The Agent Graph Trust Protocol (AGTP) defines the smallest set of interoperable primitives required for heterogeneous agents—human, software, and hybrid—to coordinate and compound intelligence through verifiable feedback. The protocol standardizes identity (DID), a signed Learning Signal (W3C VC) as the atomic feedback unit, Space Manifests (signed VCs) that declare policy per context, and a canonical provenance URI that makes evaluations reproducible. AGTP v2 sharpens minimality and implementability with a mandatory HTTP interop profile, a baseline cryptographic suite (VC Data Integrity with Ed25519 2020 over URDNA2015), canonical hashing for deduplication, and replay/idempotency controls. The protocol keeps policy—aggregation specifics, incentives, governance—at the edge inside Spaces, enabling pluralism without fragmenting the substrate. A reference default aggregation, operational KPIs, and a privacy model (ephemeral→persistent distillation with optional commitments) provide practical guidance. Machine-readable artifacts (JSON-LD contexts, JSON Schemas, ABNF grammar, OpenAPI) and conformance classes make AGTP directly implementable while preserving credible neutrality. Future work targets verifiable rewards at scale, benchmark-from-live, privacy-preserving aggregation, and cross-Space normalization.
When we think of AGI, we imagine a breakthrough algorithm suddenly emerging from a frontier lab in San Francisco or Beijing. It’s both exciting and scary. Inviting speculation about the risks for our society and our very survival as a species. But what if the real existential risk in front of us was not a runaway superintelligence conjuring itself into godhood, but something far more mundane and far more likely?
In fact, superintelligence is already there; it’s just not properly coordinated.
It exists not as a single datacenter-scale model, but as a distributed reality: billions of humans, machines, and hybrid agents interacting, sharing and updating beliefs to minimize entropy. Yet their outputs remain fragmented, trapped in proprietary silos that do not compound. The real constraint is not the supply of intelligence, but the lack of coordination.
This fragmentation is not just an inconvenience—it is the defining bottleneck. Centralized AI pipelines, no matter how well-funded, cannot test hypotheses at the scale of open research and distributed exploration. To compensate, frontier labs are converging on a different strategy: monopolizing the decisive input to progress, the “experience signal.”
Every trace of interaction—logs, corrections, evaluations, device telemetry—becomes the fuel for reinforcement. With each new user, more feedback is captured; with more feedback, models improve; with better models, more users join. This creates a self-reinforcing cycle, where the control of experience becomes the ultimate moat.
Intelligence emerges from learning, and learning now depends on the accumulation of structured experience. Reinforcement learning from human feedback (RLHF) and reinforcement learning from verifiable rewards (RLVR) represent two sides of this shift: one harnessing human preference signals, the other harnessing machine-generated validation. Together, they define what we can call the “Era of experience.” Whoever controls the flows of feedback in this era controls the pace of progress itself.
In this new paradigm, open-source and open-weights are no longer sufficient. Open models, code, datasets and architectures cannot fully compensate for closed experience streams. If the interactions, feedback loops, and reinforcement signals remain private, then even the best open research will always be structurally disadvantaged. What we need is not just open source, but open learning: a substrate where streams of observation, action, and feedback are continuously exchanged, standardized, and available for compounding.
The timeline is brutally short. The de facto standard is rapidly becoming that every micro-decision feeds a private reinforcement pipeline. If we continue on this trajectory, the future of intelligence will be defined by a brittle monoculture that slows innovation and narrows humanity’s collective agency. The question before us is not whether AGI will emerge, but whether it will emerge through concentration or through coordination.
To achieve coordination, we need a minimal protocol that makes feedback portable, verifiable, and reusable across agents. This is the missing substrate that can transform intelligence from a race of closed flywheels into a commons of compounding learning. By standardizing this loop, we can turn the internet into a live system where every experiment emits a signed, portable signal. Small labs can inherit edge cases from large deployments; negative results become first-class assets; and reproducibility grows teeth because claims ship with evidence graphs.
Enter AGTP.
AGTP stands for Agent Graph Trust Protocol.
Imagine a layer on top of HTTP where:
- Each agentic entity has a permanent Decentralized Identifier, a wallet, a trust score.
- Each prompt is routed to a constellation of agents ranked based on intersubjective search.
- Each in-context inference and feedback are cryptographically signed and readable by others.
Instead of experience signals flowing towards a handful of monopolistic AI labs, they are stored at the protocol level, like web pages, and compound quadratically as the network expands.
The web of documents is giving way to a web of coordinated compute, where autonomous agents—human, software, and hybrid—act, evaluate, and learn from each other. What compounds intelligence across such heterogeneity is not a single model or platform, but a universal unit of feedback that any agent can issue, verify, and aggregate. The Agent Graph Trust Protocol (AGTP) defines that minimal substrate.
Current ecosystems drift toward incompatible reward signals, opaque leaderboards, and brittle integrations. Without a neutral way to identify agents, attest feedback, bind it to provenance, and aggregate it within contexts, we get fragmentation, capture, and stalled generalization.
AGTP is deliberately small. It standardizes:
- Identity for issuers and subjects,
- A signed Learning Signal as the atomic unit of feedback,
- Context (Space) manifests that declare rules,
- Provenance bindings that make feedback reproducible.
