Agentic Primitives

Agent relationships SDK: trust-fabric edge store (subject, object, relationshipType) with role taxonomy. Phase 1 ships edge-ID derivation + relationship-type constants + client skeleton; AgentRelationship.sol + RelationshipTypeRegistry.sol ports land in P

Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS). Pure crypto primitives; no session lifecycle (that's in delegation).

Off-chain skill CLAIM credentials + on-chain SkillDefinitionRegistry helpers (spec 251). Definitions on chain; the agent↔skill claim is a private vault credential pointing to a (skillId, version).

Policy-bound one-time key release (spec 277 §14): DecryptGrant construction + KAS verification + one-time replay store. Authority stays delegation/entitlement/policy; key-custody does the DEK unwrap.

Cloudflare adapter for @agenticprimitives/edge-runtime: Request→AdmissionRequest extraction (exact-byte preserving), the Workers rate-limiter binding as a SoftRateLimiter, and Service-Binding dispatch. Imports the platform runtime; the edge core never doe

Capability claim credentials (SkillClaimCredential) + on-chain SkillDefinitionRegistry helpers (spec 251). NOT Agent Skill SKILL.md packages.

Portable Agentic Trust Home contracts (spec 310): signed Home manifests, surface descriptors, inbox bindings, action cards, managed-agent/connected-app projections, control-plane events. Schema + validation + deterministic projection only — no routes, UI,

Intent-native DeFi Treasury Agent (spec 284): a domain composition over service-agent — skill catalog + profiles + treasury authority-scope/receipt helpers, evolving toward intent resolution, solver brokering, and DAG execution. Catalog = definitions + pl

Managed storage for Content Artifacts (SKILL.md, .ttl, .md, JSON-LD, images/video): the StoragePort provider abstraction + ContentArtifact/ArtifactBundle model that stores a content-primitives descriptor's bytes in a client-side-envelope-encrypted, conten

Vendor-neutral traffic-rate-limit + hard-usage-budget controls: VerifiedAuthorityContext, typed RateControlProfiles, cost units, HMAC-keyed buckets, and SoftRateLimiter/HardBudgetStore/ConcurrencyLimiter interfaces with in-memory reference impls. Cloudfla

Verifier-retained verification receipts (spec 303): commitment-split evidence that signature + scope + revocation were checked at time T. Public receipt = HMAC commitments only; private detail = vault-held opening material.

The Ring-0 agentic orchestration core (ADR-0044): the intent→plan→execute→observe loop, the Planner + ToolInvoker ports, and a deterministic rule-based planner. A first-party app expresses a goal; the loop plans which tools compose to satisfy it and runs

OpenAI-compatible chat-completions binding for the @agenticprimitives/orchestration Planner / AnswerComposer ports (the in-repo adapter, chain-state-viem pattern). Vendor-neutral: the consumer supplies baseUrl + model (Groq, Ollama, OpenRouter, …). create

The openac-sdk binding of privacy-credentials' ProvingBackendPort (spec 305 W2 / zkID alignment Z1): Prepare, Show and verify for the openac-sd-jwt-p256 suite. The only package that imports openac-sdk; Ring 0 carries no circuit.

ERC-4337 smart-account substrate: deterministic addressing, factory deployment, ERC-1271 signing, UserOp building.

Append-only audit event schema + sink interface. Transport-agnostic; consumers wire concrete sinks (console / D1 / Cloud Logging / etc.).

User authentication (passkey + SIWE + Google OAuth), JWT sessions, and pluggable signer interfaces.

Agentic Connect — the SSO broker (spec 224 / ADR-0014). Mints CAIP-10-subject, no-owner AgentSessions (asymmetric + JWKS); drives entry-flow convergence (connect-auth verify → identity-directory resolve → issue/bootstrap/disambiguate) with assurance floor

Custody-layer SDK: CustodyPolicy ABI, CustodyAction enum + arg builders, EIP-712 typed-data helpers, and Custodian/Trustee/CustodyCouncil types. Speaks custody-domain vocabulary only — no delegation / steward / caveat concepts (those belong in @agenticpri

Agent Naming Service SDK: hierarchical naming for Smart Agents (.agent TLD). Owns name normalization, namehash/labelhash, records schemas, and the AgentNamingClient (resolve / reverse / registry). Speaks naming-domain vocabulary only — no delegation / cav

Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.

Evidence-backed read model over canonical agents and their facets (ADR-0015 / spec 223). Declares the ports (NamingPort / OnChainReadPort / IndexerPort) + the query API with provenance + assurance. Not an authority; no eth_getLogs; no fallback. Adapters l

Monorepo-wide formal vocabulary (RDFS/OWL T-box + SHACL/SKOS C-box + A-box fixtures) for agentic primitives. Off-chain source of truth the on-chain ontology (ADR-0009) instantiates. Ships TTL/JSON-LD artifacts + typed IRI constants.

