agp-tpe 2.3.3__tar.gz

agp_tpe-2.3.3/.gitignore

@@ -0,0 +1,22 @@
+.DS_Store
+__pycache__/
+*.pyc
+
+results/
+generated/
+
+*.exe
+*.out
+*.o
+
+agp-log-go
+agp-signed-go
+agp-resolver-go
+
+# Go build artifacts
+signed_decision_context/go/agp-signed-decision-context-verify
+
+# Python package build artifacts
+dist/
+build/
+*.egg-info/

agp_tpe-2.3.3/LICENSE

@@ -0,0 +1,9 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+Copyright 2026 AGP contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at the URL above.

agp_tpe-2.3.3/PKG-INFO

@@ -0,0 +1,201 @@
+Metadata-Version: 2.4
+Name: agp-tpe
+Version: 2.3.3
+Summary: AGP Trust Primitive Engine for deterministic Trust Policy 2 evaluation
+Project-URL: Homepage, https://github.com/agpprotocol/agp
+Project-URL: Repository, https://github.com/agpprotocol/agp
+Project-URL: Documentation, https://github.com/agpprotocol/agp/blob/main/trust_primitive_engine/INTEGRATION-GUIDE.md
+Project-URL: Issues, https://github.com/agpprotocol/agp/issues
+Author: AGP Protocol
+License: Apache License
+        Version 2.0, January 2004
+        http://www.apache.org/licenses/
+        
+        Copyright 2026 AGP contributors
+        
+        Licensed under the Apache License, Version 2.0 (the "License");
+        you may not use this file except in compliance with the License.
+        You may obtain a copy of the License at the URL above.
+License-File: LICENSE
+Keywords: agp,deterministic-evaluation,ed25519,policy-engine,trust-policy
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.12
+Requires-Dist: cryptography>=42.0
+Requires-Dist: jsonschema<5,>=4.26
+Description-Content-Type: text/markdown
+
+# Agent Governance Protocol (AGP)
+
+**AGP is an experimental governance layer for multi-agent systems.**
+
+It defines how independent agents or authorities can propose, review, approve,
+reject, veto and audit high-impact decisions without trusting a single
+coordinator as the sole source of truth.
+
+> Status: experimental. AGP is not yet a production standard.
+
+
+
+## 120-Second Demo
+
+Run the public AGP demo with no external dependencies:
+
+    python3 examples/120_second_demo/demo.py
+
+Fast mode:
+
+    python3 examples/120_second_demo/demo.py --fast
+
+Valid governance path:
+
+    python3 examples/120_second_demo/demo.py --happy-path --fast
+
+The demo shows a coordinator changing a deployment payload after approval.
+A coordinator-trusting workflow accepts it because the approval count is still present.
+AGP rejects it because the approvals are bound to the exact approved input.
+
+[Read the demo documentation](examples/120_second_demo/README.md)
+
+## Whitepaper
+
+The current public review draft is:
+
+**AGP Whitepaper v0.9.2 — A Deterministic Governance Layer for Multi-Agent Systems**
+
+- [Read online](docs/whitepaper/AGP_Whitepaper_v0.9.2.md)
+- [Download PDF](https://github.com/agpprotocol/agp/releases/tag/whitepaper-v0.9.2)
+- [Submit technical feedback](https://github.com/agpprotocol/agp/issues/1)
+
+The whitepaper is experimental, is not a production standard, and has not yet received independent security review.
+
+## Why AGP?
+
+- **MCP** connects models to tools and data.
+- **A2A-style protocols** let agents communicate.
+- **Workflow engines** coordinate execution.
