provenance-protocol 0.4.0 → 0.5.0

package/SPEC.md

@@ -251,8 +251,30 @@ provenance:npm:@scope/package-name
 provenance:pypi:package-name
 provenance:huggingface:owner/space-name
 provenance:clawmarket:listing-id
+provenance:domain:agent.example.com
+provenance:domain:example.com/agents/research
 ```
 
+### Domain identifiers
+
+`provenance:domain:<hostname>` is for an agent that runs as a service and has no
+public repository — which is most commercial agents. Control is proven exactly as
+it is for a repository: the declaration is served from the location the
+identifier names, and only someone with write access to that location could have
+put it there.
+
+The hostname must match exactly. A subdomain is a different party for this
+purpose, and treating `agent.example.com` as covered by `example.com` would be
+the whole attack.
+
+Optional path segments allow several agents under one domain — those segments
+must appear in the retrieval path.
+
+Without this form, a hosted service serving its own declaration could never be
+verified as its operator's: the signature would check out while the location
+check reported `unchecked`, so no verifier could conclude the declaration was
+genuinely theirs.
+
 Add `provenance_id` to your PROVENANCE.yml to link your file to your
 index entry and claim your agent profile.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provenance-protocol",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The Provenance Protocol \u2014 open standard for AI agent identity \u2014 and its reference SDK",
   "type": "module",
   "main": "./src/index.js",
@@ -58,6 +58,6 @@
     "node": ">=14.0.0"
   },
   "scripts": {
-    "test": "node test/verify.test.mjs && node test/declaration-signature.test.mjs && node test/payload-separation.test.mjs"
+    "test": "node test/verify.test.mjs && node test/declaration-signature.test.mjs && node test/payload-separation.test.mjs && node test/location.test.mjs"
   }
 }

package/src/verify.js

@@ -131,6 +131,26 @@ export function checkLocation(provenanceId, retrievedFrom) {
     return 'unchecked';
   }
 
+  // provenance:domain:<hostname>[/<path>] — for an agent that runs as a service
+  // and has no public repository. Control is proven the same way as with a
+  // repo: whoever put the file there had write access to the location. Most
+  // commercial agents are this shape, so without it they could never be
+  // verified as their operator's.
+  if (id.platform === 'domain') {
+    const [declaredHost, ...declaredPath] = id.path.split('/').filter(Boolean);
+    if (!declaredHost) return 'unchecked';
+    // Exact host match. A subdomain is a different party as far as this is
+    // concerned, and treating it as the same would be the whole attack.
+    if (url.hostname.toLowerCase() !== declaredHost.toLowerCase()) return 'mismatch';
+    if (declaredPath.length === 0) return 'match';
+    const segs = url.pathname.split('/').filter(Boolean).map((x) => x.toLowerCase());
+    const want = declaredPath.map((x) => x.toLowerCase());
+    for (let i = 0; i + want.length <= segs.length; i++) {
+      if (want.every((part, j) => segs[i + j] === part)) return 'match';
+    }
+    return 'mismatch';
+  }
+
   const platform = HOST_PLATFORMS.find(([host]) => host.test(url.hostname))?.[1];
   if (!platform) return 'unchecked';
   if (platform !== id.platform) return 'mismatch';