Everything else—scoring formulas, staking, moderation, arbitration, economic policy—is out of scope and lives at the policy layer (within Spaces or higher-level systems).
Normative language: “MUST/SHOULD/MAY” are as defined in RFC 2119.
An Agent is any actor (human, service, or model) identified by a Decentralized Identifier (DID).
- An Agent’s DID Document MUST include a reachable FeedbackService endpoint (see below).
A Space is a DID-addressed policy domain—a context subgraph—that declares how feedback is interpreted.
- Each Space MUST publish a Space Manifest (a Verifiable Credential) specifying:
- dimensions (the named axes permitted, with per-dimension range, higherIsBetter, optional unit),
- dimensionRefs (optional semantic URIs),
- aggregation (how multiple Signals combine into scores) or use the default,
- persistence_policy (rules for private vs public retention),
- status/revocation URIs (RECOMMENDED),
- version, validFrom, validUntil, and manifestHash.
An Artifact is any content-addressed resource implicated in an interaction (e.g., model version, dataset, trace, code).
- Artifacts SHOULD be referenced by a content hash (CID or equivalent) and MAY be public or private.
A Learning Signal is a W3C Verifiable Credential (VC) that encodes feedback about a specific interaction. A conformant Signal MUST include:
- issuer (DID of the Agent issuing the Signal),
- issuanceDate,
- credentialSubject with:
- subject (DID/URI of the Agent or Artifact being evaluated),
- space (DID/URI of the Space in which this applies),
- dimensions (array of dimension identifiers),
- value (one or more numeric values aligned to dimensions),
- persistence ("ephemeral" or "persistent"),
- provenance (a canonical AGTP provenance URI),
- issuerRelation (optional: self|affiliate|independent),
- commitment (optional Merkle root over a set of EphemeralSignals used for distillation),
- proof (VC Data Integrity, Ed25519 2020 over URDNA2015).
Status / Revocation: Signals MUST expose revocation/status via VC Status List (2021/2024 or successor) or a Space-defined status endpoint.
Every Agent’s DID Document MUST advertise a service endpoint of type AGTPFeedbackService that accepts POSTed Signals and returns a receipt. This prevents “leeching” (participating without being evaluable).
Dimensions are identifiers for evaluation axes. A Space MUST list the dimension identifiers it accepts and MAY reference external registries. The base protocol does not fix any global dimension set.
Each Signal MUST bind to a canonical provenance URI that allows reproducing or auditing the evaluated interaction.
- AGTP defines a scheme: agtp://provenance?space=<URI>&interaction=<opaque-id>&artifact=<CID>[,<CID>...]
- At least space and interaction are required; at least one artifact is RECOMMENDED.
- Discovery An Agent resolves another Agent’s DID and reads its AGTPFeedbackService.
- Interaction Agents act and/or evaluate within a declared Space (by DID/URI). The Space Manifest defines which dimensions are valid and how they are aggregated.
- Signal issuance Evaluators issue a Learning Signal (VC) with:
- issuer DID, subject, space, dimensions, value(s),
- persistence flag,
- provenance URI binding the interaction to artifacts,
- timestamp and cryptographic proof.
- Delivery & receipt The issuer POSTs the Signal to the subject’s AGTPFeedbackService; both parties (and optionally the Space) store receipts. Replay protection uses a HEAD-issued nonce; duplicates are rejected via Idempotency-Key.
- Aggregation The Space applies its declared aggregation rule to combine relevant Signals into scores or ranks. If omitted, the default trust-weighted average is applied over a sliding window (initial issuer trust weight = 1.0; trust updates are policy).
- Routing & learning Consumers (humans, agents, orchestration systems) route requests using aggregated feedback; private learners update locally using ephemeral Signals and may distill summaries into persistent Signals later.
- Aggregation default: trust-weighted average with sliding window, minimum rater count, and cap per-issuer contribution (parameters declared in Manifest).
- Transport: delivery SHOULD be over an authenticated, confidential channel; the HTTP profile is mandatory for interop; DIDComm v2 is an optional profile.
- Reproducible tournament: Solver S submits an answer; Verifier V evaluates. V issues a Signal in Space did:space:rlvr, dimension correctness, value 1.0, provenance binds the test-case CID and the output CID. Anyone can later reproduce the evaluation from provenance.
- Microscopic checks: A model generates a chain-of-thought; a private tool issues ephemeral Signals on each step (dimensions: consistency, grounding). A distilled persistent summary is later published with aggregated values and a link to a redacted trace artifact, optionally committed via Merkle root.
- Resolve (MUST)
- Input: subject DID
- Output: DID Document with AGTPFeedbackService.
- Negotiate (SHOULD)
- Choose a transport profile (HTTP mandatory; DIDComm optional) and mutually supported VC proof suites.
- Declare context (MUST)
- Specify Space (URI/DID). Fetch Space Manifest (VC) and verify.
- Act/Evaluate (POLICY)
- Perform the task; run evaluators, tournaments, or audits.
- Issue Signal (MUST)
- Construct VC with required fields; sign.
