vouch-protocol 2.0.1__tar.gz → 2.1.0__tar.gz

{vouch_protocol-2.0.1/vouch_protocol.egg-info → vouch_protocol-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vouch-protocol
-Version: 2.0.1
+Version: 2.1.0
 Summary: The Identity & Reputation Standard for AI Agents
 Author-email: Vouch Protocol Contributors <hello@vouch-protocol.com>
 License: Apache License 2.0
@@ -236,7 +236,7 @@ Requires-Dist: pyyaml>=6.0; extra == "goose"
 Provides-Extra: autogen
 Requires-Dist: pyautogen>=0.2.0; extra == "autogen"
 Provides-Extra: mcp
-Requires-Dist: mcp>=0.1.0; extra == "mcp"
+Requires-Dist: mcp>=1.2.0; extra == "mcp"
 Provides-Extra: vertex
 Requires-Dist: google-cloud-aiplatform>=1.0.0; extra == "vertex"
 Provides-Extra: streamlit
@@ -265,6 +265,14 @@ Requires-Dist: Pillow>=10.0.0; extra == "media"
 Requires-Dist: base58>=2.1.0; extra == "media"
 Requires-Dist: qrcode>=7.4.0; extra == "media"
 Requires-Dist: c2pa-python>=0.5.0; extra == "media"
+Provides-Extra: openvla
+Requires-Dist: torch>=2.2.0; extra == "openvla"
+Requires-Dist: transformers==4.40.1; extra == "openvla"
+Requires-Dist: tokenizers==0.19.1; extra == "openvla"
+Requires-Dist: timm==0.9.10; extra == "openvla"
+Requires-Dist: accelerate>=0.25.0; extra == "openvla"
+Requires-Dist: huggingface-hub>=0.23.0; extra == "openvla"
+Requires-Dist: Pillow>=10.0.0; extra == "openvla"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
@@ -348,7 +356,7 @@ Vouch Protocol v1.0 aligns directly with the open standard:
 - **Verifiable Credentials** as the credential format (replacing v0.x JWS tokens).
 - **Data Integrity proofs** with the `eddsa-jcs-2022` cryptosuite (no JOSE, no Base64-wrapped payload, the credential remains human-readable JSON).
 - **Multikey verification methods** in DID Documents (algorithm-agnostic, ML-DSA-44 ready).
-- **Hybrid post-quantum profile** (`hybrid-eddsa-mldsa44-jcs-2026`) as an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
+- **Post-quantum profile** as a Data Integrity proof set: the credential carries two independent proofs, `eddsa-jcs-2022` and `mldsa44-jcs-2024`, an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
 - **Three-way cross-implementation interop** verified across Python, TypeScript, and Go.
 
 Credentials are issued with `Signer.sign()` and checked with `Verifier.verify()`. See the Specification at [vouch-protocol.com/specs/SPEC/](https://vouch-protocol.com/specs/SPEC/) for the full specification.
@@ -377,6 +385,7 @@ Vouch is not one tool, it is a set of them. Here is the whole map.
 - **Identity Sidecar** keeps signing keys out of the model's context, so a prompt injection cannot read them.
 - **Vouch Shield** a runtime check that inspects every tool call against your rules, like a customs officer at the door.
 - **Continuous trust** heartbeats and session vouchers, so trust is a live signal that has to be renewed, not a badge that is issued once and trusted forever.
+- **Authority freshness** a signed authority state with a counter that only goes up, so a state change (a fraud signal, a suspended mandate) collapses the acceptable freshness window to now for a high-consequence action, even when time-decay trust still passes. See [docs/authority-freshness.md](docs/authority-freshness.md).
 
 ### Framework integrations (new in v1.6.2)
 Standalone packages that drop Vouch into the agent framework you already use. Each one issues a verifiable credential for a tool call, with optional delegation back to a human principal.
@@ -394,7 +403,7 @@ The standalone **`vouch-mcp`** package above ships alongside these in v1.6.2.
 Python, TypeScript, and Go are the full reference implementations. A Rust core with idiomatic Swift, JVM (Java and Kotlin), .NET, and C wrappers shares one codebase, so every language produces byte-identical output, verified against shared test vectors. A WebAssembly build is included for the browser and the edge. See the table further down for status per language.
 