+- **AGP** governs collective decisions.
+
+A workflow can record that a deployment was approved. AGP additionally aims to
+make the authority snapshot, evidence, ballots, resolution and history
+independently verifiable.
+
+## Core properties
+
+- deterministic resolution;
+- canonical serialization;
+- independent Python and Go implementations;
+- Ed25519 signed envelopes;
+- replay, expiration and revocation checks;
+- append-only transparency log;
+- external audit receipts;
+- conformance and adversarial test vectors.
+
+## Architecture
+
+```mermaid
+flowchart LR
+    P[Proposal] --> E[Evidence]
+    E --> B[Signed ballots]
+    B --> R[Deterministic resolution]
+    R --> L[Transparency log]
+    L --> A[Independent audit]
+```
+
+## AGP vs. a conventional workflow
+
+| Property | Workflow | AGP |
+|---|---:|---:|
+| Coordinates steps | Yes | Yes |
+| Deterministic replay across implementations | Not inherent | Yes |
+| Signed authority actions | Optional/custom | Built into profile |
+| Evidence version validation | Optional/custom | Yes |
+| Revocation-aware decisions | Optional/custom | Yes |
+| Tamper-evident history | Optional/custom | Yes |
+| Independent audit without trusting coordinator | Not inherent | Yes |
+
+AGP is intentionally more complex. For low-risk internal automation, a
+conventional workflow is usually the better choice.
+
+## Reproducible results
+
+```text
+AGP v0.3 Conformance:          260/260 passed
+AGP v0.4 Signed Conformance:    10/10 passed
+AGP v0.5 Transparency:           8/8 passed
+AGP vs Workflow benchmark:       8/8 attacks detected by AGP
+```
+
+The workflow baseline in the benchmark detected 0/8 because it treated
+coordinator state as authoritative. This is a limited experimental benchmark,
+not a claim that all workflow engines are insecure.
+
+## Quick start
+
+Requirements:
+
+- Python 3.10+
+- Go 1.22+
+
+```bash
+git clone https://github.com/agpprotocol/agp.git
+cd agp
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements-v0.4.txt
+python3 run_benchmark_all.py
+```
+
+Expected final line:
+
+```text
+AGP BENCHMARK COMPLETE
+```
+
+## Repository map
+
+```text
+spec/           Conformance profile
+python/         Python resolver
+go/             Go resolver
+signed/         Signed envelope conformance
+transparency/   Append-only audit log
+benchmark/      AGP vs workflow experiment
+examples/       Reference scenarios
+docs/           Architecture, threat model and evaluation
+```
+
+## What AGP does not claim
+
+AGP does not:
+
+- replace authentication, authorization or IAM;
+- replace orchestration engines;
+- guarantee that evidence is factually true;
+- eliminate compromised members;
+- solve governance for every multi-agent system;
+- claim production maturity.
+
+## Current research question
+
+> Do high-impact multi-agent systems need a portable, independently verifiable
+> governance layer distinct from communication and orchestration?
+
+## Documentation
+
+- [Architecture](docs/ARCHITECTURE.md)
+- [Threat model](docs/THREAT_MODEL.md)
+- [Benchmark](docs/BENCHMARK.md)
+- [Roadmap](ROADMAP.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security policy](SECURITY.md)
+- [Governance](GOVERNANCE.md)
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

