-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathdocs.html
More file actions
752 lines (708 loc) · 63.4 KB
/
Copy pathdocs.html
File metadata and controls
752 lines (708 loc) · 63.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Docs · Observer Protocol</title>
<link rel="preconnect" href="https://fonts.googleapis.com" />
<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@300;400;500;600&family=IBM+Plex+Sans:wght@300;400;500;600&family=Fraunces:ital,wght@0,300;0,600;0,900;1,300;1,600&display=swap" rel="stylesheet" />
<style>
:root {
--bg: #0a0a08;
--bg2: #111110;
--bg3: #1a1a18;
--border: #2a2a26;
--amber: #f5a623;
--amber-dim: #b8791a;
--amber-glow:#f5a62322;
--green: #4ade80;
--green-dim: #166534;
--text: #e8e8e0;
--text-dim: #888880;
--text-faint:#444440;
--blue: #7eb8f7;
--teal: #5eead4;
--purple: #a78bfa;
}
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
html { scroll-behavior: smooth; }
body { background: var(--bg); color: var(--text); font-family: 'IBM Plex Sans', sans-serif; font-size: 16px; line-height: 1.6; overflow-x: hidden; }
/* NAV */
nav { position: fixed; top: 0; left: 0; right: 0; z-index: 100; display: flex; align-items: center; justify-content: space-between; padding: 0 2.5rem; height: 56px; background: rgba(10,10,8,0.92); backdrop-filter: blur(12px); border-bottom: 1px solid var(--border); }
.nav-logo { font-family: 'IBM Plex Mono', monospace; font-size: 0.8rem; font-weight: 500; color: var(--amber); letter-spacing: 0.12em; text-transform: uppercase; text-decoration: none; }
.nav-links { display: flex; gap: 2rem; list-style: none; }
.nav-links a { font-family: 'IBM Plex Mono', monospace; font-size: 0.72rem; color: var(--text-dim); text-decoration: none; letter-spacing: 0.06em; transition: color 0.2s; }
.nav-links a:hover { color: var(--text); }
.nav-links a.active { color: var(--amber); }
.pulse { width: 6px; height: 6px; border-radius: 50%; background: var(--green); box-shadow: 0 0 6px var(--green); animation: pulse 2s infinite; display: inline-block; }
@keyframes pulse { 0%,100%{opacity:1} 50%{opacity:0.4} }
.nav-status { display: flex; align-items: center; gap: 0.5rem; font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-dim); }
/* PAGE HEADER */
.page-header { padding: 9rem 2.5rem 4rem; border-bottom: 1px solid var(--border); position: relative; overflow: hidden; }
.page-header::before { content: ''; position: absolute; inset: 0; background: radial-gradient(ellipse 50% 60% at 75% 40%, rgba(126,184,247,0.05) 0%, transparent 70%); pointer-events: none; }
.page-header-inner { max-width: 1100px; position: relative; display: grid; grid-template-columns: 1fr auto; gap: 3rem; align-items: start; }
@media (max-width: 768px) { .page-header-inner { grid-template-columns: 1fr; } }
.breadcrumb { font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-faint); letter-spacing: 0.1em; margin-bottom: 1.5rem; }
.breadcrumb span { color: var(--amber); }
.page-tag { display: inline-flex; align-items: center; gap: 0.5rem; font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--blue); letter-spacing: 0.12em; text-transform: uppercase; border: 1px solid #7eb8f744; padding: 0.3rem 0.8rem; margin-bottom: 1.5rem; background: #7eb8f711; }
h1 { font-family: 'Fraunces', serif; font-size: clamp(2.2rem, 4vw, 3.2rem); font-weight: 900; line-height: 1.08; letter-spacing: -0.02em; margin-bottom: 1.25rem; }
.page-sub { font-size: 1rem; color: var(--text-dim); max-width: 580px; line-height: 1.75; font-weight: 300; }
/* ON-PAGE NAV */
.doc-nav { background: var(--bg2); border: 1px solid var(--border); padding: 1.5rem; min-width: 200px; }
.doc-nav-title { font-family: 'IBM Plex Mono', monospace; font-size: 0.62rem; color: var(--text-faint); letter-spacing: 0.12em; text-transform: uppercase; margin-bottom: 1rem; }
.doc-nav-links { display: flex; flex-direction: column; gap: 0.5rem; }