 ### Robots and embodied agents
-A robot is an agent with a body, so identity and accountability matter even more once it can cause physical harm. The `vouch.robotics` module ships six capabilities on the same `eddsa-jcs-2022` credentials as the rest of Vouch: hardware-rooted identity (bound to a TPM or secure element, so it cannot be cloned to other hardware), model and config provenance (re-signable on every OTA update), physical capability scope (force, speed, a tighter cap near humans, allowed zones, and shift windows, checked before each actuation, with narrow-only delegation), a robot-to-robot trust handshake, an encrypted tamper-evident black box with a verifiable kill switch, and a scannable offline passport. All six are implemented in Python, TypeScript, Go, and the Rust core, which flows to the Swift, Kotlin/JVM, .NET, C/C++, and WebAssembly wrappers, so a robotics credential signed in one language verifies in every other. Fourteen further capabilities round out the set: a living-trust heartbeat (a signed per-interval motion summary whose trust decays unless it is renewed in-envelope), two-level credential revocation (per-credential status lists and whole-DID kill), an accountable safety record (a tamper-evident incident ledger summarized into a portable signed record), signed perception provenance (each captured sensor frame's hash bound to the robot's key and hash-linked, so a robot can prove what its sensors saw and a substituted frame is detectable), an offline delegation lease (a short-lived, scope-bounded grant a disconnected robot verifies and acts on with no network call, nesting across vendors), a physical quorum (a cryptographic two-person rule requiring M of N attested approvers for a high-consequence action), lifecycle credentials (ownership transfer that chains into a verifiable chain of custody, key rotation that forms a key history, and a signed decommission that retires the robot), a regulatory conformance profile (a machine-checkable mapping from a robot's credentials to the clauses of ISO 10218 and 15066, the EU Machinery Regulation, the EU AI Act, and UL 3300, with a deterministic checker and a signed conformance attestation), post-quantum signing by default (robot credentials sign with the hybrid classical-plus-ML-DSA-44 cryptosuite, with backward-compatible verification, so a robot stays unforgeable across its decade-long life), and cross-embodiment identity continuity (an agent identity that moves between robot bodies, with an embodiment credential re-binding to each body's hardware root and a continuity chain that proves the same accountable agent persisted, plus a fork check), a physical custody handoff chain (a signed record of who accepted custody of a task or object at each hop across human and robot actors, so an incident traces to the exact hop and an attested condition localizes damage to the holder responsible), bounded infrastructure access (an operator-signed grant naming a resource, its permitted operations, an optional zone, and a time window, which a robot pairs with a signed request the resource authorizes offline, so a robot can open a door or dock at a charger with a tamper-evident, attributable, shrink-only record), fused-sensor provenance (a signed attestation binding a robot's fused world model to the exact set of input frame hashes and the fusion method that produced it, so a manipulated fusion result or a dropped input is detectable and every fused input traces to a frame the robot recorded), and wear and degradation attestation (a robot signs its own wear level bound to its identity and hash-linked over time, and a deterministic rule narrows its physical capability scope as it degrades, so a worn robot operates inside a tighter, verifiable envelope than the static limit it shipped with), implemented across the same languages and pinned by the shared interop vector. See [docs/robotics.md](docs/robotics.md) and the defensive disclosures PAD-064 through PAD-070, PAD-076 through PAD-084, and PAD-087 through PAD-092.
+A robot is an agent with a body, so identity and accountability matter even more once it can cause physical harm. The `vouch.robotics` module ships six capabilities on the same `eddsa-jcs-2022` credentials as the rest of Vouch: hardware-rooted identity (bound to a TPM or secure element, so it cannot be cloned to other hardware), model and config provenance (re-signable on every OTA update), physical capability scope (force, speed, a tighter cap near humans, allowed zones, and shift windows, checked before each actuation, with narrow-only delegation), a robot-to-robot trust handshake, an encrypted tamper-evident black box with a verifiable kill switch, and a scannable offline passport. All six are implemented in Python, TypeScript, Go, and the Rust core, which flows to the Swift, Kotlin/JVM, .NET, C/C++, and WebAssembly wrappers, so a robotics credential signed in one language verifies in every other. Fifteen further capabilities round out the set: a living-trust heartbeat (a signed per-interval motion summary whose trust decays unless it is renewed in-envelope), two-level credential revocation (per-credential status lists and whole-DID kill), an accountable safety record (a tamper-evident incident ledger summarized into a portable signed record), signed perception provenance (each captured sensor frame's hash bound to the robot's key and hash-linked, so a robot can prove what its sensors saw and a substituted frame is detectable), an offline delegation lease (a short-lived, scope-bounded grant a disconnected robot verifies and acts on with no network call, nesting across vendors), a physical quorum (a cryptographic two-person rule requiring M of N attested approvers for a high-consequence action), lifecycle credentials (ownership transfer that chains into a verifiable chain of custody, key rotation that forms a key history, and a signed decommission that retires the robot), a regulatory conformance profile (a machine-checkable mapping from a robot's credentials to the clauses of ISO 10218 and 15066, the EU Machinery Regulation, the EU AI Act, and UL 3300, with a deterministic checker and a signed conformance attestation), post-quantum signing by default (robot credentials carry a proof set with an Ed25519 proof and an ML-DSA-44 proof, with backward-compatible verification, so a robot stays unforgeable across its decade-long life), and cross-embodiment identity continuity (an agent identity that moves between robot bodies, with an embodiment credential re-binding to each body's hardware root and a continuity chain that proves the same accountable agent persisted, plus a fork check), a physical custody handoff chain (a signed record of who accepted custody of a task or object at each hop across human and robot actors, so an incident traces to the exact hop and an attested condition localizes damage to the holder responsible), bounded infrastructure access (an operator-signed grant naming a resource, its permitted operations, an optional zone, and a time window, which a robot pairs with a signed request the resource authorizes offline, so a robot can open a door or dock at a charger with a tamper-evident, attributable, shrink-only record), fused-sensor provenance (a signed attestation binding a robot's fused world model to the exact set of input frame hashes and the fusion method that produced it, so a manipulated fusion result or a dropped input is detectable and every fused input traces to a frame the robot recorded), wear and degradation attestation (a robot signs its own wear level bound to its identity and hash-linked over time, and a deterministic rule narrows its physical capability scope as it degrades, so a worn robot operates inside a tighter, verifiable envelope than the static limit it shipped with), and bystander-consent evidence (a robot binds the basis for capturing people, an explicit token, posted notice, a legitimate interest, or a redaction it applied, to the capture itself by its hash, holding only hashes and never anyone's identifying data, and a bystander can sign consent bound to one capture so it cannot be replayed to another), implemented across the same languages and pinned by the shared interop vector. See [docs/robotics.md](docs/robotics.md) and the defensive disclosures PAD-064 through PAD-070, PAD-076 through PAD-084, and PAD-087 through PAD-094.
 