Port implementations for @agenticprimitives/identity-directory: NamingPort (wraps agent-naming), OnChainReadPort (viem readContract), IndexerPort (in-memory; SPARQL/GraphDB later). The one composition layer allowed to import agent-naming (spec 100 §4 / AD

Cross-cutting branded types and chain primitives shared across @agenticprimitives/* packages.

Verifiable Content Substrate SDK: name, resolve, commit, entitlement-gate, and cite off-platform content controlled by third-party rights holders. Owns CanonicalLocus / CorpusManifest / ContentDescriptor / CitationAssertion / Entitlement (FRBR-aligned), d

W3C Verifiable Credentials envelope + Eip712Signature2026 proof + DOLCE+DnS Situation bases + ontology-shape schema registration. Substrate for layers 12–15 credential types.

Scripture vertical for the verifiable-content substrate: the Bible canon (OSIS book codes), a versioned versification model, the scripture.verse selector, and alias parsing (scripture:book.chapter.verse + tolerant forms) that normalizes many surface gramm

FedCM IdP contract as pure builders + validators: web-identity manifest, provider config, accounts list, thin id-assertion claims, request validators. Generic; the app hosts + signs (ADR-0031).

Relying-party FedCM wrapper: navigator.credentials.get({identity}) → IdP token. The FedCM strategy injected into browser-identity's chooseSignIn. FedCM-first, not FedCM-only (ADR-0031).

AttestationRegistry SDK — EAS-aligned with bilateral consent. Owns Association + JointAgreement + Evidence + Outcome + Validation + TrustUpdate credential types asserted into a single on-chain registry per ADR-0023.

Off-chain geo CLAIM credentials + on-chain GeoFeatureRegistry helpers (spec 251). Features on chain; the agent↔feature claim is a private vault credential pointing to a (featureId, version).

Resolver layer skeleton (W1) — types + PassThroughResolver only. Full resolver engine deferred to W2.

Private, holder-resident related-agent credentials (person↔org links as vault situation credentials, never on-chain edges — ADR-0025) + scoped-delegation read caveats + list-query shapes. Composes verifiable-credentials + delegation.

PaymentMandate + ContextBinding + MandateConstraints + open/closed mode discrimination. Three W1 rails (x402, wallet, sponsored-userop). PaymentReceipt asserted into AttestationRegistry per ADR-0023.

Async, delegation-authorized Agent-to-Agent (A2A) task transport: Task/Message/Artifact runtime over a TaskStore port, JSON-RPC method handlers, SkillHandler dispatch, the A2aWireAdapter client, and scoped-grant caveat builders. Transport-agnostic core (s

Commitment-only AgreementRegistry SDK. Owns AgreementCredential shape (PD-22) + commitment math + bilateral status transitions + joint-assertion gateway.

Direct Lane intent matchmaking. Intent + ConstraintSet + AssumptionSet + ResolutionReceipt + IntentMatch + composite-score ranking. Resolver layer 4 folded into PassThrough stub in W1.

Generic named delegated-signer resolution — compose agent-naming + agent-account + delegation + key-custody into a signer for a named identity, authorized by a delegation chain. Vertical-agnostic; naming/account are injected.

Manifest-driven managed-KMS orchestrator: provision per-identity Cloud-KMS HSM signing keys + per-key IAM, resolve each agent's Smart Agent (agent-naming), derive + verify the EVM delegate address, and push the minimal runtime secrets to deploy targets wi

Durable resource/action/field/purpose/classification authorization over VC-compatible entitlement credentials (spec 277 §10). Matching engine + resolver; VC-proof/status layer is additive.

AP-native registry-building primitives: Smart-Agent-anchored registry entries, signed-card binding proofs, claim-slot schemas, lifecycle call builders, and event decoders for vertical registries. External registry publication/sync stays outside Ring 0.

viem-backed ChainProvider adapter for @agenticprimitives/chain-state: readContract-only isRevoked / connection-agnostic signature validation / isAcceptedSessionDelegation reads, pinned to a block for evidence.

Generic relying-party connect client: hand off to the central-auth Home (FedCM-first → OIDC redirect/popup), exchange the code for an SA-signed scoped delegation. The relying half of spec 230/259; no credential ever originates in the relying app.

Vendor-neutral edge ADMISSION layer: the EdgeAdapter interface, trusted-header hygiene, the GatewayAssertion verification port, and the admission pipeline (route resolution + size/depth/envelope + Stage-1 abuse limit). Owns admission only, never authority

Generic service-agent capability framework (spec 283): define -> assert -> entitle -> delegate -> primitive-plan -> execute -> receipt. Provider-neutral; all authority evaluators + primitives are injected. Domain catalogs (e.g. @agenticprimitives/treasury

Substrate Situation primitive (SituationV2, RoleBinding, EntityRef) — spec 324 W2.