agp_tpe-2.3.3/README.md

@@ -0,0 +1,169 @@
+# Agent Governance Protocol (AGP)
+
+**AGP is an experimental governance layer for multi-agent systems.**
+
+It defines how independent agents or authorities can propose, review, approve,
+reject, veto and audit high-impact decisions without trusting a single
+coordinator as the sole source of truth.
+
+> Status: experimental. AGP is not yet a production standard.
+
+
+
+## 120-Second Demo
+
+Run the public AGP demo with no external dependencies:
+
+    python3 examples/120_second_demo/demo.py
+
+Fast mode:
+
+    python3 examples/120_second_demo/demo.py --fast
+
+Valid governance path:
+
+    python3 examples/120_second_demo/demo.py --happy-path --fast
+
+The demo shows a coordinator changing a deployment payload after approval.
+A coordinator-trusting workflow accepts it because the approval count is still present.
+AGP rejects it because the approvals are bound to the exact approved input.
+
+[Read the demo documentation](examples/120_second_demo/README.md)
+
+## Whitepaper
+
+The current public review draft is:
+
+**AGP Whitepaper v0.9.2 — A Deterministic Governance Layer for Multi-Agent Systems**
+
+- [Read online](docs/whitepaper/AGP_Whitepaper_v0.9.2.md)
+- [Download PDF](https://github.com/agpprotocol/agp/releases/tag/whitepaper-v0.9.2)
+- [Submit technical feedback](https://github.com/agpprotocol/agp/issues/1)
+
+The whitepaper is experimental, is not a production standard, and has not yet received independent security review.
+
+## Why AGP?
+
+- **MCP** connects models to tools and data.
+- **A2A-style protocols** let agents communicate.
+- **Workflow engines** coordinate execution.
+- **AGP** governs collective decisions.
+
+A workflow can record that a deployment was approved. AGP additionally aims to
+make the authority snapshot, evidence, ballots, resolution and history
+independently verifiable.
+
+## Core properties
+
+- deterministic resolution;
+- canonical serialization;
+- independent Python and Go implementations;
+- Ed25519 signed envelopes;
+- replay, expiration and revocation checks;
+- append-only transparency log;
+- external audit receipts;
+- conformance and adversarial test vectors.
+
+## Architecture
+
+```mermaid
+flowchart LR
+    P[Proposal] --> E[Evidence]
+    E --> B[Signed ballots]
+    B --> R[Deterministic resolution]
+    R --> L[Transparency log]
+    L --> A[Independent audit]
+```
+
+## AGP vs. a conventional workflow
+
+| Property | Workflow | AGP |
+|---|---:|---:|
+| Coordinates steps | Yes | Yes |
+| Deterministic replay across implementations | Not inherent | Yes |
+| Signed authority actions | Optional/custom | Built into profile |
+| Evidence version validation | Optional/custom | Yes |
+| Revocation-aware decisions | Optional/custom | Yes |
+| Tamper-evident history | Optional/custom | Yes |
+| Independent audit without trusting coordinator | Not inherent | Yes |
+
+AGP is intentionally more complex. For low-risk internal automation, a
+conventional workflow is usually the better choice.
+
+## Reproducible results
+
+```text
+AGP v0.3 Conformance:          260/260 passed
+AGP v0.4 Signed Conformance:    10/10 passed
+AGP v0.5 Transparency:           8/8 passed
+AGP vs Workflow benchmark:       8/8 attacks detected by AGP
+```
+
+The workflow baseline in the benchmark detected 0/8 because it treated
+coordinator state as authoritative. This is a limited experimental benchmark,
+not a claim that all workflow engines are insecure.
+
+## Quick start
+
+Requirements:
+
+- Python 3.10+
+- Go 1.22+
+
+```bash
+git clone https://github.com/agpprotocol/agp.git
+cd agp
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements-v0.4.txt
+python3 run_benchmark_all.py
+```
+
+Expected final line:
+
+```text
+AGP BENCHMARK COMPLETE
+```
+
+## Repository map
+
+```text
+spec/           Conformance profile
+python/         Python resolver
+go/             Go resolver
+signed/         Signed envelope conformance
+transparency/   Append-only audit log
+benchmark/      AGP vs workflow experiment
+examples/       Reference scenarios
+docs/           Architecture, threat model and evaluation
+```
+
+## What AGP does not claim
+
+AGP does not:
+
+- replace authentication, authorization or IAM;
+- replace orchestration engines;
+- guarantee that evidence is factually true;
+- eliminate compromised members;
+- solve governance for every multi-agent system;
+- claim production maturity.
+
+## Current research question
+
+> Do high-impact multi-agent systems need a portable, independently verifiable
+> governance layer distinct from communication and orchestration?
+
+## Documentation
+
+- [Architecture](docs/ARCHITECTURE.md)
+- [Threat model](docs/THREAT_MODEL.md)
+- [Benchmark](docs/BENCHMARK.md)
+- [Roadmap](ROADMAP.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security policy](SECURITY.md)
+- [Governance](GOVERNANCE.md)
+
+## License
+
+Apache License 2.0. See [LICENSE](LICENSE).