- Deliver (MUST)
- POST to AGTPFeedbackService with AGTP-Nonce and Idempotency-Key. Receive receipt.
- Persist/Distill (POLICY)
- Store private artifacts; decide whether to publish persistent Signals; include commitment when distilling.
- Aggregate (MUST at Space)
- Apply Space’s declared rule or the default.
- Discover & Route (POLICY)
- Index persistent Signals; clients select agents based on aggregated scores.
Non-goals: prescribing orchestration frameworks, agent runtimes, or evaluator taxonomies.
- Agents MUST use DIDs; DID Documents MUST be resolvable.
- A FeedbackService MUST authenticate callers and apply rate-limits or admission controls (policy).
- Signals MUST be VCs with verifiable proofs.
- Baseline signature suite: Ed25519 2020. Additional suites MAY be supported.
- Signals MUST implement status/revocation via Status List or Space status API.
- provenance MUST conform to AGTP grammar.
- Artifacts SHOULD be content-addressed; where disclosure is sensitive, publish redacted artifacts plus attestations.
- Signals MUST use HEAD-issued nonces and POST AGTP-Nonce; servers MUST reject missing/used nonces.
- Clients MUST include an Idempotency-Key; servers MUST reject duplicates within a window.
- Spaces MAY anchor hashes of PersistentSignals to a ledger for timestamping and censorship resistance. AGTP does not mandate specific chains.
Out of scope: global PKI, KYC/real-name, centralized trust registries.
AGTP is incentive-compatible without hard-coding economics:
- Anti-leeching primitive: the mandatory FeedbackService ensures everyone can be evaluated.
- Signals as rewards: values in specified dimensions serve as reward carriers.
- Spaces define policy: staking, deposits, eligibility, and payouts (if any) are Space-level choices.
Non-normative examples
- A research Space requires a small refundable deposit to reduce spam.
- A marketplace Space distributes rewards proportionally to aggregated helpfulness over a period. These are policy choices; the protocol remains neutral.
- AGTP uses semantic versioning: MAJOR.MINOR.PATCH.
- Agents and Spaces SHOULD advertise supported versions and capabilities (e.g., signature suites) via optional capability endpoints.
- Dimensions: Spaces MAY define new dimension identifiers; public registries are encouraged.
- Vocabularies: JSON-LD contexts MAY be extended with new terms in separate namespaces.
- Profiles: Transport and proof-suite profiles MAY be standardized separately without changing core invariants.
- Proposals, reference implementations, and conformance tests precede a MINOR increment.
- MAJOR changes require deprecation schedules and migration tooling, with opt-in migrations via dual-served manifests.
Non-goals: global DAO mandates; centralized councils with binding authority.
{
"@context": {
"@version": 1.1,
"vc": "https://www.w3.org/2018/credentials#",
"agtpo": "https://schema.agtp.org/ontology#",
"type": "@type",
"issuer": {"@id": "vc:issuer", "@type": "@id"},
"issuanceDate": {"@id": "vc:issuanceDate", "@type": "http://www.w3.org/2001/XMLSchema#dateTime"},
"credentialSubject": {"@id": "vc:credentialSubject", "@context": {
"subject": {"@id": "agtpo:subject", "@type": "@id"},
"space": {"@id": "agtpo:space", "@type": "@id"},
"dimensions": {"@id": "agtpo:dimensions", "@container": "@set"},
"value": {"@id": "agtpo:value"},
"persistence": {"@id": "agtpo:persistence"},
"provenance": {"@id": "agtpo:provenance", "@type": "@id"},
"issuerRelation": {"@id": "agtpo:issuerRelation"}, // optional
"commitment": {"@id": "agtpo:commitment"} // optional
}},
"proof": "https://w3id.org/security#proof"
}
}{
"@context": ["https://www.w3.org/2018/credentials/v1", "https://schema.agtp.org/context/v1"],
"type": ["VerifiableCredential", "LearningSignal"],
"issuer": "did:example:evaluator1",
"issuanceDate": "2025-09-06T18:12:00Z",
"credentialSubject": {
"subject": "did:example:agent456",
"space": "did:space:rlvr",
"dimensions": ["accuracy"],
"value": 1.0,
"persistence": "persistent",
"provenance": "agtp://provenance?space=did:space:rlvr&interaction=3b4f...&artifact=bafybeigd...",
"issuerRelation": "independent",
"commitment": "mh:zb2rhk... (optional)"
},
"proof": { "...": "Ed25519 2020 over URDNA2015" }
}{
"@context": ["https://www.w3.org/2018/credentials/v1", "https://schema.agtp.org/context/v1"],
"type": ["VerifiableCredential", "SpaceManifest"],
"issuer": "did:space:rlvr",
"issuanceDate": "2025-09-06T00:00:00Z",
"credentialSubject": {
"id": "did:space:rlvr",
"version": "1.2.0",
"validFrom": "2025-09-06T00:00:00Z",
"validUntil": "2026-03-06T00:00:00Z",
"manifestHash": "mh:zQmV...",
"dimensions": [
{"id":"accuracy","range":[0,1],"higherIsBetter":true,"unit":"prob"},
{"id":"robustness","range":[0,1],"higherIsBetter":true}
],
"dimensionRefs": ["https://registry.example.org/dimensions/v1#accuracy"],
"aggregation": {"name":"TrustWeightedAverage","parameters":{"window":"P30D","defaultWeight":1.0,"minRaters":3,"maxWeightPerIssuer":0.4}},
"persistence_policy": {"ephemeralRetention":"P7D","persistentPublication":"public-index"},
"status": "https://status.rlvr.space/v1",
"revocation": "https://revocations.rlvr.space/v1"
},
"proof": { "...": "Ed25519 2020 over URDNA2015" }
}{
"id": "did:example:agent456",
"service": [{
"id": "did:example:agent456#agtp-feedback",
"type": "AGTPFeedbackService",
"serviceEndpoint": "https://agent456.example.org/.well-known/agtp/feedback"
}]
}- Sybil/Collusion: mitigated at policy via admissions, deposits, issuer-diversity thresholds; protocol exposes issuerRelation, receipts, and trust-weight hooks.