 ### Inside your AI tools
 - **Claude Skill**, **OpenAI Custom GPT**, and **Gemini Gem** packages that teach your AI assistant how to add Vouch to your code, running on your own AI subscription.
@@ -440,7 +449,7 @@ AI agents are making real-world API calls with **ZERO cryptographic proof** of:
 - **Data Integrity proofs** (`eddsa-jcs-2022` cryptosuite, no JOSE/JWS dependency)
 - **Decentralized Identifiers** (`did:web`, `did:key`)
 - **Multikey verification methods** (algorithm-agnostic, post-quantum ready)
-- **Hybrid post-quantum profile** (optional Ed25519 + ML-DSA-44 composite, `hybrid-eddsa-mldsa44-jcs-2026`)
+- **Post-quantum profile** (optional proof set: `eddsa-jcs-2022` + `mldsa44-jcs-2024`)
 - **Human-readable JSON** (proof attaches as a sibling object, no Base64-wrapped opaque payload)
 - **Framework-agnostic** (works with MCP, LangChain, CrewAI, AutoGPT, AutoGen, Vertex AI)
 - **Cross-language interop** (Python, TypeScript, Go, byte-identical canonical form)
@@ -491,15 +500,15 @@ flowchart TB
   subgraph CRYPTO["Cryptographic Proof"]
     JCS["JCS canonicalization (RFC 8785)"]
     DEFAULT["eddsa-jcs-2022<br/>(Ed25519, default)"]
-    HYBRID["hybrid-eddsa-mldsa44-jcs-2026<br/>(Ed25519 + ML-DSA-44, optional)"]
+    PQ["mldsa44-jcs-2024<br/>(ML-DSA-44, optional second proof)"]
   end
   IDENTITY --> FORMAT
   FORMAT --> CRYPTO
   JCS --> DEFAULT
-  JCS --> HYBRID
+  JCS --> PQ
 ```
 
-**Trust = Verifiable Credentials + Data Integrity + Decentralized Identifiers + Multikey, with optional hybrid post-quantum signatures.** The same math that secures SSL/TLS, plus the standardized primitives that secure verifiable credentials elsewhere on the web, applied to AI agents.
+**Trust = Verifiable Credentials + Data Integrity + Decentralized Identifiers + Multikey, with an optional post-quantum proof set.** The same math that secures SSL/TLS, plus the standardized primitives that secure verifiable credentials elsewhere on the web, applied to AI agents.
 
 ---
 
@@ -515,7 +524,7 @@ flowchart TB
 | **Audit trail format** | ✅ (VC standardized) | ❌ (custom) |
 | **standards-aligned** | ✅ (`eddsa-jcs-2022` Data Integrity) | ❌ |
 | **Multikey verification methods** | ✅ (algorithm-agnostic) | ❌ |
-| **Hybrid post-quantum signatures** | ✅ (`hybrid-eddsa-mldsa44-jcs-2026`) | ❌ |
+| **Post-quantum signatures** | ✅ (`mldsa44-jcs-2024` proof set) | ❌ |
 | **Cross-implementation interop tests** | ✅ (Python, TypeScript, Go) | ❌ |
 | **Security best practices** | ✅ (built-in) | ⚠️ (easy to mess up) |
 
@@ -612,18 +621,19 @@ Works with all major AI frameworks out-of-the-box:
 - **Reputation Scoring**: track agent behavior over time
 - **Revocation Registry**: blacklist compromised keys
 - **Redis Caching**: production-scale verification
-- **Hybrid Post-Quantum Profile**: optional Ed25519 + ML-DSA-44 composite signatures (`hybrid-eddsa-mldsa44-jcs-2026`) for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 migration timelines
+- **Post-Quantum Profile**: an optional proof set carrying an `eddsa-jcs-2022` proof and an `mldsa44-jcs-2024` proof for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 migration timelines
 
-### Hybrid Post-Quantum Example
+### Post-Quantum Example
 