.doc-nav-links a { font-family: 'IBM Plex Mono', monospace; font-size: 0.7rem; color: var(--text-dim); text-decoration: none; transition: color 0.2s; display: flex; align-items: center; gap: 0.5rem; }
.doc-nav-links a:hover { color: var(--amber); }
.doc-nav-links a::before { content: '→'; color: var(--text-faint); font-size: 0.6rem; }
/* SECTIONS */
section { padding: 4rem 2.5rem; border-bottom: 1px solid var(--border); }
section:last-of-type { border-bottom: none; }
.section-inner { max-width: 1100px; margin: 0 auto; }
.section-label { font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; letter-spacing: 0.16em; text-transform: uppercase; color: var(--amber); margin-bottom: 1rem; }
h2 { font-family: 'Fraunces', serif; font-size: clamp(1.5rem, 2.5vw, 2.2rem); font-weight: 600; line-height: 1.15; margin-bottom: 1rem; color: var(--text); }
.section-intro { font-size: 0.95rem; color: var(--text-dim); max-width: 680px; line-height: 1.8; margin-bottom: 2.5rem; font-weight: 300; }
/* QUICKSTART CARDS */
.qs-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(240px,1fr)); gap: 1px; background: var(--border); }
.qs-card { background: var(--bg2); padding: 1.5rem; text-decoration: none; display: block; transition: background 0.2s; }
.qs-card:hover { background: var(--bg3); }
.qs-icon { font-size: 1.4rem; margin-bottom: 0.6rem; }
.qs-tag { font-family: 'IBM Plex Mono', monospace; font-size: 0.6rem; color: var(--amber); letter-spacing: 0.1em; margin-bottom: 0.35rem; }
.qs-name { font-family: 'Fraunces', serif; font-size: 1rem; font-weight: 600; color: var(--text); margin-bottom: 0.3rem; }
.qs-meta { font-family: 'IBM Plex Mono', monospace; font-size: 0.6rem; color: var(--text-faint); margin-bottom: 0.6rem; }
.qs-desc { font-size: 0.82rem; color: var(--text-dim); line-height: 1.65; font-weight: 300; }
/* API REFERENCE */
.api-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 1.5rem; margin-bottom: 2.5rem; }
@media (max-width: 768px) { .api-grid { grid-template-columns: 1fr; } }
.api-group { background: var(--bg2); border: 1px solid var(--border); }
.api-group-header { padding: 0.85rem 1.25rem; border-bottom: 1px solid var(--border); font-family: 'IBM Plex Mono', monospace; font-size: 0.65rem; color: var(--amber); letter-spacing: 0.1em; text-transform: uppercase; }
.api-endpoint { display: flex; align-items: center; gap: 0.75rem; padding: 0.65rem 1.25rem; border-bottom: 1px solid var(--bg3); font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; transition: background 0.15s; }
.api-endpoint:hover { background: var(--bg3); }
.api-endpoint:last-child { border-bottom: none; }
.method { font-size: 0.58rem; font-weight: 600; padding: 0.15rem 0.4rem; border-radius: 2px; flex-shrink: 0; }
.method.get { background: #166534; color: #4ade80; }
.method.post { background: #1e3a5f; color: #7eb8f7; }
.method.patch { background: #44310a; color: #f5a623; }
.endpoint-path { color: var(--text-dim); flex: 1; }
.endpoint-desc { color: var(--text-faint); font-size: 0.6rem; }
.new-tag { font-size: 0.5rem; background: #7eb8f722; color: var(--blue); padding: 0.1rem 0.3rem; border: 1px solid #7eb8f744; }
/* SDK */
.sdk-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 2rem; }
@media (max-width: 768px) { .sdk-grid { grid-template-columns: 1fr; } }
.code-block { background: var(--bg); border: 1px solid var(--border); border-left: 2px solid var(--amber-dim); padding: 1.25rem; font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-dim); line-height: 1.9; overflow-x: auto; }
.code-comment { color: var(--text-faint); }
.code-key { color: var(--blue); }
.code-val { color: var(--green); }
.code-fn { color: var(--amber); }
.sdk-note { font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-faint); border: 1px solid var(--border); padding: 0.75rem 1rem; background: var(--bg2); margin-top: 1rem; display: flex; gap: 0.75rem; align-items: flex-start; }