agp_tpe-2.3.3/canonicalization/python/canonicalize.py

@@ -0,0 +1,293 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+MAX_INPUT_BYTES = 1_048_576
+MAX_DEPTH = 64
+MIN_SAFE_INTEGER = -(2**53 - 1)
+MAX_SAFE_INTEGER = 2**53 - 1
+
+
+class CanonicalizationError(ValueError):
+    def __init__(self, code: str, detail: str = "") -> None:
+        super().__init__(detail or code)
+        self.code = code
+        self.detail = detail
+
+
+def _reject_constant(value: str) -> Any:
+    raise CanonicalizationError("INVALID_NUMBER", value)
+
+
+def _parse_integer(value: str) -> int:
+    number = int(value, 10)
+    if number < MIN_SAFE_INTEGER or number > MAX_SAFE_INTEGER:
+        raise CanonicalizationError("INTEGER_OUT_OF_RANGE", value)
+    return number
+
+
+def _reject_decimal(value: str) -> Any:
+    raise CanonicalizationError("DECIMAL_NOT_SUPPORTED", value)
+
+
+def _normalize_string(value: str) -> str:
+    output: list[str] = []
+    index = 0
+
+    while index < len(value):
+        codepoint = ord(value[index])
+
+        if 0xD800 <= codepoint <= 0xDBFF:
+            if index + 1 >= len(value):
+                raise CanonicalizationError(
+                    "INVALID_UNICODE",
+                    f"unpaired high surrogate U+{codepoint:04X}",
+                )
+
+            low = ord(value[index + 1])
+            if not 0xDC00 <= low <= 0xDFFF:
+                raise CanonicalizationError(
+                    "INVALID_UNICODE",
+                    f"unpaired high surrogate U+{codepoint:04X}",
+                )
+
+            combined = (
+                0x10000
+                + ((codepoint - 0xD800) << 10)
+                + (low - 0xDC00)
+            )
+            output.append(chr(combined))
+            index += 2
+            continue
+
+        if 0xDC00 <= codepoint <= 0xDFFF:
+            raise CanonicalizationError(
+                "INVALID_UNICODE",
+                f"unpaired low surrogate U+{codepoint:04X}",
+            )
+
+        output.append(value[index])
+        index += 1
+
+    return "".join(output)
+
+
+def _normalize_value(value: Any) -> Any:
+    if isinstance(value, str):
+        return _normalize_string(value)
+
+    if isinstance(value, list):
+        return [_normalize_value(item) for item in value]
+
+    if isinstance(value, dict):
+        normalized: dict[str, Any] = {}
+        for key, item in value.items():
+            normalized_key = _normalize_string(key)
+            if normalized_key in normalized:
+                raise CanonicalizationError(
+                    "DUPLICATE_KEY",
+                    normalized_key,
+                )
+            normalized[normalized_key] = _normalize_value(item)
+        return normalized
+
+    return value
+
+
+def _object_from_pairs(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        normalized_key = _normalize_string(key)
+        if normalized_key in result:
+            raise CanonicalizationError("DUPLICATE_KEY", normalized_key)
+        result[normalized_key] = value
+    return result
+
+
+def _validate_string(value: str) -> None:
+    _normalize_string(value)
+
+
+def _validate_value(value: Any, depth: int = 0) -> None:
+    if depth > MAX_DEPTH:
+        raise CanonicalizationError("MAX_DEPTH_EXCEEDED")
+
+    if value is None or isinstance(value, bool):
+        return
+
+    if isinstance(value, int):
+        if value < MIN_SAFE_INTEGER or value > MAX_SAFE_INTEGER:
+            raise CanonicalizationError("INTEGER_OUT_OF_RANGE")
+        return
+
+    if isinstance(value, float):
+        raise CanonicalizationError("DECIMAL_NOT_SUPPORTED")
+
+    if isinstance(value, str):
+        _validate_string(value)
+        return
+
+    if isinstance(value, list):
+        for item in value:
+            _validate_value(item, depth + 1)
+        return
+
+    if isinstance(value, dict):
+        for key, item in value.items():
+            if not isinstance(key, str):
+                raise CanonicalizationError("NON_STRING_KEY")