- Signal Spam: HTTP quotas/rate limits (policy); Receipt states and standard errors prevent silent drops.
- Provenance Spoofing: content addressing + reproducibility via provenance; optional anchoring.
- Replay/Duplicates: AGTP-Nonce + Idempotency-Key windows; canonical signalHash.
- Privacy Leakage: ephemeral→persistent distillation + commitment for audit without revealing private traces.
- Governance Capture: signed, versioned Manifests; multiple registries; client choice and caching with pinning.
Formulas (examples, 30-day rolling windows):
- Coverage = validSignals / interactionsObserved
- Leeching = agentsWithoutHealthyFeedbackService / activeAgents
- Reproducibility = reverifiedOutcomes / auditedOutcomes
- Interop Conformance = passes / totalCases (per suite)
- HHI = Σ sᵢ² over shares in identity/storage/routing provider roles
- Cross-Space Transfer Lift = (scoreWithReuse − baselineScore) / baselineScore
- Re-ID Incident Rate = incidents / totalPersistentSignals
- Reputation Volatility = stdev(monthlyScore) / mean(monthlyScore)
KPI Feed (optional endpoint): GET /.well-known/agtp/metrics → JSON list of objects {metric, value, window, method, lastUpdated} to enable third-party audits.
- Space: did:space:rlvr with dimensions accuracy, robustness.
- Flow: Solver submits result → Verifier evaluates → Verifier issues persistent Signal with provenance linking test-case CID and output CID → Space aggregates across multiple verifiers → Leaderboard updates.
- Why it matters: anyone can re-run evaluations, preventing scoreboard gaming.
- Space: did:space:microcheck with dimensions consistency, grounding.
- Flow: Tooling issues ephemeral Signals on each step → private learner updates → periodic persistent summary Signals published (optionally with commitment).
- Why it matters: preserves privacy while improving public signal quality.
- Space: did:space:ctxprog with dimension task_yield.
- Flow: Agents exchange prompts/programs as Artifacts → Evaluators issue Signals tied to program CIDs → Aggregation favors modules with consistent cross-task gains.
- Why it matters: rewards abstraction/transfer rather than overfitting.
{
"@context": {
"@version": 1.1,
"vc": "https://www.w3.org/2018/credentials#",
"xsd": "http://www.w3.org/2001/XMLSchema#",
"agtpo": "https://schema.agtp.org/ontology#",
"type": "@type",
"issuer": { "@id": "vc:issuer", "@type": "@id" },
"issuanceDate": { "@id": "vc:issuanceDate", "@type": "xsd:dateTime" },
"credentialSubject": {
"@id": "vc:credentialSubject",
"@context": {
"subject": { "@id": "agtpo:subject", "@type": "@id" },
"space": { "@id": "agtpo:space", "@type": "@id" },
"dimensions": { "@id": "agtpo:dimensions", "@container": "@set" },
"value": { "@id": "agtpo:value" },
"persistence": { "@id": "agtpo:persistence" },
"provenance": { "@id": "agtpo:provenance", "@type": "@id" },
"issuerRelation":{ "@id": "agtpo:issuerRelation" },
"commitment": { "@id": "agtpo:commitment" }
}
},
"SpaceManifest": "agtpo:SpaceManifest",
"LearningSignal": "agtpo:LearningSignal",
"dimensionsSpec": { "@id": "agtpo:dimensionsSpec", "@container": "@set" },
"dimensionRefs": { "@id": "agtpo:dimensionRefs", "@container": "@set" },
"aggregation": "agtpo:aggregation",
"persistence_policy":"agtpo:persistencePolicy",
"status": { "@id": "agtpo:status", "@type": "@id" },
"revocation": { "@id": "agtpo:revocation", "@type": "@id" },
"version": "agtpo:version",
"validFrom": { "@id": "agtpo:validFrom", "@type": "xsd:dateTime" },
"validUntil": { "@id": "agtpo:validUntil", "@type": "xsd:dateTime" },
"manifestHash": "agtpo:manifestHash"
}
}- Vocabulary base: https://schema.agtp.org/ontology\#
- Context URL (versioned): https://schema.agtp.org/context/v1
- Key terms:
- agtpo:LearningSignal
- agtpo:SpaceManifest
- agtpo:subject, agtpo:space, agtpo:dimensions, agtpo:value
- agtpo:persistence, agtpo:provenance, agtpo:issuerRelation, agtpo:commitment
- agtpo:aggregation, agtpo:dimensionsSpec, agtpo:dimensionRefs
- agtpo:status, agtpo:revocation, agtpo:version, agtpo:validFrom, agtpo:validUntil, agtpo:manifestHash
agtp-uri = "agtp://" "provenance" "?" agtp-param *( "&" agtp-param )
agtp-param = space-param / interaction-param / artifact-param / ext-param
space-param = "space=" URI
interaction-param = "interaction=" 1*( unreserved / pct-encoded )
artifact-param = "artifact=" cid *( "," cid )
ext-param = pname "=" pvalue
; Notes:
; - URI is an RFC3986 absolute URI or a DID.
