Modules
Portable, non-authorizing contracts for agent blueprints and their environment-local deployment manifests.
Strict unpadded base64url codec: the RFC 4648 §5 URL-safe alphabet with
all trailing = omitted (RFC 7515 §2 permits omission on the wire; this
protocol's wire form never carries padding, so padded input rejects).
The Blueprint artifact (base §6): an immutable, portable, inert statement
of intent, decoded and validated through the ONE generic field-registry
engine (AgentBlueprintProtocol.Registry) parameterized by this module's
18-member table.
Parse ceilings for the bounded JSON decoder — resource-exhaustion guards, distinct from the eight operational ceilings an artifact declares.
The bounds algebra: the pointwise narrowest intersection of the
Blueprint's declared bounds, the Deployment Manifest's host_bounds, and
the host's live policy, over the closed 13-bound vocabulary.
One named bound: name from the closed 13, class (:operational /
:protected), unit (:count | :millisecond | :token | :money | :ordinal), and the family's value shape.
A bound is data about limits and carries no authority.
A (possibly partial) set of the closed 13. Construction validates every
PRESENT name and value (:bound_unknown / :bound_value_invalid);
totality — all thirteen present — is demanded of all three sources at
intersect/1 time, never defaulted, because an implicit default is the
silent-widening hole.
A bound set is data about limits and carries no authority.
The typed evidence of one permitted narrowing (base §Evolution
:155-156): the field, its class and unit, the requested and effective
values, the source that produced the effective value (a Deployment or
host term, never a tenant or principal), and whether the host
acknowledged a protected clamp.
Clamp evidence is a record of narrowing, not a decision.
The effective set plus the clamp evidence list (name-sorted). The result records what the bounds imply; it is not a decision.
The three intersection sources plus the protected-clamp posture
(default :deny). Intersection inputs are host-supplied facts that
carry no authority.
RFC 8785 JSON Canonicalization Scheme over the closed tagged algebra
produced by AgentBlueprintProtocol.Json.
The compatibility surface : identity-exact or
error. A manifest identity — one build_identities member entry — is
matched only by an observed identity carrying the EXACT
(kind, name, version, digest) tuple. Version ranges deny
:compatibility_identity_inexact on BOTH sides (a range is malformed,
never silently unmatchable — the manifest side is decode-checked through
the registry table; verify/2 re-asserts it for struct-bypassed inputs,
the structural-bypass rim lesson, and checks the host-built observed side, which
never passes a decoder).
The host's observed build identities: what the environment actually
resolved. Host-built (never decoded), so verify/2 type-checks the
list itself.
Observed identities are host-supplied facts that carry no authority.
The conformance CLI : --corpus <dir> is REQUIRED
— no default, so a vacuous run is impossible — and the exit status is the
agreement verdict
The escript entry: the one place the package halts the VM. Delegates to
AgentBlueprintProtocol.Conformance.Cli.run/1 for everything else — argv
parsing, corpus loading, execution, and the report are all tested pure
surfaces there.
The escript entry reports conformance facts; it never authorizes anything.
The pure conformance-corpus loader and integrity verifier:
load/1 takes %{path => binary} and performs no I/O — only
the CLI touches the filesystem.
The pure report builder over a loaded corpus and runner results: overall agreement, exit status, counts.
The pure case executor over a loaded corpus: dispatches each case against the package's PUBLIC module surface — the runner adds no protocol capability of its own — and compares the result to the case's expectation.
The Deployment Manifest artifact (base §7, re-derived 2026-08-22): binds
exactly ONE Blueprint release digest to one local environment — portable
as a shape, resolved values local. Decoded and validated through the ONE
generic field-registry engine (AgentBlueprintProtocol.Registry)
parameterized by this module's 19-member table : the table, the
scan's open regions, and the digest domain are the only deltas from the
Blueprint pipeline.
The host-supplied inputs to verify_binding/3's observation-gated
stages: the host clock, the host's maximum tolerable attestation age,
and the currently OBSERVED descriptor digests by logical operation.
Absent inputs skip exactly their stages — see Deployment's moduledoc.
Observed facts are host-supplied records that carry no authority.
Observed facts are host-supplied records that carry no authority.
Tagged content digests over RFC 8785 canonical bytes.
The typed failure record: code + subject + optional
detail. This is the failure shape of the bounds-algebra surface; the
decode surfaces still return bare reason atoms and migrate here with the
composed import (a recorded contract delta).
The evidence record : the non-authorizing result of a verification pass — per-surface checks, effective bounds, clamp evidence, and extension facts.