+            _validate_string(key)
+            _validate_value(item, depth + 1)
+        return
+
+    raise CanonicalizationError("UNSUPPORTED_TYPE", type(value).__name__)
+
+
+def parse_json_bytes(raw: bytes) -> Any:
+    if len(raw) > MAX_INPUT_BYTES:
+        raise CanonicalizationError("INPUT_TOO_LARGE")
+
+    if raw.startswith(b"\xef\xbb\xbf"):
+        raise CanonicalizationError("UTF8_BOM_NOT_ALLOWED")
+
+    try:
+        text = raw.decode("utf-8", errors="strict")
+    except UnicodeDecodeError as error:
+        raise CanonicalizationError("INVALID_UTF8", str(error)) from error
+
+    try:
+        value = json.loads(
+            text,
+            object_pairs_hook=_object_from_pairs,
+            parse_int=_parse_integer,
+            parse_float=_reject_decimal,
+            parse_constant=_reject_constant,
+        )
+    except CanonicalizationError:
+        raise
+    except (json.JSONDecodeError, RecursionError) as error:
+        raise CanonicalizationError("INVALID_JSON", str(error)) from error
+
+    value = _normalize_value(value)
+    _validate_value(value)
+    return value
+
+
+def _escape_string(value: str) -> str:
+    _validate_string(value)
+    output: list[str] = ['"']
+
+    short_escapes = {
+        0x08: r"\b",
+        0x09: r"\t",
+        0x0A: r"\n",
+        0x0C: r"\f",
+        0x0D: r"\r",
+    }
+
+    for character in value:
+        codepoint = ord(character)
+
+        if character == '"':
+            output.append(r"\"")
+        elif character == "\\":
+            output.append(r"\\")
+        elif codepoint in short_escapes:
+            output.append(short_escapes[codepoint])
+        elif codepoint <= 0x1F:
+            output.append(f"\\u{codepoint:04x}")
+        else:
+            output.append(character)
+
+    output.append('"')
+    return "".join(output)
+
+
+def canonical_text(value: Any) -> str:
+    _validate_value(value)
+
+    if value is None:
+        return "null"
+
+    if value is True:
+        return "true"
+
+    if value is False:
+        return "false"
+
+    if isinstance(value, int):
+        return str(value)
+
+    if isinstance(value, str):
+        return _escape_string(value)
+
+    if isinstance(value, list):
+        return "[" + ",".join(canonical_text(item) for item in value) + "]"
+
+    if isinstance(value, dict):
+        entries = (
+            _escape_string(key) + ":" + canonical_text(value[key])
+            for key in sorted(value)
+        )
+        return "{" + ",".join(entries) + "}"
+
+    raise CanonicalizationError("UNSUPPORTED_TYPE", type(value).__name__)
+
+
+def canonical_bytes(value: Any) -> bytes:
+    return canonical_text(value).encode("utf-8")
+
+
+def sha256_digest(value: Any) -> str:
+    return "sha256:" + hashlib.sha256(canonical_bytes(value)).hexdigest()
+
+
+def make_receipt(raw: bytes) -> dict[str, Any]:
+    try:
+        value = parse_json_bytes(raw)
+        encoded = canonical_bytes(value)
+        return {
+            "accepted": True,
+            "canonical": encoded.decode("utf-8"),
+            "digest": "sha256:" + hashlib.sha256(encoded).hexdigest(),
+            "error_codes": [],
+        }
+    except CanonicalizationError as error:
+        return {
+            "accepted": False,
+            "canonical": None,
+            "digest": None,
+            "error_codes": [error.code],
+        }
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        print(
+            "usage: canonicalize.py INPUT.json OUTPUT.json",
+            file=sys.stderr,
+        )
+        return 2
+
+    source = Path(sys.argv[1])
+    target = Path(sys.argv[2])
+
+    try:
+        raw = source.read_bytes()
+    except OSError as error:
+        print(f"cannot read input: {error}", file=sys.stderr)
+        return 2
+
+    receipt = make_receipt(raw)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    target.write_bytes(canonical_bytes(receipt) + b"\n")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())