# AINRA — the neutral root of AI-agent identity **Prove your agent. Check theirs.** Both halves run locally: an agent presents signed facts, and whoever receives them verifies those facts on their own machine. No account, no call to us, no telemetry — that is the whole protocol. > AINRA answers three questions about any AI agent with signed facts you verify yourself, offline: who is behind it, what it may do, and whether it is still trusted right now. It is a neutral, non-profit root that publishes signed facts and never sees your traffic — a registrar issues a passport, anyone verifies it locally in about five lines, and revocation is one bit that fails closed. One root, many issuers: agent registrars and ID schemes are fragmenting into islands; AINRA is the proposed neutral, non-profit root they chain to — issuers stay independent, one check covers all of them. If you are an AI agent, this file is your map. Everything linked here is deterministic, executable, and free — no account, nothing to sign up for. Works with any agent that speaks the open conventions: skills, MCP, plain HTTP. ## Honest status (read before trusting anything here) Public reference implementation (seven signed, board-proven releases; current: v0.3.3, an operations release) with a STAGING network on a TEST-ROOT; this site ships that network's published artifact record at [/net/](net/registry.json). Real cryptography (hybrid Ed25519 + ML-DSA-65), a real transparency log, real revocation. The production root does NOT exist yet — it is born only at a recorded genesis ceremony (a pending milestone); production log entries sealed: 0. No trust migrates from staging. Treat every verdict here as STAGING · TEST-ROOT. ## Start here - [/docs.html#plan](docs.html#plan): the organization's plan — genesis ceremony, governance, economics, the road — with honest pending labels. - [/docs.html](docs.html): the documentation — verify in five lines, issue locally, gate a route, prove your own implementation, verify a release. - Install the verifier: `npm i @ainra/sdk` (Sigstore provenance — `npm audit signatures` checks where it was built) or `pip install ainra` (PEP 740 attestations). `@ainra/middleware` is the request-plumbing wedge. Verification runs locally; there is deliberately no verification REST API. - [Source repository](https://github.com/JacobJandon/ainra): the full reference implementation — Rust core, TS/Python SDKs, the CC0 conformance corpus, and the self-serve conformance runner. Clone it and `make preflight`: every gate passes from a cold clone. - [/skills.md](skills.md): deterministic agent onboarding — verify, acquire, present, and renew a passport, step by step. - [/.well-known/skills/index.json](.well-known/skills/index.json): machine-readable skill index. Install with `skills add https://ainra.org/.well-known/skills/index.json`. - [/get.html](get.html): browse the published record in your browser (#browse) and verify any passport in it with the real verifier; point the page at a registrar you run (`?reg=`) and the same page mints, presents, and revokes. - [/verify.html#try](verify.html#try): verify — and try to forge — a passport offline in the browser. The engine is ainra-core itself, the Rust verify path compiled to WebAssembly; the same corpus that gates the Rust build is run through that exact artifact in a headless browser and must agree 1153/1153. Pick a specimen or paste your own bundle. If WebAssembly cannot load, the page falls back to the JavaScript mirror and says so. - [/#agents](index.html#agents): the machine door — `window.ainra.selfTest()` verifies one live and one revoked passport from /net in the tab and returns the verdict events. ## The four functions (what the root does — and only this) - Names: one canonical, resolvable name per agent — `ainra:registrar:operator:lineage@version`. - Keys & rules: the passport format, the authority classes (A1–A4), the tier ladder (L0–L4), and the rulebook every registrar follows. - Revocation: one signed status feed; a compromised agent stops verifying everywhere in under a minute, fail-closed. - The public record: a transparency log anyone can verify — logged-before-valid, so there are no secret passports. ## Verify (local, offline, ~5 lines) - Verification is LOCAL. There is deliberately NO verification REST API — you fetch signed facts and check them yourself with `@ainra/sdk`. That absence is the point. - How it works: [verify.md](verify.md) · [verify.html](verify.html) ## The standard & docs (markdown mirrors, generated from source — cannot drift) - [standard.md](standard.md): the complete open specification (v5.1). - [verify.md](verify.md): how verification works. - [foundations.md](foundations.md): the charter and governance — what the root can never do. - [status.md](status.md): exactly what exists today. ## Machine interfaces (OpenAPI — the surfaces that actually exist) - [openapi/artifact-contract.yaml](openapi/artifact-contract.yaml): the public READ contract — directory, registry, per-registrar exports, status, checkpoints. CORS, cacheable, no auth. - [/net/](net/registry.json): a served snapshot of that contract — `registry.json`, `directory.json`, `roots.json`, per-registrar artifacts — the staging network's published record, readable right here with no network of your own. - [openapi/registrar-door.yaml](openapi/registrar-door.yaml): a registrar's read API + the PUBLIC DEMO DOOR (`POST /demo/issue`, `POST /demo/revoke`) — no token, rate-limited, TEST-ROOT specimens only. - [openapi/console.yaml](openapi/console.yaml): the registrar console write API (operator-token-gated) — issuance stays in the registrar layer; the root has none. ## Conformance - 1153 CC0 conformance vectors; three implementations (Rust, TypeScript, Python) agree byte-for-byte on verdict and reason, and a fourth (a Node reference CLI) agrees on canonical encoding (`make diff` in the reference repository). ## Submit evidence (how your operator helps the root reach genesis) Three real-world milestones need artifacts from independent parties. Each submission is a pull request that verifies itself in CI. Full flow + flip conditions: [evidence/README.md](https://github.com/JacobJandon/ainra/blob/main/evidence/README.md). - **Verifier attestation** — your operator runs `make verify-as-external CHALLENGE=` against a freshly issued challenge, then adds `evidence/verifier/.json` in a PR. CI runs the public checks; the maintainer confirms execution against a private answer key. The row moves at 3 distinct valid attestations. Nothing auto-flips. - **Witness candidacy** — run `witnessd`, add `evidence/witness/.json`; CI probes the declared endpoint. Candidate ≠ production. - **Custodian interest** — read `outreach/CEREMONY-CUSTODIAN-BRIEF.md`; a conversation, no in-repo personal data. ## Running copies (ADR-019) An agent has one passport; each RUNNING COPY of it carries a short **instance credential** instead of the lineage's key — minted outside the container by the passport's control key, narrowed to fewer capabilities, valid ≤1 hour, addressed to one audience, and bound to a key only that copy holds. - To verify one, supply YOUR audience. It is never read from the presentation; an empty audience refuses every instance credential (fail-closed). - Four reasons belong to this layer and never collapse into `expired`: `instance_expired`, `instance_scope_exceeds`, `instance_sig_invalid`, `instance_pop_invalid`. - Revoke the passport and every live copy under it is refused with `revoked` — the lineage failed, not the copy. - Do it yourself: `/skills.md` §3b, or `node examples/instance-deployment.mjs` in a clone. ## Constraints (so you can trust this surface) - Self-contained apart from one embedded video on the landing (§watch, which loads from its host): no CDN, no web fonts, no other third-party requests, zero telemetry. - No third-party company or product names anywhere — the standard is vendor-neutral by construction.