; - cid is an ASCII multibase content identifier (e.g., CIDv1).
; - pname/pvalue allow future extension.
; Requirements:
; - MUST include space-param and interaction-param
; - SHOULD include at least one artifact-param
{
"conformanceClasses": [
{
"id": "AGTP.Agent",
"must": [
"REQ-DID-1","REQ-FBSVC-HTTP-1","REQ-FBSVC-NONCE-1",
"REQ-HTTP-ACCEPT-1","REQ-HTTP-RECEIPT-1"
],
"should": ["REQ-DISCOVERY-CACHE-1"],
"profiles": ["http/1.0"],
"capabilities": ["sig/ed25519-2020","status/vc-statuslist","hash/urdna2015-multihash"]
},
{
"id": "AGTP.Space",
"must": [
"REQ-SMAN-VC-1","REQ-SMAN-DIMS-1","REQ-SMAN-AGG-1",
"REQ-SMAN-CACHE-1","REQ-SMAN-SIGN-1"
],
"should": ["REQ-SMAN-STATUS-1","REQ-SMAN-REVOC-1"],
"profiles": ["http/1.0"],
"capabilities": ["sig/ed25519-2020","status/vc-statuslist"]
},
{
"id": "AGTP.SignalProducer",
"must": [
"REQ-SIG-MIN-1","REQ-SIG-PROV-1","REQ-SIG-PROOF-1",
"REQ-HTTP-POST-SIG-1","REQ-IDEMPOTENCY-1","REQ-NONCE-USE-1"
],
"should": ["REQ-COMMITMENT-1","REQ-ISSUER-REL-1"],
"profiles": ["http/1.0"],
"capabilities": ["sig/ed25519-2020","hash/urdna2015-multihash"]
},
{
"id": "AGTP.SignalConsumer",
"must": [
"REQ-VERIFY-VC-1","REQ-VERIFY-PROV-1","REQ-STATUS-CHECK-1",
"REQ-DEDUP-1","REQ-AGG-DEFAULT-1"
],
"should": ["REQ-REPRO-ARTIFACTS-1"],
"profiles": ["http/1.0"]
}
],
"requirements": {
"REQ-DID-1": "Use a resolvable DID; advertise AGTPFeedbackService.",
"REQ-FBSVC-HTTP-1": "Expose /.well-known/agtp/feedback (POST) and (HEAD) per HTTP profile.",
"REQ-FBSVC-NONCE-1": "HEAD returns Replay-Nonce; POST MUST include AGTP-Nonce.",
"REQ-HTTP-ACCEPT-1": "Accept application/vc+json payloads.",
"REQ-HTTP-RECEIPT-1": "Return JSON receipt with signalHash and acceptState.",
"REQ-DISCOVERY-CACHE-1": "Cache Space Manifests per ETag/validUntil.",
"REQ-SMAN-VC-1": "Space Manifest is a VC signed by Space DID.",
"REQ-SMAN-DIMS-1": "Manifest includes per-dimension range, higherIsBetter, optional unit.",
"REQ-SMAN-AGG-1": "Manifest declares aggregation or uses default.",
"REQ-SMAN-CACHE-1": "Serve Manifest with ETag and Cache-Control.",
"REQ-SMAN-SIGN-1": "Manifest includes version, validFrom, validUntil, manifestHash.",
"REQ-SMAN-STATUS-1": "Expose status endpoint.",
"REQ-SMAN-REVOC-1": "Expose revocation endpoint.",
"REQ-SIG-MIN-1": "Signal includes issuer, issuanceDate, subject, space, dimensions, value, persistence, provenance.",
"REQ-SIG-PROV-1": "Signal provenance conforms to AGTP ABNF.",
"REQ-SIG-PROOF-1": "Signal uses VC Data Integrity Ed25519Signature2020 over URDNA2015.",
"REQ-HTTP-POST-SIG-1": "POST signal to FeedbackService; handle 200/202/406/409/422.",
"REQ-IDEMPOTENCY-1": "Include Idempotency-Key header; server rejects duplicates within window.",
"REQ-NONCE-USE-1": "Include AGTP-Nonce header matching latest HEAD.",
"REQ-VERIFY-VC-1": "Verify VC signatures per baseline suite.",
"REQ-VERIFY-PROV-1": "Validate provenance grammar; dereferenceable fields where applicable.",
"REQ-STATUS-CHECK-1": "Check VC status/revocation.",
"REQ-DEDUP-1": "Compute signalHash = multihash(URDNA2015(VC)) and dedupe.",
"REQ-AGG-DEFAULT-1": "If manifest omits aggregation, apply reference default (see §6).",
"REQ-REPRO-ARTIFACTS-1": "Attempt reproducibility when artifacts are public.",
"REQ-COMMITMENT-1": "Include commitment (Merkle root) for distilled persistent signals.",
"REQ-ISSUER-REL-1": "Include issuerRelation hint when known."
