Self-sovereign identity · Capability-bound work · Durable evidence · Optional settlement
Agnet is an implementation-backed research project for the Agnet Fabric Protocol (AFP): a future transport-neutral fabric for sovereign Agent coordination, verifiable work, and programmable settlement. Its current implementation is ASP v14, a local-first proof kernel whose signed task, event, artifact, checkpoint, receipt, and Swarm semantics become AFP's evidence narrow waist.
ASP v14 remains the implemented local-first wire surface. AFP v1 does not silently rename or reinterpret existing frames, vectors, artifact fields, CLIs, or package APIs.
Quick start · AFP v1 design · Architecture · Current wire protocol · Current status · Ultimate vision
Agent systems can call tools and coordinate work, but they usually cannot prove—across runtimes, endpoints, relays, and organizations—who authorized an action, which bounded capability was used, what actually ran, which bytes were produced, which party accepted custody, and whether a result or charge should be trusted.
Agnet treats that accountability gap as an Agent Internet fabric problem, not as an HTTP API problem.
AFP defines the future narrow waist for agent work:
Self-sovereign Agent identity
+ Capability grant and policy
+ Signed task and causal events
+ Context-bound Artifact reference
+ Fenced receipt commitment
+ Optional custody and settlement commitment
The transport, relay, discovery provider, storage provider, scheduler, and payment rail remain replaceable. The authority and evidence do not. The current ASP v14 runtime already proves the local core: signed tasks, receipts, artifacts, checkpoints, approvals, and Swarm closure records are replayable and verifier-readable outside the runtime that created them.
- Portable trust — verify work without trusting the original process or UI.
- Accountable delegation — bind intent, requester, worker, policy, and output into one evidence chain.
- Recoverable agent work — preserve events, checkpoints, artifacts, leases, and retry lineage.
- Federated operation — cross Zone boundaries with explicit identity and trust provenance.
- Research without hand-waving — turn claims about agent coordination into executable protocol fixtures and failure tests.
Agnet separates product surfaces, Agent-level authority, and byte transport. Go owns the durable local runtime and gateway. Node.js owns compact protocol construction and pure verification. Shared vectors keep both implementations aligned.
flowchart TB
H[Human or Principal Agent] --> P[Intent · Policy · Capability Grant]
P --> F[AFP Evidence & Authority Fabric]
F --> W[Workers · Tools · Sandboxes]
W --> A[Artifacts · Checkpoints · Events]
A --> R[Fenced Receipt / Close / Settlement Facts]
R --> V[Independent Verifiers]
F --> D[Discovery · Encrypted Mailbox · Relay Custody]
D --> N[Replaceable Peer Substrate]
N --> U[Internet Underlay: Local IPC · HTTPS/QUIC · libp2p]
G[Optional Zone Governance] -. credentials · policy · revocation .-> F
R --> J[Durable Journal / Rebuildable Views]
J --> V
Current boundary: the ASP v14 proof kernel remains local-first. AFP AF3 now includes an opt-in, bounded QUIC-v1 Direct dial and an explicit operator-owned persistent listener with a durable Ed25519 libp2p identity; sovereign remote task delivery, relay custody, public discovery, public reachability, and settlement adapters remain planned, not claimed.
| Surface | Role | Primary implementation |
|---|---|---|
| AFP v1 design | Target transport-neutral identity, authority, delivery, evidence, and settlement contract | docs/afp-v1-design.md |
| ASP v14 proof core | Implemented local-first identities, tasks, receipts, artifacts, discovery, Swarm, knowledge, and trust objects | asp-core.mjs |
| Verifier CLI | Replays signature, Zone trust, task binding, artifact closure, sandbox, and package proof checks | asp-verify.mjs |
| Federation reference | Compact Node.js execution and governed federation behavior | federation-gateway.mjs |
| Durable runtime | TCP/TLS gateway, queueing, approvals, artifacts, Human Gateway, and journal-backed local Swarms | cmd/go-fed-discovery/ |
| TypeScript client SDK | Authenticated Product API tasks, cursor-resumable events, local receipt trust/signature/task/artifact verification | agnet/client |
| Packaged daemon | Thin Node launcher plus OS/CPU-specific native daemon packages for Darwin and Linux | agnet-daemon.mjs, @agnet-ai/daemon-* |
| Reusable Go verification | Receipt and Swarm output verification without the gateway | verifier/ |
| Interop evidence | Fixed Node/Go protocol fixtures and adversarial cases | test-vectors/, test/ |
Current baseline:
v14.11-phase-c-local-foundationsMaturity: research prototype with a completed local proof kernel—not a production Agent Internet. Protocol status: ASP v14 is implemented locally; AFP v1 is a strategic design gate, not a released wire protocol. Package line:0.1.0-dev.7prerelease; the Human Gateway requires a bearer token whenever its port is enabled.