 ```python
-# Optional v1.0 profile, requires `pip install pqcrypto`
+# Optional profile, requires `pip install pqcrypto`
 credential = signer.sign_hybrid(intent={
   'action': 'submit_clinical_finding',
   'target': 'trial:NCT00000001',
   'resource': 'https://fda-submissions.example.com/api/findings',
 })
-# Carries both Ed25519 and ML-DSA-44 signatures over the same JCS canonical form.
+# The credential's `proof` is an array of two independent Data Integrity proofs,
+# eddsa-jcs-2022 and mldsa44-jcs-2024, over the same document.
 # Verification REQUIRES both to validate.
 ```
 
@@ -668,7 +678,7 @@ To keep this space free from patent capture, the project publishes **61 defensiv
 
 - [Quick Start](https://github.com/vouch-protocol/vouch#quick-start)
 - [Vouch Specification (v1.6 normative)](https://vouch-protocol.com/specs/)
-- [Hybrid Post-Quantum Implementation Guide](https://github.com/vouch-protocol/vouch/blob/main/docs/hybrid-pq-implementation-guide.md)
+- [Post-Quantum Implementation Guide](https://github.com/vouch-protocol/vouch/blob/main/docs/hybrid-pq-implementation-guide.md)
 - [Protocol Specification (developer guide)](https://github.com/vouch-protocol/vouch/blob/main/docs/vouch_guide.md)
 - [Integration Guides](https://github.com/vouch-protocol/vouch/tree/main/vouch/integrations)
 - [Threat Model and Security Considerations](https://github.com/vouch-protocol/vouch/blob/main/docs/THREAT_MODEL.md)
@@ -691,7 +701,7 @@ To keep this space free from patent capture, the project publishes **61 defensiv
 
 - [x] **Verifiable Credentials + Data Integrity** (`eddsa-jcs-2022` cryptosuite)
 - [x] **Multikey verification methods** (algorithm-agnostic, multibase + multicodec)
-- [x] **Hybrid post-quantum profile** (`hybrid-eddsa-mldsa44-jcs-2026`, NIST CNSA 2.0 / NSM-10 aligned)
+- [x] **Post-quantum profile** (`eddsa-jcs-2022` + `mldsa44-jcs-2024` proof set, NIST CNSA 2.0 / NSM-10 aligned)
 - [x] **Three-language reference implementation** (Python, TypeScript, Go) with byte-identical canonical form via RFC 8785 JCS, verified against shared test vectors
 - [x] **Specification drafted** and submitted to the open standards group for incubation
 - [x] **55 Prior Art Disclosures** (CC0 defensive publications)
@@ -753,7 +763,7 @@ Contributions welcome. See [CONTRIBUTING.md](https://github.com/vouch-protocol/v
 
 **Areas where help is most useful:**
 - [ ] Additional framework integrations (Haystack, Semantic Kernel, LlamaIndex, others)
-- [ ] Cross-implementation interop test vectors (additional edge cases for JCS, VC, hybrid PQ)
+- [ ] Cross-implementation interop test vectors (additional edge cases for JCS, VC, post-quantum proof sets)
 - [ ] Tutorials and worked examples for regulated-sector deployments
 - [ ] Independent security review and audit
 - [ ] Reference implementations in additional languages (Rust, Java, .NET)

{vouch_protocol-2.0.1 → vouch_protocol-2.1.0}/README.md

@@ -66,7 +66,7 @@ Vouch Protocol v1.0 aligns directly with the open standard:
 - **Verifiable Credentials** as the credential format (replacing v0.x JWS tokens).
 - **Data Integrity proofs** with the `eddsa-jcs-2022` cryptosuite (no JOSE, no Base64-wrapped payload, the credential remains human-readable JSON).
 - **Multikey verification methods** in DID Documents (algorithm-agnostic, ML-DSA-44 ready).
-- **Hybrid post-quantum profile** (`hybrid-eddsa-mldsa44-jcs-2026`) as an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
+- **Post-quantum profile** as a Data Integrity proof set: the credential carries two independent proofs, `eddsa-jcs-2022` and `mldsa44-jcs-2024`, an optional add-on for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 timelines.
 - **Three-way cross-implementation interop** verified across Python, TypeScript, and Go.
 
 Credentials are issued with `Signer.sign()` and checked with `Verifier.verify()`. See the Specification at [vouch-protocol.com/specs/SPEC/](https://vouch-protocol.com/specs/SPEC/) for the full specification.
@@ -95,6 +95,7 @@ Vouch is not one tool, it is a set of them. Here is the whole map.
 - **Identity Sidecar** keeps signing keys out of the model's context, so a prompt injection cannot read them.
 - **Vouch Shield** a runtime check that inspects every tool call against your rules, like a customs officer at the door.
 - **Continuous trust** heartbeats and session vouchers, so trust is a live signal that has to be renewed, not a badge that is issued once and trusted forever.
+- **Authority freshness** a signed authority state with a counter that only goes up, so a state change (a fraud signal, a suspended mandate) collapses the acceptable freshness window to now for a high-consequence action, even when time-decay trust still passes. See [docs/authority-freshness.md](docs/authority-freshness.md).
 
 ### Framework integrations (new in v1.6.2)
 Standalone packages that drop Vouch into the agent framework you already use. Each one issues a verifiable credential for a tool call, with optional delegation back to a human principal.
@@ -112,7 +113,7 @@ The standalone **`vouch-mcp`** package above ships alongside these in v1.6.2.
 Python, TypeScript, and Go are the full reference implementations. A Rust core with idiomatic Swift, JVM (Java and Kotlin), .NET, and C wrappers shares one codebase, so every language produces byte-identical output, verified against shared test vectors. A WebAssembly build is included for the browser and the edge. See the table further down for status per language.
 
 ### Robots and embodied agents
-A robot is an agent with a body, so identity and accountability matter even more once it can cause physical harm. The `vouch.robotics` module ships six capabilities on the same `eddsa-jcs-2022` credentials as the rest of Vouch: hardware-rooted identity (bound to a TPM or secure element, so it cannot be cloned to other hardware), model and config provenance (re-signable on every OTA update), physical capability scope (force, speed, a tighter cap near humans, allowed zones, and shift windows, checked before each actuation, with narrow-only delegation), a robot-to-robot trust handshake, an encrypted tamper-evident black box with a verifiable kill switch, and a scannable offline passport. All six are implemented in Python, TypeScript, Go, and the Rust core, which flows to the Swift, Kotlin/JVM, .NET, C/C++, and WebAssembly wrappers, so a robotics credential signed in one language verifies in every other. Fourteen further capabilities round out the set: a living-trust heartbeat (a signed per-interval motion summary whose trust decays unless it is renewed in-envelope), two-level credential revocation (per-credential status lists and whole-DID kill), an accountable safety record (a tamper-evident incident ledger summarized into a portable signed record), signed perception provenance (each captured sensor frame's hash bound to the robot's key and hash-linked, so a robot can prove what its sensors saw and a substituted frame is detectable), an offline delegation lease (a short-lived, scope-bounded grant a disconnected robot verifies and acts on with no network call, nesting across vendors), a physical quorum (a cryptographic two-person rule requiring M of N attested approvers for a high-consequence action), lifecycle credentials (ownership transfer that chains into a verifiable chain of custody, key rotation that forms a key history, and a signed decommission that retires the robot), a regulatory conformance profile (a machine-checkable mapping from a robot's credentials to the clauses of ISO 10218 and 15066, the EU Machinery Regulation, the EU AI Act, and UL 3300, with a deterministic checker