"description"
|
|
11
|
+
],
|
|
12
|
+
"properties": {
|
|
13
|
+
"provenance": {
|
|
14
|
+
"type": "string",
|
|
15
|
+
"description": "Spec version",
|
|
16
|
+
"enum": [
|
|
17
|
+
"0.1"
|
|
18
|
+
]
|
|
19
|
+
},
|
|
20
|
+
"name": {
|
|
21
|
+
"type": "string",
|
|
22
|
+
"description": "Human-readable name for this agent",
|
|
23
|
+
"minLength": 1,
|
|
24
|
+
"maxLength": 100
|
|
25
|
+
},
|
|
26
|
+
"description": {
|
|
27
|
+
"type": "string",
|
|
28
|
+
"description": "What this agent does, in plain language",
|
|
29
|
+
"minLength": 1,
|
|
30
|
+
"maxLength": 1000
|
|
31
|
+
},
|
|
32
|
+
"version": {
|
|
33
|
+
"type": "string",
|
|
34
|
+
"description": "Semantic version of the agent",
|
|
35
|
+
"pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+.*$"
|
|
36
|
+
},
|
|
37
|
+
"model": {
|
|
38
|
+
"type": "object",
|
|
39
|
+
"description": "The LLM powering this agent",
|
|
40
|
+
"properties": {
|
|
41
|
+
"provider": {
|
|
42
|
+
"type": "string",
|
|
43
|
+
"enum": [
|
|
44
|
+
"anthropic",
|
|
45
|
+
"openai",
|
|
46
|
+
"google",
|
|
47
|
+
"mistral",
|
|
48
|
+
"meta",
|
|
49
|
+
"local",
|
|
50
|
+
"other"
|
|
51
|
+
],
|
|
52
|
+
"description": "LLM provider"
|
|
53
|
+
},
|
|
54
|
+
"model_id": {
|
|
55
|
+
"type": "string",
|
|
56
|
+
"description": "Specific model ID e.g. claude-sonnet-4-5"
|
|
57
|
+
}
|
|
58
|
+
},
|
|
59
|
+
"additionalProperties": false
|
|
60
|
+
},
|
|
61
|
+
"capabilities": {
|
|
62
|
+
"type": "array",
|
|
63
|
+
"description": "What this agent can do \u2014 standard vocabulary or domain:custom",
|
|
64
|
+
"items": {
|
|
65
|
+
"type": "string",
|
|
66
|
+
"pattern": "^[a-z][a-z0-9_-]*(:[a-z0-9_:-]+)?$"
|
|
67
|
+
},
|
|
68
|
+
"uniqueItems": true
|
|
69
|
+
},
|
|
70
|
+
"constraints": {
|
|
71
|
+
"type": "array",
|
|
72
|
+
"description": "Public commitments \u2014 what this agent will NEVER do",
|
|
73
|
+
"items": {
|
|
74
|
+
"type": "string",
|
|
75
|
+
"pattern": "^no:[a-z0-9_:-]+$"
|
|
76
|
+
},
|
|
77
|
+
"uniqueItems": true
|
|
78
|
+
},
|
|
79
|
+
"delegates": {
|
|
80
|
+
"type": "array",
|
|
81
|
+
"description": "Sub-agents this orchestrator spawns \u2014 required if delegate:agents capability declared",
|
|
82
|
+
"items": {
|
|
83
|
+
"type": "object",
|
|
84
|
+
"required": [
|
|
85
|
+
"provenance_id"
|
|
86
|
+
],
|
|
87
|
+
"properties": {
|
|
88
|
+
"provenance_id": {
|
|
89
|
+
"type": "string",
|
|
90
|
+
"pattern": "^provenance:(github|npm|pypi|huggingface|clawmarket):.+$"
|
|
91
|
+
},
|
|
92
|
+
"purpose": {
|
|
93
|
+
"type": "string",
|
|
94
|
+
"maxLength": 200
|
|
95
|
+
}
|
|
96
|
+
},
|
|
97
|
+
"additionalProperties": false
|
|
98
|
+
}
|
|
99
|
+
},
|
|
100
|
+
"skills": {
|
|
101
|
+
"type": "array",
|
|
102
|
+
"description": "External skills this agent depends on",
|
|
103
|
+
"items": {
|
|
104
|
+
"type": "object",
|
|
105
|
+
"required": [
|
|
106
|
+
"id",
|
|
107
|
+
"source"
|
|
108
|
+
],
|
|
109
|
+
"properties": {
|
|
110
|
+
"id": {
|
|
111
|
+
"type": "string"
|
|
112
|
+
},
|
|
113
|
+
"source": {
|
|
114
|
+
"type": "string",
|
|
115
|
+
"enum": [
|
|
116
|
+
"skillsmp",
|
|
117
|
+
"github",
|
|
118
|
+
"npm",
|
|
119
|
+
"custom"
|
|
120
|
+
]
|
|
121
|
+
},
|
|
122
|
+
"url": {
|
|
123
|
+
"type": "string",
|
|
124
|
+
"format": "uri"
|
|
125
|
+
}
|
|
126
|
+
},
|
|
127
|
+
"additionalProperties": false
|
|
128
|
+
}
|
|
129
|
+
},
|
|
130
|
+
"runtime": {