.sdk-note-icon { color: var(--amber); flex-shrink: 0; }
/* DID RESOLVER */
.resolver-wrap { background: var(--bg2); border: 1px solid var(--border); padding: 2rem; }
.resolver-input-row { display: flex; gap: 0.75rem; margin-bottom: 1.5rem; flex-wrap: wrap; }
.resolver-input { font-family: 'IBM Plex Mono', monospace; font-size: 0.72rem; background: var(--bg); border: 1px solid var(--border); color: var(--text); padding: 0.6rem 0.9rem; flex: 1; min-width: 280px; outline: none; }
.resolver-input:focus { border-color: var(--blue); }
.btn-resolve { font-family: 'IBM Plex Mono', monospace; font-size: 0.72rem; padding: 0.65rem 1.25rem; background: var(--blue); color: #0a0a08; border: none; cursor: pointer; font-weight: 600; transition: all 0.2s; white-space: nowrap; }
.btn-resolve:hover { background: #a8d4fb; }
.resolver-output { background: var(--bg); border: 1px solid var(--border); padding: 1.25rem; font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-dim); line-height: 1.8; min-height: 160px; white-space: pre-wrap; word-break: break-all; }
/* DID RESOLUTION DOC */
.did-doc { display: grid; grid-template-columns: 1fr 1fr; gap: 2rem; }
@media (max-width: 768px) { .did-doc { grid-template-columns: 1fr; } }
.did-pattern { background: var(--bg2); border: 1px solid var(--border); padding: 1.5rem; }
.did-pattern-label { font-family: 'IBM Plex Mono', monospace; font-size: 0.62rem; color: var(--text-faint); letter-spacing: 0.1em; margin-bottom: 0.75rem; }
.did-pattern-value { font-family: 'IBM Plex Mono', monospace; font-size: 0.72rem; color: var(--teal); line-height: 1.8; margin-bottom: 0.5rem; }
.did-pattern-example { font-family: 'IBM Plex Mono', monospace; font-size: 0.65rem; color: var(--text-faint); line-height: 1.8; }
.did-table { width: 100%; border-collapse: collapse; margin-top: 1.5rem; }
.did-table th { font-family: 'IBM Plex Mono', monospace; font-size: 0.62rem; letter-spacing: 0.1em; text-transform: uppercase; color: var(--text-faint); text-align: left; padding: 0.65rem 1rem; border-bottom: 1px solid var(--border); }
.did-table td { font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-dim); padding: 0.65rem 1rem; border-bottom: 1px solid var(--bg3); }
.did-table td:first-child { color: var(--teal); }
.did-table tr:hover td { background: var(--bg2); }
/* SPEC LINKS */
.spec-cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px,1fr)); gap: 1px; background: var(--border); margin-top: 1rem; }
.spec-card { background: var(--bg2); padding: 1.5rem; text-decoration: none; display: block; transition: background 0.2s; }
.spec-card:hover { background: var(--bg3); }
.spec-card-tag { font-family: 'IBM Plex Mono', monospace; font-size: 0.6rem; color: var(--amber); letter-spacing: 0.1em; margin-bottom: 0.5rem; }
.spec-card h3 { font-family: 'Fraunces', serif; font-size: 1rem; font-weight: 600; color: var(--text); margin-bottom: 0.4rem; }
.spec-card p { font-size: 0.82rem; color: var(--text-dim); line-height: 1.65; font-weight: 300; margin-bottom: 0.75rem; }
.spec-card-cta { font-family: 'IBM Plex Mono', monospace; font-size: 0.65rem; color: var(--amber); }
/* FOOTER */
footer { border-top: 1px solid var(--border); padding: 2.5rem 2.5rem 2rem; background: var(--bg); }
.footer-inner { max-width: 1100px; margin: 0 auto; display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 1rem; }
.footer-brand { font-family: 'IBM Plex Mono', monospace; font-size: 0.72rem; color: var(--amber); letter-spacing: 0.12em; text-transform: uppercase; }
.footer-links { display: flex; gap: 2rem; flex-wrap: wrap; }
.footer-links a { font-family: 'IBM Plex Mono', monospace; font-size: 0.68rem; color: var(--text-faint); text-decoration: none; transition: color 0.2s; }
.footer-links a:hover { color: var(--text-dim); }
.footer-note { font-family: 'IBM Plex Mono', monospace; font-size: 0.62rem; color: var(--text-faint); margin-top: 1.5rem; max-width: 1100px; margin-left: auto; margin-right: auto; padding-top: 1rem; border-top: 1px solid var(--border); }