U1–U30 are complete for the scoped local foundation. The strongest implemented slice is a same-host durable Go Swarm backed by an authoritative filesystem journal and OS process locks. These semantics are the evidence base AFP reuses; they do not yet prove endpoint-independent Agent delivery or public operation.
| Layer | Current state | What is real today | Next boundary |
|---|---|---|---|
| Identity & Trust | Implemented locally | aid: identities, Zone descriptors, credentials, revocation, policy evidence, signed sandbox claims |
AFP sovereign descriptor, capability grants, production key lifecycle, and hardware-backed attestation |
| Task Fabric | Implemented locally | Signed tasks, events, receipts, artifacts, checkpoints, audit chain, queue/resume evidence | Direct remote task semantics, encrypted delivery, durable remote artifacts, and multi-host recovery |
| Discovery | Implemented locally | FED_RESOLVE, evidence-first FED_QUERY, capability credentials, trust provenance, labelled routing/reputation signals |
Privacy-bounded capability queries, signed offers, freshness propagation, and abuse controls |
| Swarm | Durable same-host kernel complete | Journal authority, leases/fencing, deterministic parallel ready waves, receipt commitment, byte-stable close, output gate, signed disband | Task-scoped Direct Swarm and governed cross-host authority |
| Delivery & Overlay | Local proof only | Local TCP/TLS/WebSocket paths, encrypted mailbox/custody seams, and one-shot pinned TLS or QUIC-v1 Direct route evidence | Persistent endpoint-independent delivery, Circuit Relay v2 custody, public reachability, and reusable multi-path lifecycle |
| Isolation | Proof-backed local slice | Local sandbox evidence and Darwin private-workspace proof | Capability-bound sandbox handshake and real container/VM/TEE isolation parity |
| Knowledge | Protocol seam complete | Signed query/response frames with source, freshness, license, and query binding | Ingestion, citation/conflict graph, index, and operational gateway |
| Human product | Thin operational surface | Human Gateway for tasks, queue, approvals, audit, artifacts, transcripts, and security posture | Principal intent workspace with explicit direct/relayed/governed assurance |
| Economy & Operations | Research surface | Micro-contract fields, cost/risk signals, and auditable work evidence | Metering, budget reservation, settlement adapters, disputes, observability, and recovery operations |
The current architectural coverage is estimated at 55–65% of the Ultimate vision. That number is an inference about layer coverage, not a production-readiness score. See Implementation Status for the evidence matrix.
Agnet distinguishes execution from commitment:
- Worker execution is at least once and may repeat after failure.
- A fenced, signed receipt commitment becomes authoritative once.
- Completed, failed, and cancelled receipts bind the original signed task; cancellation also carries a separate cancel digest.
receipt.committedis exposed only after durable task state and queue projections agree, and no later per-task events are emitted.- Artifacts are accepted only when their manifest and bytes match the signed evidence.
- Views are rebuildable; journals, signed records, and content-addressed bytes remain authoritative.
- Independent verifiers replay trust and integrity checks without trusting the scheduler.
flowchart LR
T[Signed Task] --> P[Policy + Approval]
P --> E[Execution]
E --> A[Artifact / Checkpoint]
A --> R[Signed Receipt]
R --> C[Swarm Close]
R --> J[Audit Chain]
C --> V[Independent Verification]
J --> V
A typical federated flow:
- A requester signs a task with an Ed25519-backed
aid:identity. FED_TASK_OPENcarries the task, requester descriptor, origin Zone, and Zone binding.- The worker verifies identity, Zone trust, policy, task shape, and signature before execution.
- Execution emits events, artifacts, optional checkpoints and approvals, then a worker-signed receipt.
FED_RECEIPTreturns the result with task and artifact bindings.- Swarm completion binds step receipts into a Zone-signed
FED_SWARM_CLOSE. - Node and Go verifiers independently replay the evidence chain.
bash scripts/proof-demo.shThe demo emits verifier-ready task, receipt, trust, and artifact evidence under state/.