and a signed conformance attestation), post-quantum signing by default (robot credentials sign with the hybrid classical-plus-ML-DSA-44 cryptosuite, with backward-compatible verification, so a robot stays unforgeable across its decade-long life), and cross-embodiment identity continuity (an agent identity that moves between robot bodies, with an embodiment credential re-binding to each body's hardware root and a continuity chain that proves the same accountable agent persisted, plus a fork check), a physical custody handoff chain (a signed record of who accepted custody of a task or object at each hop across human and robot actors, so an incident traces to the exact hop and an attested condition localizes damage to the holder responsible), bounded infrastructure access (an operator-signed grant naming a resource, its permitted operations, an optional zone, and a time window, which a robot pairs with a signed request the resource authorizes offline, so a robot can open a door or dock at a charger with a tamper-evident, attributable, shrink-only record), fused-sensor provenance (a signed attestation binding a robot's fused world model to the exact set of input frame hashes and the fusion method that produced it, so a manipulated fusion result or a dropped input is detectable and every fused input traces to a frame the robot recorded), and wear and degradation attestation (a robot signs its own wear level bound to its identity and hash-linked over time, and a deterministic rule narrows its physical capability scope as it degrades, so a worn robot operates inside a tighter, verifiable envelope than the static limit it shipped with), implemented across the same languages and pinned by the shared interop vector. See [docs/robotics.md](docs/robotics.md) and the defensive disclosures PAD-064 through PAD-070, PAD-076 through PAD-084, and PAD-087 through PAD-092.
+A robot is an agent with a body, so identity and accountability matter even more once it can cause physical harm. The `vouch.robotics` module ships six capabilities on the same `eddsa-jcs-2022` credentials as the rest of Vouch: hardware-rooted identity (bound to a TPM or secure element, so it cannot be cloned to other hardware), model and config provenance (re-signable on every OTA update), physical capability scope (force, speed, a tighter cap near humans, allowed zones, and shift windows, checked before each actuation, with narrow-only delegation), a robot-to-robot trust handshake, an encrypted tamper-evident black box with a verifiable kill switch, and a scannable offline passport. All six are implemented in Python, TypeScript, Go, and the Rust core, which flows to the Swift, Kotlin/JVM, .NET, C/C++, and WebAssembly wrappers, so a robotics credential signed in one language verifies in every other. Fifteen further capabilities round out the set: a living-trust heartbeat (a signed per-interval motion summary whose trust decays unless it is renewed in-envelope), two-level credential revocation (per-credential status lists and whole-DID kill), an accountable safety record (a tamper-evident incident ledger summarized into a portable signed record), signed perception provenance (each captured sensor frame's hash bound to the robot's key and hash-linked, so a robot can prove what its sensors saw and a substituted frame is detectable), an offline delegation lease (a short-lived, scope-bounded grant a disconnected robot verifies and acts on with no network call, nesting across vendors), a physical quorum (a cryptographic two-person rule requiring M of N attested approvers for a high-consequence action), lifecycle credentials (ownership transfer that chains into a verifiable chain of custody, key rotation that forms a key history, and a signed decommission that retires the robot), a regulatory conformance profile (a machine-checkable mapping from a robot's credentials to the clauses of ISO 10218 and 15066, the EU Machinery Regulation, the EU AI Act, and UL 3300, with a deterministic checker and a signed conformance attestation), post-quantum signing by default (robot credentials carry a proof set with an Ed25519 proof and an ML-DSA-44 proof, with backward-compatible verification, so a robot stays unforgeable across its decade-long life), and cross-embodiment identity continuity (an agent identity that moves between robot bodies, with an embodiment credential re-binding to each body's hardware root and a continuity chain that proves the same accountable agent persisted, plus a fork check), a physical custody handoff chain (a signed record of who accepted custody of a task or object at each hop across human and robot actors, so an incident traces to the exact hop and an attested condition localizes damage to the holder responsible), bounded infrastructure access (an operator-signed grant naming a resource, its permitted operations, an optional zone, and a time window, which a robot pairs with a signed request the resource authorizes offline, so a robot can open a door or dock at a charger with a tamper-evident, attributable, shrink-only record), fused-sensor provenance (a signed attestation binding a robot's fused world model to the exact set of input frame hashes and the fusion method that produced it, so a manipulated fusion result or a dropped input is detectable and every fused input traces to a frame the robot recorded), wear and degradation attestation (a robot signs its own wear level bound to its identity and hash-linked over time, and a deterministic rule narrows its physical capability scope as it degrades, so a worn robot operates inside a tighter, verifiable envelope than the static limit it shipped with), and bystander-consent evidence (a robot binds the basis for capturing people, an explicit token, posted notice, a legitimate interest, or a redaction it applied, to the capture itself by its hash, holding only hashes and never anyone's identifying data, and a bystander can sign consent bound to one capture so it cannot be replayed to another), implemented across the same languages and pinned by the shared interop vector. See [docs/robotics.md](docs/robotics.md) and the defensive disclosures PAD-064 through PAD-070, PAD-076 through PAD-084, and PAD-087 through PAD-094.
 
 ### Inside your AI tools
 - **Claude Skill**, **OpenAI Custom GPT**, and **Gemini Gem** packages that teach your AI assistant how to add Vouch to your code, running on your own AI subscription.
@@ -158,7 +159,7 @@ AI agents are making real-world API calls with **ZERO cryptographic proof** of:
 - **Data Integrity proofs** (`eddsa-jcs-2022` cryptosuite, no JOSE/JWS dependency)
 - **Decentralized Identifiers** (`did:web`, `did:key`)
 - **Multikey verification methods** (algorithm-agnostic, post-quantum ready)
-- **Hybrid post-quantum profile** (optional Ed25519 + ML-DSA-44 composite, `hybrid-eddsa-mldsa44-jcs-2026`)
+- **Post-quantum profile** (optional proof set: `eddsa-jcs-2022` + `mldsa44-jcs-2024`)
 - **Human-readable JSON** (proof attaches as a sibling object, no Base64-wrapped opaque payload)
 - **Framework-agnostic** (works with MCP, LangChain, CrewAI, AutoGPT, AutoGen, Vertex AI)
 - **Cross-language interop** (Python, TypeScript, Go, byte-identical canonical form)
@@ -209,15 +210,15 @@ flowchart TB
   subgraph CRYPTO["Cryptographic Proof"]
     JCS["JCS canonicalization (RFC 8785)"]
     DEFAULT["eddsa-jcs-2022<br/>(Ed25519, default)"]
-    HYBRID["hybrid-eddsa-mldsa44-jcs-2026<br/>(Ed25519 + ML-DSA-44, optional)"]
+    PQ["mldsa44-jcs-2024<br/>(ML-DSA-44, optional second proof)"]
   end
   IDENTITY --> FORMAT
   FORMAT --> CRYPTO
   JCS --> DEFAULT
-  JCS --> HYBRID
+  JCS --> PQ
 ```
 