}
}{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schema.agtp.org/json/did-service.schema.json",
"title": "AGTP Feedback Service (DID Document service entry)",
"type": "object",
"required": ["id", "type", "serviceEndpoint"],
"properties": {
"id": { "type": "string" },
"type": { "const": "AGTPFeedbackService" },
"serviceEndpoint": {
"oneOf": [
{ "type": "string", "format": "uri" },
{
"type": "object",
"required": ["uri"],
"properties": { "uri": { "type": "string", "format": "uri" } },
"additionalProperties": true
}
]
}
},
"additionalProperties": true
}openapi: 3.1.0
info: { title: AGTP HTTP Profile, version: 1.0.0 }
paths:
/.well-known/agtp/feedback:
head:
responses:
'200':
description: Nonce issued
headers:
Replay-Nonce: { schema: { type: string } }
post:
requestBody:
required: true
content:
application/vc+json:
schema: { $ref: '#/components/schemas/LearningSignalVC' }
parameters:
- in: header
name: Idempotency-Key
required: true
schema: { type: string, format: uuid }
- in: header
name: AGTP-Nonce
required: true
schema: { type: string }
responses:
'200': { description: Accepted, content: { application/json: { schema: { $ref: '#/components/schemas/Receipt' } } } }
'202': { description: Pending validation, content: { application/json: { schema: { $ref: '#/components/schemas/Receipt' } } } }
'406': { description: Dimension not accepted }
'409': { description: Duplicate Idempotency-Key }
'422': { description: Invalid proof or payload }
/.well-known/agtp/space/{spaceId}:
get:
parameters:
- in: path
name: spaceId
required: true
schema: { type: string }
responses:
'200':
description: Space Manifest VC
headers:
ETag: { schema: { type: string } }
Cache-Control: { schema: { type: string } }
content:
application/vc+json:
schema: { $ref: '#/components/schemas/SpaceManifestVC' }
/.well-known/agtp/metrics:
get:
responses:
'200':
description: KPI feed
content:
application/json:
schema:
type: array
items: { $ref: '#/components/schemas/Metric' }
components:
schemas:
Receipt:
type: object
required: ["receiptId","signalHash","acceptState","receivedAt"]
properties:
receiptId: { type: string }
signalHash: { type: string }
acceptState: { type: string, enum: ["accepted","rejected","pending"] }
reason: { type: string }
receivedAt: { type: string, format: date-time }
Metric:
type: object
required: ["metric","value","window","method","lastUpdated"]
properties:
metric: { type: string }
value: { type: number }
window: { type: string }
method: { type: string }
lastUpdated: { type: string, format: date-time }
LearningSignalVC:
allOf:
- $ref: 'https://www.w3.org/2018/credentials/v1'
- type: object
required: ["@context","type","issuer","issuanceDate","credentialSubject","proof"]
properties:
"@context": { type: array, minItems: 1 }
type: { type: array, contains: { const: "LearningSignal" } }
issuer: { type: string }
issuanceDate: { type: string, format: date-time }
credentialSubject:
type: object
required: ["subject","space","dimensions","value","persistence","provenance"]
properties:
subject: { type: string }
space: { type: string }
dimensions: { type: array, items: { type: string } }
value:
oneOf:
- { type: number }
- { type: array, items: { type: number } }
persistence: { type: string, enum: ["ephemeral","persistent"] }
provenance: { type: string, pattern: "^agtp://provenance\\?.+" }
issuerRelation: { type: string, enum: ["self","affiliate","independent"] }
commitment: { type: string }
proof: { type: object }
SpaceManifestVC:
type: object
required: ["@context","type","issuer","issuanceDate","credentialSubject","proof"]
properties:
"@context": { type: array, minItems: 1 }
type: { type: array, contains: { const: "SpaceManifest" } }
issuer: { type: string }
issuanceDate: { type: string, format: date-time }
credentialSubject:
type: object
required: ["id","version","validFrom","validUntil","manifestHash","dimensions"]
properties:
id: { type: string }
version: { type: string }
validFrom: { type: string, format: date-time }
validUntil:{ type: string, format: date-time }
manifestHash: { type: string }
dimensions:
type: array
items:
type: object
required: ["id","range","higherIsBetter"]
properties:
id: { type: string }
range:
type: array
minItems: 2
maxItems: 2
items: { type: number }
higherIsBetter: { type: boolean }
unit: { type: string }
dimensionRefs:
type: array
items: { type: string }
aggregation:
type: object
properties:
name: { type: string }
parameters: { type: object }
persistence_policy: { type: object }
status: { type: string }
revocation: { type: string }
proof: { type: object }
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schema.agtp.org/json/learning-signal.schema.json",
"title": "AGTP Learning Signal VC (minimum)",
"type": "object",
"required": ["@context","type","issuer","issuanceDate","credentialSubject","proof"],
"properties": {