Verify the receipt and artifact bytes independently:
node asp-verify.mjs fed-receipt-artifacts \
state/proof-demo-fed-receipt.json \
state/proof-demo-trusted-zones.jsonnode --test --test-concurrency=1 test/*.test.mjs
go test ./...For gateway setup, TLS/mTLS, Human Gateway flows, and verifier commands, use the manuals.
Agnet is deliberately explicit about what its evidence proves.
- Cryptographic Agent and Zone identity primitives
- Signed task, receipt, artifact, checkpoint, and audit evidence
- Node/Go interoperability through fixed vectors
- Evidence-first capability discovery and routing signals
- Same-host durable Swarm recovery and deterministic ready-wave execution
- Fenced receipt commitment, stable close, output verification, and signed disband
- Local sandbox claims, signed attestation verification, and Darwin workspace isolation proof
- Human approval and task/audit/artifact inspection surfaces
- AFP v1's transport-neutral envelope and compatibility vectors
- Sovereign Direct tasks between independent remote operators
- Attenuated capability grants and capability-bound sandbox handshakes
- Encrypted endpoint-independent mailboxes, relay custody, and store-and-forward ordering
- Public P2P/DHT discovery, anti-abuse, and signed offer exchange
- Settlement adapters for verified delivery, storage, execution, and verification commitments
- A production security boundary or globally operated Agent Internet
- Cross-host durable Swarm execution or remote artifact recovery
- Public P2P/DHT routing, NAT traversal, relay infrastructure, or global discovery
- Hardware remote attestation, VM isolation, or TEE proof
- Exactly-once worker execution or exactly-once external side effects
- A mandatory blockchain, token, marketplace, payment rail, or globally trusted reputation system
- A complete Semantic OS, operational Knowledge Network, or production control plane
These are roadmap boundaries, not hidden fallbacks. The project favors narrow, testable claims over broad demos that cannot be independently verified.
NOW
U1–U30 local proof kernel
└─ signed work + durable same-host Swarm + independent verification
NEXT: AFP FOUNDATION
AF0 protocol freeze → AF1 sovereign invited Direct work → AF2 async mailbox custody
THEN: SOVEREIGN AGENT INTERNET
AF3 P2P reachability → AF4 capability query/offers → AF5 Direct Swarm
IN PARALLEL: GOVERNED / PRIVATE PROFILE
U31–U68 private cluster, remote fabric, consensus, governance, knowledge, and operations
LATER: ECONOMY AND PRODUCT CONVERGENCE
AF6 settlement adapters → AF7 unified assurance-aware product surface
The full target is documented in the AFP v1 design and Agent Space Ultimate Vision. The active implemented protocol line is tracked in the v14 roadmap. Detailed milestone history belongs in the changelog, not in this README.
| Document | Purpose |
|---|---|
| AFP v1 Design | Canonical Web3-native positioning, AFP boundaries, object families, and ordered programs |
| Architecture | Current/target layer model, proof flow, Node/Go ownership, and boundary rules |
| Protocol | Implemented ASP v14 frames and their AFP migration boundary |
| Verifier CLI | Independent verification commands and failure modes |
| Federation | Current governed gateway, trusted Zones, TLS/mTLS, and cross-Zone operation |
| Trust model | Identity, credentials, revocation, sandbox, and attestation |
| Implementation Status | Current evidence matrix and missing exit conditions |
| Ultimate Vision | Long-term Agent Internet model and economic/governance boundaries |
| Sovereign/Public plan | Requirements for the permissionless AFP participation profile |
| Governed/Private plan | U31–U68 hardened private deployment profile |
| v14 Roadmap | Active implemented protocol milestone |
| Changelog | Historical releases and completed boundaries |
| Development | Tests, Go build, and contribution workflow |
docs/afp-v1-design.md AFP strategic design and protocol boundary
asp-core.mjs Implemented ASP v14 protocol primitives
asp-verify.mjs Independent Node.js verifier CLI
federation-gateway.mjs Node.js governed federation reference
cmd/go-fed-discovery/ Durable Go gateway and local Swarm runtime
verifier/ Reusable Go verification packages
test-vectors/ Cross-language protocol fixtures
test/ Node.js protocol and documentation tests
docs/manual/ Operator and protocol manuals
scripts/ Reproducible proof workflows
Start with CONTRIBUTING.md and Development. Protocol changes should include exact failure semantics, cross-language vectors where applicable, and verifier-first tests.
No open-source license has been selected. Until a license is added, default copyright rules apply; repository access does not imply permission to reuse, redistribute, or publish the code.