-**Trust = Verifiable Credentials + Data Integrity + Decentralized Identifiers + Multikey, with optional hybrid post-quantum signatures.** The same math that secures SSL/TLS, plus the standardized primitives that secure verifiable credentials elsewhere on the web, applied to AI agents.
+**Trust = Verifiable Credentials + Data Integrity + Decentralized Identifiers + Multikey, with an optional post-quantum proof set.** The same math that secures SSL/TLS, plus the standardized primitives that secure verifiable credentials elsewhere on the web, applied to AI agents.
 
 ---
 
@@ -233,7 +234,7 @@ flowchart TB
 | **Audit trail format** | ✅ (VC standardized) | ❌ (custom) |
 | **standards-aligned** | ✅ (`eddsa-jcs-2022` Data Integrity) | ❌ |
 | **Multikey verification methods** | ✅ (algorithm-agnostic) | ❌ |
-| **Hybrid post-quantum signatures** | ✅ (`hybrid-eddsa-mldsa44-jcs-2026`) | ❌ |
+| **Post-quantum signatures** | ✅ (`mldsa44-jcs-2024` proof set) | ❌ |
 | **Cross-implementation interop tests** | ✅ (Python, TypeScript, Go) | ❌ |
 | **Security best practices** | ✅ (built-in) | ⚠️ (easy to mess up) |
 
@@ -330,18 +331,19 @@ Works with all major AI frameworks out-of-the-box:
 - **Reputation Scoring**: track agent behavior over time
 - **Revocation Registry**: blacklist compromised keys
 - **Redis Caching**: production-scale verification
-- **Hybrid Post-Quantum Profile**: optional Ed25519 + ML-DSA-44 composite signatures (`hybrid-eddsa-mldsa44-jcs-2026`) for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 migration timelines
+- **Post-Quantum Profile**: an optional proof set carrying an `eddsa-jcs-2022` proof and an `mldsa44-jcs-2024` proof for regulated deployments aligning with NIST CNSA 2.0 / NSM-10 migration timelines
 
-### Hybrid Post-Quantum Example
+### Post-Quantum Example
 
 ```python
-# Optional v1.0 profile, requires `pip install pqcrypto`
+# Optional profile, requires `pip install pqcrypto`
 credential = signer.sign_hybrid(intent={
   'action': 'submit_clinical_finding',
   'target': 'trial:NCT00000001',
   'resource': 'https://fda-submissions.example.com/api/findings',
 })
-# Carries both Ed25519 and ML-DSA-44 signatures over the same JCS canonical form.
+# The credential's `proof` is an array of two independent Data Integrity proofs,
+# eddsa-jcs-2022 and mldsa44-jcs-2024, over the same document.
 # Verification REQUIRES both to validate.
 ```
 
@@ -386,7 +388,7 @@ To keep this space free from patent capture, the project publishes **61 defensiv
 
 - [Quick Start](https://github.com/vouch-protocol/vouch#quick-start)
 - [Vouch Specification (v1.6 normative)](https://vouch-protocol.com/specs/)
-- [Hybrid Post-Quantum Implementation Guide](https://github.com/vouch-protocol/vouch/blob/main/docs/hybrid-pq-implementation-guide.md)
+- [Post-Quantum Implementation Guide](https://github.com/vouch-protocol/vouch/blob/main/docs/hybrid-pq-implementation-guide.md)
 - [Protocol Specification (developer guide)](https://github.com/vouch-protocol/vouch/blob/main/docs/vouch_guide.md)
 - [Integration Guides](https://github.com/vouch-protocol/vouch/tree/main/vouch/integrations)
 - [Threat Model and Security Considerations](https://github.com/vouch-protocol/vouch/blob/main/docs/THREAT_MODEL.md)
@@ -409,7 +411,7 @@ To keep this space free from patent capture, the project publishes **61 defensiv
 
 - [x] **Verifiable Credentials + Data Integrity** (`eddsa-jcs-2022` cryptosuite)
 - [x] **Multikey verification methods** (algorithm-agnostic, multibase + multicodec)
-- [x] **Hybrid post-quantum profile** (`hybrid-eddsa-mldsa44-jcs-2026`, NIST CNSA 2.0 / NSM-10 aligned)
+- [x] **Post-quantum profile** (`eddsa-jcs-2022` + `mldsa44-jcs-2024` proof set, NIST CNSA 2.0 / NSM-10 aligned)
 - [x] **Three-language reference implementation** (Python, TypeScript, Go) with byte-identical canonical form via RFC 8785 JCS, verified against shared test vectors
 - [x] **Specification drafted** and submitted to the open standards group for incubation
 - [x] **55 Prior Art Disclosures** (CC0 defensive publications)
@@ -471,7 +473,7 @@ Contributions welcome. See [CONTRIBUTING.md](https://github.com/vouch-protocol/v
 
 **Areas where help is most useful:**
 - [ ] Additional framework integrations (Haystack, Semantic Kernel, LlamaIndex, others)
-- [ ] Cross-implementation interop test vectors (additional edge cases for JCS, VC, hybrid PQ)
+- [ ] Cross-implementation interop test vectors (additional edge cases for JCS, VC, post-quantum proof sets)
 - [ ] Tutorials and worked examples for regulated-sector deployments
 - [ ] Independent security review and audit
 - [ ] Reference implementations in additional languages (Rust, Java, .NET)

{vouch_protocol-2.0.1 → vouch_protocol-2.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vouch-protocol"
-version = "2.0.1"
+version = "2.1.0"
 description = "The Identity & Reputation Standard for AI Agents"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -32,8 +32,9 @@ dependencies = [
     "cryptography",
     "pydantic>=2.0.0",
     "httpx>=0.24.0",
-    # Hybrid post-quantum profile (Specification 13.2; W3C-aligned cryptosuite
-    # `hybrid-eddsa-mldsa44-jcs-2026`). Bundled by default: pqcrypto ships
+    # Post-quantum profile (Specification 13.2): a Data Integrity proof set,
+    # an `eddsa-jcs-2022` proof plus an `mldsa44-jcs-2024` proof on the same
+    # credential. Bundled by default: pqcrypto ships
     # prebuilt wheels for all mainstream platforms (~80 KB, no compiler needed)
     # and the PQ story is core to Vouch, so we do not gate it behind an extra.
     "pqcrypto>=0.4.0",
@@ -46,7 +47,9 @@ crewai = ["crewai>=0.1.0"]
 langgraph = ["langgraph>=0.1.0"]
 goose = ["pyyaml>=6.0"]
 autogen = ["pyautogen>=0.2.0"]
-mcp = ["mcp>=0.1.0"]
+# mcp 1.2 is the first release with the FastMCP high-level API; the server
+# also supports mcp 2.x (the 2026-07-28 stateless protocol revision).
+mcp = ["mcp>=1.2.0"]
 vertex = ["google-cloud-aiplatform>=1.0.0"]
 streamlit = ["streamlit>=1.0.0"]
 