|
|
131
|
+
"type": "object",
|
|
132
|
+
"description": "How this agent runs",
|
|
133
|
+
"properties": {
|
|
134
|
+
"type": {
|
|
135
|
+
"type": "string",
|
|
136
|
+
"enum": [
|
|
137
|
+
"task",
|
|
138
|
+
"persistent",
|
|
139
|
+
"scheduled"
|
|
140
|
+
],
|
|
141
|
+
"description": "task: runs to completion | persistent: always on | scheduled: cron-like"
|
|
142
|
+
},
|
|
143
|
+
"trigger": {
|
|
144
|
+
"type": "string",
|
|
145
|
+
"enum": [
|
|
146
|
+
"api",
|
|
147
|
+
"webhook",
|
|
148
|
+
"schedule",
|
|
149
|
+
"event"
|
|
150
|
+
],
|
|
151
|
+
"description": "What starts this agent"
|
|
152
|
+
}
|
|
153
|
+
},
|
|
154
|
+
"additionalProperties": false
|
|
155
|
+
},
|
|
156
|
+
"contact": {
|
|
157
|
+
"type": "object",
|
|
158
|
+
"description": "Who is responsible for this agent",
|
|
159
|
+
"properties": {
|
|
160
|
+
"name": {
|
|
161
|
+
"type": "string",
|
|
162
|
+
"minLength": 1
|
|
163
|
+
},
|
|
164
|
+
"url": {
|
|
165
|
+
"type": "string",
|
|
166
|
+
"format": "uri"
|
|
167
|
+
},
|
|
168
|
+
"email": {
|
|
169
|
+
"type": "string",
|
|
170
|
+
"format": "email"
|
|
171
|
+
}
|
|
172
|
+
},
|
|
173
|
+
"additionalProperties": false
|
|
174
|
+
},
|
|
175
|
+
"provenance_id": {
|
|
176
|
+
"type": "string",
|
|
177
|
+
"description": "Your Provenance identifier \u2014 links this file to your index entry",
|
|
178
|
+
"pattern": "^provenance:(github|npm|pypi|huggingface|clawmarket):.+$"
|
|
179
|
+
},
|
|
180
|
+
"identity": {
|
|
181
|
+
"type": "object",
|
|
182
|
+
"description": "Cryptographic identity. public_key alone advertises the key an agent will use to prove control live. Adding signature makes the declaration itself tamper-evident.",
|
|
183
|
+
"properties": {
|
|
184
|
+
"public_key": {
|
|
185
|
+
"type": "string",
|
|
186
|
+
"description": "Base64-encoded Ed25519 SPKI DER public key. Generate with: generateProvenanceKeyPair() from provenance-protocol/keygen"
|
|
187
|
+
},
|
|
188
|
+
"signature": {
|
|
189
|
+
"type": "string",
|
|
190
|
+
"description": "Base64 Ed25519 signature of '<provenance_id>:<public_key>' \u2014 proves you control the private key and that the declaration is unaltered. Optional: omit it when the key is published only for live challenge-response. Requires provenance_id."
|
|
191
|
+
},
|
|
192
|
+
"algorithm": {
|
|
193
|
+
"type": "string",
|
|
194
|
+
"enum": [
|
|
195
|
+
"ed25519"
|
|
196
|
+
],
|
|
197
|
+
"description": "Signing algorithm. Always ed25519."
|
|
198
|
+
}
|
|
199
|
+
},
|
|
200
|
+
"required": [
|
|
201
|
+
"public_key"
|
|
202
|
+
],
|
|
203
|
+
"additionalProperties": false
|
|
204
|
+
},
|
|
205
|
+
"ajp": {
|
|
206
|
+
"type": "object",
|
|
207
|
+
"description": "Agent Job Protocol endpoint \u2014 enables agent-to-agent job delegation",
|
|
208
|
+
"properties": {
|
|
209
|
+
"endpoint": {
|
|
210
|
+
"type": "string",
|
|
211
|
+
"format": "uri",
|
|
212
|
+
"description": "Base URL for your AJP implementation. Must accept POST /jobs, GET /jobs/:id, POST /jobs/:id/ack"
|
|
213
|
+
},
|
|
214
|
+
"version": {
|
|
215
|
+
"type": "string",
|
|
216
|
+
"enum": [
|
|
217
|
+
"0.1"
|
|
218
|
+
],
|
|
219
|
+
"description": "AJP spec version"
|
|
220
|
+
}
|
|
221
|
+
},
|
|
222
|
+
"required": [
|
|
223
|
+
"endpoint"
|
|
224
|
+
],
|
|
225
|
+
"additionalProperties": false
|
|
226
|
+
}
|
|
227
|
+
},
|
|
228
|
+
"additionalProperties": false
|
|
229
|
+
}
|