The positional extension envelope shared by BOTH artifact tables:
{"critical": {namespace → payload}, "optional": {namespace → payload}},
digest-covered, with namespace form and total cardinality. Extracted from
Blueprint so the Deployment table carries the same judgment as
DATA instead of a copy of it — one envelope, one definition, two tables.
The COMPILED-IN extension registry: entries are module-attribute data, so registry content is a code release — drift is unrepresentable and a beam-census architecture gate asserts nothing reads a registry file at runtime.
The federation profile: the 23-member TaskEnvelope, the
lossy-aware A2A/MCP state codecs, and the carrier placement laws — the
executable half of the field-by-field mapping published as
federation_mapping/0 data.
The receiving context verify_commitment/2 compares a receipt
against: trusted keys, the issuer/subject/audience pins (each nil =
the receiver does not pin that member), and the previously-verified
terminal facts for conflict detection.
One row of the published field-by-field mapping: the logical field
(bijective with an envelope wire member), the A2A location, the MCP
Tasks location, and the verdict (:native | :partial |
:extension) re-derived against the pinned live sources.
A mapping row is published data that carries no authority.
A mapping row is published data that carries no authority.
Bounded JSON decoder over Erlang/OTP's :json.decode/3 custom-decoder hook.
Negotiation: the evolution gate an importing host runs
after canonical verification, before any semantic read. In a standalone
pass it runs immediately after canonical verification; in the composed
import (Reconcile.reconcile/3) the pinned stage order is
canonical → digest → negotiation → structure → portability → signatures → bind → bounds — the digest stage runs BEFORE negotiation
(the supersession of the "integrity last" ordering).
The negotiation result: the exact artifact revision, the honored required-core-field list, the supported critical / retained optional / quarantined namespaces, and typed notices (reason atoms — the typed Error notices are the Evidence surface). The outcome lists facts about revisions and extensions — it is not a decision. The outcome lists facts about revisions and extensions — it is not a decision.
The consumer's negotiation posture: the revision SET it supports, the
core fields it implements, an optional HOST-PINNED registry view
(%{namespace => ExtensionRegistry.t()} layered over the compiled
registry — hosts may supply lifecycle states, never remove compiled
entries), and the host-supplied schemas for critical namespaces
(%{namespace => schema_document}).
A support posture is a consumer's declaration that carries no authority.
A support posture is a consumer's declaration that carries no authority.
The never-portable structural guard: member-name and value-shape denylists over tagged values.
The closed, portable boolean predicate algebra carried by
deterministic_predicate evaluation assertions (base §6.6).
The one call per import : the composed non-authorizing pass over a Blueprint + Deployment pair under host inputs. Stage order is PINNED — canonical → digest → negotiation → structure → portability → signatures → bind → bounds — each stage reject-or-annotate, never repair, the earliest defect reported.
The host inputs reconcile needs: host policy bounds, negotiation
support, trusted public keys, the protected-clamp posture, and the
bind-time observations (host clock, max attestation age, observed
descriptor digests — the binding-surface delta
kept for parity). Observed BUILD IDENTITIES are deliberately
NOT an input: the pinned eight-stage order has no
compatibility stage, so carrying the field would manufacture false
assurance — hosts call verify_compatibility/2 for that surface (a
recorded contract delta: its descriptive Inputs list names observed
identities).
Reconcile inputs are caller-supplied facts that carry no authority.
The generic field-registry decode/validate engine: ONE
table-driven walk, parameterized by the registry table an artifact layer
supplies — Blueprint today, Deployment next. The engine knows tables,
not domains: every domain judgment (bounded schemas, signature envelopes,
predicates, extension forms, cross-field rules) arrives as data — checker
functions carried in the table and defined in the owning artifact module —
so the dependency direction is always artifact → engine.
Bounded JSON Schema 2020-12 dialect + instance validator.
Detached JWS signature envelope: RFC 7515 compact serialization with the
RFC 7797 b64=false unencoded, detached payload, Ed25519 signatures
verified through :crypto. Verify-only — the package never signs,
never accepts a private key on any function, and performs no key
discovery or trust selection; hosts supply the trusted keys.
The validated signed attributes of a signature entry, with
content_digest parsed to a Digest value and purpose the closed
purpose atom.
Signed attributes are signature evidence that carries no authority.
A host-supplied Ed25519 public key, matched by the producer-chosen
key_id. The package performs no discovery or trust selection.
A public key is verification input that carries no authority.