@@ -67,7 +70,7 @@ aws = ["aioboto3>=12.0.0"]
 gcp = ["google-cloud-kms>=2.0.0"]
 azure = ["azure-keyvault-keys>=4.0.0"]
 
-# Hybrid post-quantum profile is now bundled by default (see required
+# The post-quantum profile is bundled by default (see required
 # `dependencies` above). The `pq` extra is retained as a no-op alias so
 # `pip install 'vouch-protocol[pq]'` keeps working for anyone who already
 # wrote that into a Dockerfile or requirements.txt.
@@ -93,6 +96,23 @@ media = [
     "c2pa-python>=0.5.0",
 ]
 
+# Real vision-language-action model (OpenVLA, open weights) for
+# examples/robotics_openvla_gated_loop.py. Heavy: torch plus a ~16 GB 7B
+# checkpoint, so it is never installed by default and is deliberately left out
+# of `all` -- CI exercises the example's skip path instead. transformers,
+# tokenizers, and timm are pinned to the versions OpenVLA's model card
+# specifies, because the checkpoint ships its own modelling code
+# (trust_remote_code) that is written against exactly those APIs.
+openvla = [
+    "torch>=2.2.0",
+    "transformers==4.40.1",
+    "tokenizers==0.19.1",
+    "timm==0.9.10",
+    "accelerate>=0.25.0",
+    "huggingface-hub>=0.23.0",
+    "Pillow>=10.0.0",
+]
+
 # Development dependencies
 dev = [
     "pytest>=7.0.0",