The Agentic Interaction Fabric (spec 316): one canonical ExchangeRecordV1 + two-level exec/case FSM that absorbs messaging (envelope/inbox) and interactions (case/run) into an A2A-native, decentralized, low-latency substrate. Transport-agnostic core; the

Organization membership, enrollment, roles, revocation cascade (spec 324 W2).

Evidentiary dispute attestation (spec 307 / G-11): deterministically walk a relationship record + verification receipt and attest in_scope / out_of_scope / revoked_before_execution / stale_status_used / insufficient_evidence. Facts, never remedies.

Coordination core: Endeavor, OutcomeSpecification, CoordinationPlan, Participation — spec 332 W1.

Provider-neutral agent resolution primitives: agent discovery policy, signed sequenced AgentServicePublication with anti-rollback verification, private resolution grants, connection invitations, audience projection, and resolution provider ports. Resoluti

Privacy presentation layer (spec 305 / G-6): selectively-disclosed SD-JWT VC presentations, pairwise relationship pseudonyms, spec-304 issuer-key facet verification. One suite per request, never a fallback ladder.

The Ring-0 provenance projector (spec 316 §6): maps fabric exchanges + orchestration runs to a PRIVATE PROV-O / P-Plan A-box, and enforces the ADR-0040 public-projection firewall (S1). Sole writer of the private vault A-box; NEVER writes the public KB.

Cloudflare adapter for @agenticprimitives/rate-control: the SmartAgentBudgetDO Durable Object (the authoritative per-Smart-Agent hard-budget store, sharded by chainId+sponsorAgent) + a HardBudgetStore client that routes reserve/commit/release to the right

Vault subject authority primitives: role assignments scoped to vault-resident subjects, vault-record-scope grant compilation, and pure runtime decisions.

The chain-read authority port: resilient, evidence-bearing, fail-closed reads (isDelegationRevoked, verifySmartAgentSignature, isSessionDelegationAccepted) over multiple injected providers with circuit breakers, divergence detection, and bounded revocatio

Governed collaboration activities (spec 378 huddles): scope, run, participant and lifecycle contracts, admission rules as pure functions, and the media-provider port. No provider SDK, no UI.

The Developer Kit generator (spec 398 §10.3, spec 399 §3.6): `create-app <dir> --template product-repo` writes a product repository — pnpm workspace, exact @agenticprimitives/* pins, agentic.lock.json, `ap doctor` + `ap test` CI, a nightly live-gates work

Browser sign-in adapter seam: feature-detect FedCM and choose the browser-native path vs the guaranteed fallback. FedCM-first, not FedCM-only (ADR-0031).

The composed typed resolver (spec 346 §6.3/§8/§9): typed name → subject → derived type → (context → relationship) → permitted publication → bindings, returned as SEPARATE signals (subject / context / relationship / bindings / authority / evidence — never

Agentic Delegated Data Vault seam (spec 277) — the Vault read/write/list interface + data-classification taxonomy + persisted object envelope. Storage/runtime-agnostic; adapters (D1/R2/KMS) layer in behind it.

The two-tier context contract (spec 351 P0.11): public knowledge vs a subject's private records, entity resolution that refuses to guess, and the ContextProvider port.

The authority-aware agent harness (spec 350): the composition root that binds delegation mandates, the tool-policy risk ladder and receipts to the orchestration loop's ports.

Intent engagement protocol core (spec 336 §8): probe → response → offer → acceptance → mandate requirement → execute → receipt as pure documents, JCS digests, and two deterministic reducers. Transport-free; grants nothing.

An estate's public projection of its authority (spec 410 §4): the live-grant root and the membership root over blinded commitments, anchored on public ground; the authority presentation a verifier in another estate checks against them, learning that a gra

Node-side reference bindings of the provenance ports (spec 414 §5): the W3C RDFC-1.0 canonicalizer, SHACL validation over the published run shapes, a directory store, and the `ap conform provenance` suite (C1–C6) any binding is run through.

Temporary package placeholder for staged publishing

The AP Model Gateway's contract (spec 434): one request shape, profiles over a model catalog with one switch per model, the reserve-then-settle budget algebra, usage normalization, declared-and-receipted fallback, the provider adapters over the existing f

The typed client of the AP Model Gateway (spec 434): models.generate / stream / listProfiles under an app key or a session wire, and the orchestration bridges that let a harness swap planner, composer, structured-call and text-stream factories onto the ga