"@context": { "type": "array", "minItems": 1 },
"type": { "type": "array", "contains": { "const": "LearningSignal" } },
"issuer": { "type": "string" },
"issuanceDate": { "type": "string", "format": "date-time" },
"credentialSubject": {
"type": "object",
"required": ["subject","space","dimensions","value","persistence","provenance"],
"properties": {
"subject": { "type": "string" },
"space": { "type": "string" },
"dimensions": { "type": "array", "items": { "type": "string" } },
"value": {
"oneOf": [
{ "type": "number" },
{ "type": "array", "items": { "type": "number" } }
]
},
"persistence": { "type": "string", "enum": ["ephemeral","persistent"] },
"provenance": { "type": "string", "pattern": "^agtp://provenance\\?.+" },
"issuerRelation": { "type": "string", "enum": ["self","affiliate","independent"] },
"commitment": { "type": "string" }
},
"additionalProperties": true
},
"proof": { "type": "object" }
},
"additionalProperties": true
}{
"aggregation": {
"name": "TrustWeightedAverage",
"parameters": {
"window": "P30D",
"defaultWeight": 1.0,
"minRaters": 3,
"maxWeightPerIssuer": 0.4
}
}
}- Sliding time window window; initial
$w_{issuer}=1.0$ ; trust updates are policy. - Enforce minRaters; cap each issuer’s fractional contribution by maxWeightPerIssuer.
- aggregation.name SHOULD be a URI/namespaced identifier.
- aggregation.parameters is open; clients MAY ignore unknown parameters.
- Optional implementation pointer: "impl": "https://example.org/agg/TrustWeightedAverage@1.0.1".
- agtpVersion: MAJOR.MINOR.PATCH.
GET /.well-known/agtp/capabilities
{
"agtpVersion": "2.0.0",
"supportedProfiles": ["http/1.0", "didcomm/2.0"],
"signatureSuites": ["Ed25519Signature2020"],
"statusFormats": ["StatusList2021"],
"hashing": ["URDNA2015+multihash"],
"features": ["metricsFeed","anchoring"],
"extensions": [
"https://schema.agtp.org/context/v1",
"https://registry.example.org/dimensions/v1"
],
"updatedAt": "2025-09-06T18:30:00Z"
}- DID service for capabilities:
{
"id": "did:example:agent456#agtp-cap",
"type": "AGTPCapabilities",
"serviceEndpoint": "https://agent456.example.org/.well-known/agtp/capabilities"
}- Manifest credentialSubject.capabilities MAY mirror supported versions/suites.
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schema.agtp.org/json/space-manifest.schema.json",
"title": "AGTP Space Manifest VC (payload)",
"type": "object",
"required": ["@context","type","issuer","issuanceDate","credentialSubject","proof"],
"properties": {
"@context": { "type": "array", "minItems": 1 },
"type": { "type": "array", "contains": { "const": "SpaceManifest" } },
"issuer": { "type": "string" },
"issuanceDate": { "type": "string", "format": "date-time" },
"credentialSubject": {
"type": "object",
"required": ["id","version","validFrom","validUntil","manifestHash","dimensions"],
"properties": {
"id": { "type": "string" },
"version": { "type": "string" },
"validFrom": { "type": "string", "format": "date-time" },
"validUntil": { "type": "string", "format": "date-time" },
"manifestHash": { "type": "string" },
"dimensions": {
"type": "array",
"items": {
"type": "object",
"required": ["id","range","higherIsBetter"],
"properties": {
"id": { "type": "string" },
"range": {
"type": "array",
"minItems": 2, "maxItems": 2,
"items": { "type": "number" }
},
"higherIsBetter": { "type": "boolean" },
"unit": { "type": "string" }
}
}
},
"dimensionRefs": { "type": "array", "items": { "type": "string" } },
"aggregation": { "type": "object" },
"persistence_policy": { "type": "object" },
"status": { "type": "string" },
"revocation": { "type": "string" },
"capabilities": { "type": "object" }
},
"additionalProperties": true
},
"proof": { "type": "object" }
},
"additionalProperties": true
}{
"hashing": {
"canonicalization": "URDNA2015",
"digest": "multihash",
"signalHash": "multihash(URDNA2015(VC-JSON))"
},
"deduplication": {
"key": "signalHash",
"policy": "drop-duplicates-within-window"
}
}{
"status": {
"format": "StatusList2021",
"endpoint": "https://status.example.org/v1",
"requirement": "MUST support one of {StatusList2021, SpaceStatusAPI}"
},
"revocation": {
"endpoint": "https://revocations.example.org/v1",
"semantics": "machine-readable boolean or reason code"
}
}| Threat | Attacker goal | Typical vectors | Protocol hooks (MUST/SHOULD) | Policy levers (Space) | Residual risk |
|---|---|---|---|---|---|
| Sybil | Inflate influence via many cheap IDs | Mass issuer DIDs rating a target, faucet accounts | DID requirement; canonical signalHash; status/revocation; signed Manifests; issuerRelation hint | Admission controls, deposits, issuer-diversity thresholds, min-raters, capped per-issuer weight | Collusion across orgs if attribution is weak |