vouch_protocol-2.1.0/tests/test_agent_enroll.py

@@ -0,0 +1,302 @@
+"""
+Tests for the portable identity bundle and the one-command enroll and
+root-anchored verify flow.
+
+Covers the library layer (build_identity_bundle + verify_bundle, happy path and
+a wrong pinned root) and the CLI (`vouch agent enroll` produces a bundle that
+`vouch agent verify` accepts against the correct root and rejects against a
+wrong one). Everything runs offline with did:key identities and a temp keystore,
+no network and no passphrase prompts.
+"""
+
+import json
+import types
+
+import pytest
+
+from vouch import cli
+from vouch.keys import KeyManager
+from vouch.signer import Signer
+from vouch.root_of_trust import (
+    ACTION_ISSUE_AGENT_IDENTITY,
+    IDENTITY_BUNDLE_TYPE,
+    build_agent_identity,
+    build_identity_bundle,
+    build_recognized_issuer,
+    build_root_of_trust,
+    generate_did_key_identity,
+    verify_bundle,
+)
+
+
+def _signer():
+    """A fresh did:key signer."""
+    return Signer.from_keypair(generate_did_key_identity())
+
+
+def _read(path):
+    with open(path, "r") as f:
+        return json.load(f)
+
+
+@pytest.fixture
+def temp_keystore(tmp_path, monkeypatch):
+    """Point KeyManager at a temp directory for the duration of a test."""
+    key_dir = str(tmp_path / "keys")
+    orig_init = KeyManager.__init__
+    monkeypatch.setattr(
+        KeyManager, "__init__", lambda self, key_dir=key_dir: orig_init(self, key_dir)
+    )
+    return tmp_path
+
+
+# ---------------------------------------------------------------------------
+# Library: build_identity_bundle + verify_bundle
+# ---------------------------------------------------------------------------
+
+
+def test_bundle_happy_path():
+    """Root recognizes issuer, issuer attests agent, bundle verifies to root."""
+    root = _signer()
+    issuer = _signer()
+    agent = _signer()
+
+    root_cred = build_root_of_trust(root, name="Vouch Machine Identity Root")
+    recognition = build_recognized_issuer(
+        root, issuer_did=issuer.did, recognized_actions=[ACTION_ISSUE_AGENT_IDENTITY]
+    )
+    identity = build_agent_identity(
+        issuer,
+        subject_did=agent.did,
+        attributes={"owner": "Acme", "model": "gpt-x", "capabilityClass": "shopping"},
+    )
+    action = agent.sign(
+        intent={"action": "buy", "target": "store", "resource": "https://store.example/item/1"}
+    )
+
+    bundle = build_identity_bundle(
+        identity=identity, recognition=recognition, action=action, root=root_cred
+    )
+    assert bundle["type"] == IDENTITY_BUNDLE_TYPE
+    assert bundle["vouchVersion"] == "1.0"
+    assert bundle["identity"] == identity
+    assert bundle["recognizedIssuer"] == recognition
+    assert bundle["action"] == action
+    assert bundle["root"] == root_cred
+
+    result = verify_bundle(bundle, trusted_root=root.did)
+    assert result.ok
+    assert result.agent_did == agent.did
+    assert result.issuer_did == issuer.did
+    assert result.root_did == root.did
+    assert result.attributes == {
+        "owner": "Acme",
+        "model": "gpt-x",
+        "capabilityClass": "shopping",
+    }
+    assert result.action is not None
+
+
+def test_bundle_omits_optional_keys_when_none():
+    root = _signer()
+    issuer = _signer()
+    agent = _signer()
+    recognition = build_recognized_issuer(root, issuer_did=issuer.did)
+    identity = build_agent_identity(issuer, subject_did=agent.did, attributes={"owner": "Acme"})
+
+    bundle = build_identity_bundle(identity=identity, recognition=recognition)
+    assert "action" not in bundle
+    assert "root" not in bundle
+    assert verify_bundle(bundle, trusted_root=root.did).ok
+
+
+def test_bundle_wrong_root_rejected():
+    """A bundle pinned to a root the verifier does not trust is rejected."""
+    root = _signer()
+    issuer = _signer()
+    agent = _signer()
+    recognition = build_recognized_issuer(root, issuer_did=issuer.did)
+    identity = build_agent_identity(issuer, subject_did=agent.did, attributes={"owner": "Acme"})
+    bundle = build_identity_bundle(identity=identity, recognition=recognition)
+
+    wrong_root = _signer()
+    result = verify_bundle(bundle, trusted_root=wrong_root.did)
+    assert not result.ok
+    assert result.reason == "recognized_issuer_not_from_root"
+
+
+def test_verify_bundle_malformed():
+    assert verify_bundle({}, trusted_root="did:key:zabc").reason == "bad_bundle"
+    assert verify_bundle("nope", trusted_root="did:key:zabc").reason == "bad_bundle"
+    assert (
+        verify_bundle(
+            {"type": IDENTITY_BUNDLE_TYPE, "identity": 1, "recognizedIssuer": {}},
+            trusted_root="did:key:zabc",
+        ).reason
+        == "bad_bundle"
+    )
+
+
+# ---------------------------------------------------------------------------
+# CLI: agent enroll -> agent verify
+# ---------------------------------------------------------------------------
+
+
+def _init_root(temp_keystore, out_name, capsys):
+    """Mint a did:key identity via `root init` and return its DID."""
+    out = str(temp_keystore / out_name)
+    assert (
+        cli.cmd_root_init(
+            types.SimpleNamespace(
+                name="Root", scope=None, domain=None, out=out, reference=False, yes=True
+            )
+        )
+        == 0
+    )
+    capsys.readouterr()
+    return _read(out)["issuer"]
+
+
+def test_cli_enroll_and_verify(temp_keystore, capsys):
+    # Root and issuer identities (both stored in the temp keystore).
+    root_did = _init_root(temp_keystore, "root.json", capsys)
+    issuer_did = _init_root(temp_keystore, "issuer.json", capsys)
+
+    # Root recognizes the issuer.
+    recognition_out = str(temp_keystore / "recognition.json")
+    assert (
+        cli.cmd_root_recognize(
+            types.SimpleNamespace(
+                issuer=issuer_did, actions=None, root_did=root_did, out=recognition_out
+            )
+        )
+        == 0
+    )
+    capsys.readouterr()
+
+    # Enroll an agent: generate a fresh agent DID, attest it, write the bundle.
+    bundle_out = str(temp_keystore / "identity-bundle.json")
+    rc = cli.cmd_agent_enroll(
+        types.SimpleNamespace(
+            agent_did=None,
+            issuer_did=issuer_did,
+            attr=["owner=Acme", "model=gpt-x"],
+            recognition=recognition_out,
+            action=None,
+            out=bundle_out,
+            yes=True,
+        )
+    )
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert "Agent enrolled" in out
+    assert "Generated agent identity:" in out
+
+    bundle = _read(bundle_out)
+    assert bundle["type"] == IDENTITY_BUNDLE_TYPE
+    agent_did = bundle["identity"]["credentialSubject"]["id"]
+    assert bundle["identity"]["issuer"] == issuer_did
+
+    # Verify the bundle against the correct root.
+    rc = cli.cmd_agent_verify(
+        types.SimpleNamespace(
+            bundle=bundle_out, root=root_did, action_required="issueAgentIdentity"
+        )
+    )
+    assert rc == 0
+    out = capsys.readouterr().out
+    assert "Identity bundle verified" in out
+    assert agent_did in out
+    assert issuer_did in out
+    assert "Acme" in out
+
+    # Verify against a WRONG root: non-zero exit and a clear reason on stderr.
+    rc = cli.cmd_agent_verify(
+        types.SimpleNamespace(
+            bundle=bundle_out,
+            root="did:key:z6MkNotTheRealRootDidPinnedByAnHonestVerifier00",
+            action_required="issueAgentIdentity",
+        )
+    )
+    assert rc == 1
+    err = capsys.readouterr().err
+    assert "rejected" in err.lower()
+    assert "recognized_issuer_not_from_root" in err
+
+
+def test_cli_enroll_verify_via_main(temp_keystore):
+    """Drive the flow through cli.main with argv lists, including a supplied DID."""
+    root_out = str(temp_keystore / "r.json")
+    issuer_out = str(temp_keystore / "i.json")
+    recognition_out = str(temp_keystore / "rec.json")
+    bundle_out = str(temp_keystore / "bundle.json")
+
+    assert cli.main(["root", "init", "--yes", "--out", root_out]) == 0
+    assert cli.main(["root", "init", "--yes", "--out", issuer_out]) == 0
+    root_did = _read(root_out)["issuer"]
+    issuer_did = _read(issuer_out)["issuer"]
+
+    assert (
+        cli.main(
+            [
+                "root",
+                "recognize",
+                "--issuer",
+                issuer_did,
+                "--root-did",
+                root_did,
+                "--out",
+                recognition_out,
+            ]
+        )
+        == 0
+    )
+
+    agent_did = "did:key:z6MkagentSubjectPlaceholderDidForTest000000000000"
+    assert (
+        cli.main(
+            [
+                "agent",
+                "enroll",
+                "--agent-did",
+                agent_did,
+                "--issuer-did",
+                issuer_did,
+                "--attr",
+                "owner=Acme",
+                "--recognition",
+                recognition_out,
+                "--out",
+                bundle_out,
+            ]
+        )
+        == 0
+    )
+    assert _read(bundle_out)["identity"]["credentialSubject"]["id"] == agent_did
+
+    # Correct root via --root.
+    assert cli.main(["agent", "verify", "--bundle", bundle_out, "--root", root_did]) == 0
+
+    # Root supplied through the VOUCH_TRUSTED_ROOT env var (no --root).
+    import os
+
+    os.environ["VOUCH_TRUSTED_ROOT"] = root_did
+    try:
+        assert cli.main(["agent", "verify", "--bundle", bundle_out]) == 0
+    finally:
+        del os.environ["VOUCH_TRUSTED_ROOT"]
+
+    # Wrong root: non-zero.
+    assert (
+        cli.main(
+            [
+                "agent",
+                "verify",
+                "--bundle",
+                bundle_out,
+                "--root",
+                "did:key:z6MkWrongRoot000000000000000000000000000000000000",
+            ]
+        )
+        == 1
+    )