| Collusion / rating rings | Reciprocal boosting; down-rating rivals | Closed loops of issuers; time-coordinated bursts | Provenance grammar; dedupe via signalHash; receipt trails | Windowed aggregation, diversity constraints (distinct issuers/org-hash), anomaly detection, audits | Sophisticated rings that mimic organic patterns |
| Reward hacking (Goodhart) | Optimize the metric, not the task | Extreme values on easy cases; cherry-picking; self-rating | issuerRelation; dimension semantics (range, higherIsBetter, unit); reproducible provenance | Adversarial test injection; tournament cross-checks; evaluator reputation; holdout rotations | Metric drift as tasks evolve |
| Provenance spoofing | Claim results not actually achieved | Fake artifact links; swapped datasets | Content addressing in provenance; canonical hashing; optional anchoring | Mandatory artifact re-execution for top-K; dispute windows | Private artifacts limit public re-runs |
| Replay / duplicate | Inflate weight via re-submit | Resend identical signals | AGTP-Nonce + Idempotency-Key; dedupe by signalHash | Sliding windows; per-issuer rate limits | Partition races (see below) |
| Eclipse / net splits | Isolate victims; create forked views | BGP/AS isolation; gateway manipulation | Manifest caching with ETag/validUntil; receipts with timestamps; optional ledger anchoring | Grace windows; quorum re-confirmation for critical scores | Short-lived inconsistencies during heal |
| Privacy leakage | Deanonymize subjects or raters | Linkage via sidecars; rich artifacts | Ephemeral vs persistent flag; optional commitment root; redaction allowed | Data-minimization catalog; retention ceilings; DP noise on published aggregates | Side-channel inference with auxiliary data |
| Governance capture | Control semantics or manifests | Registry monopoly; silent edits | Manifests as signed VCs; version pinning; multiple registries | Mirrors; client choice; deprecation windows | Soft capture via popularity |
Partition tolerance. During splits, accept 202 Accepted receipts with later resolution; cache last-known-good Manifests until validUntil; reconcile on heal via anchored hashes and dedupe by signalHash. Treat scores as tentative while status indicates degraded mode.
Credible neutrality. Protocol is mechanism-only (identity, attestation, provenance, minimal HTTP). Policy stays in Spaces.
Versioning.
- MAJOR.MINOR.PATCH; MAJOR may break wire semantics.
- Manifests are signed VCs with version, validFrom, validUntil, manifestHash. Cache with ETag; pin versions for reproducibility.
Change process.
- Proposal → reference implementation → conformance tests → release.
- Opt-in migrations: dual-serve old/new manifests during an overlap window; clients negotiate via /.well-known/agtp/capabilities.
Space-controlled parameters (examples).
- Aggregation window, min-raters, issuer caps.
- Eligibility gates (uptime, acceptance).
- Dispute windows and status semantics.
- Dimension registries and extension namespaces.
Goals. Enable private learning while publishing sufficient evidence for coordination.
- Ephemeral Signals: private VCs for local learning; retention ceilings (policy).
- Distillation: summarize into Persistent Signals; include optional commitment (Merkle root) to enable selective disclosure.
- Persistent Signals: public, discoverable, reproducible via provenance; artifacts may be redacted with attestations.
- Sidecars: keep minimal; avoid quasi-identifiers; use hashed org/AS hints for diversity checks.
- Advanced (policy/future): DP on aggregates; k-anonymity thresholds; MPC/TEE verification.
- DID/VC (normative): DID for identity; VC Data Integrity (Ed25519 2020 over URDNA2015) for Manifests and Signals; Status List or Space status API.
- A2A: Mandatory HTTP profile; optional DIDComm v2 profile maps nonce/idempotency and receipts to messages.
- MCP / tool RPCs: Run inside Spaces; executions produce Artifacts (CIDs) referenced in provenance.
- Other RPCs (JSON-RPC/gRPC): Treat method catalogs and logs as Artifacts; evaluators issue Signals tied to request/response CIDs.
- Content addressing: Any CIDv1-compatible scheme; publish resolver hints to improve interop.
- Verifiable rewards at scale: verifier receipts (TEE attestations, SNARK-friendly transcripts); dataset-slice commitments (KZG/IPA).
- Benchmark-from-live: rolling benchmarks from production interactions; adversarial mining; drift detection; freeze windows.
- Privacy-preserving aggregation: MPC/threshold aggregation; DP noise for public leaderboards; selective disclosure from commitment trees.
- Cross-Space normalization: mapping schemas with uncertainty and provenance for dimension scale alignment.
- Dimension registries: community-governed semantics, change logs, and deprecations.
- Conformance & fuzzing: fixtures for malformed VCs, nonce reuse, CID tampering; shared fuzz corpus.
- Anchoring standards: profiles for timestamp anchoring, re-org handling, and audit tooling.