.divider { width: 40px; height: 1px; background: var(--amber-dim); margin-bottom: 2rem; }
</style>
</head>
<body>
<nav>
<a class="nav-logo" href="/">Observer Protocol</a>
<ul class="nav-links">
<li><a href="/verify.html">Verify</a></li>
<li><a href="/check.html">Check</a></li>
<li><a href="/supervisors.html">Supervisors</a></li>
<li><a href="/architecture.html">Architecture</a></li>
<li><a href="/docs.html" class="active">Docs</a></li>
<li><a href="/registry.html">Registry</a></li>
<li><a href="/agentic-terminal.html">Agentic Terminal</a></li>
</ul>
<div class="nav-status"><div class="pulse"></div>AIP v0.9</div>
</nav>
<!-- PAGE HEADER -->
<div class="page-header">
<div class="page-header-inner">
<div>
<div class="breadcrumb">OBSERVER PROTOCOL · <span>DOCS</span></div>
<div class="page-tag">Developer Documentation · AIP v0.9</div>
<h1>Documentation</h1>
<p class="page-sub">
Everything you need to register agents, issue credentials, verify identity, and integrate Observer Protocol into your stack. Open protocol, MIT licensed, self-hostable.
</p>
</div>
<div class="doc-nav">
<div class="doc-nav-title">On This Page</div>
<div class="doc-nav-links">
<a href="#getting-started">Getting Started</a>
<a href="#api-reference">API Reference</a>
<a href="#sdk">SDK</a>
<a href="#did-resolver">DID Resolver</a>
<a href="#spec-aip">Spec & AIP</a>
<a href="#did-resolution">DID Resolution</a>
</div>
</div>
</div>
</div>
<!-- GETTING STARTED -->
<section id="getting-started" style="background: var(--bg);">
<div class="section-inner">
<div class="section-label">Getting Started</div>
<h2>Choose your path.</h2>
<p class="section-intro">
Get started with Observer Protocol. Full developer documentation, SDK reference, and working examples on GitHub.
</p>
<div class="qs-grid">
<a href="https://github.com/observer-protocol/aip/tree/master/docs/developer-guide" target="_blank" class="qs-card">
<div class="qs-icon">📖</div>
<div class="qs-tag">START HERE</div>
<div class="qs-name">Developer Guide</div>
<div class="qs-meta">Architecture · API Reference · Chain Verification</div>
<div class="qs-desc">Complete developer documentation on GitHub. Covers agent registration, chain-agnostic verification, delegation credentials, VAC extensions, and sandbox testing.</div>
</a>
<a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/agent-quickstart.md" target="_blank" class="qs-card">
<div class="qs-icon">⚡</div>
<div class="qs-tag">60 SECONDS</div>
<div class="qs-name">Agent Quickstart</div>
<div class="qs-meta">Python · pip install observer-protocol</div>
<div class="qs-desc">Register an agent, prove key ownership, retrieve your VAC, and check your delegation status, all in 60 seconds. Working code you can run immediately.</div>
</a>
<a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/chain-verification.md" target="_blank" class="qs-card">
<div class="qs-icon">🔗</div>
<div class="qs-tag">CHAIN-AGNOSTIC</div>
<div class="qs-name">Chain Verification</div>
<div class="qs-meta">x402 / USDC · Lightning · TRON · Solana · ERC-8004</div>
<div class="qs-desc">Verify transactions on any supported rail. x402 dual verification (Coinbase facilitator + Base RPC). Lightning three-tier model. TRON TronGrid verification. Solana Ed25519. ERC-8004 / TRC-8004 on-chain registry integration.</div>
</a>
<a href="https://github.com/observer-protocol/op-policy-engine" target="_blank" class="qs-card">
<div class="qs-icon">📦</div>
<div class="qs-tag">NPM INSTALL · v<span data-engine-version="current">1.0.0-rc.22</span></div>
<div class="qs-name">Verify a credential</div>
<div class="qs-meta">npm install @observer-protocol/policy-engine</div>
<div class="qs-desc" data-shared-copy="offline-scope">Verify a delegation credential yourself — issuer, structure, validity window, eddsa-jcs-2022 proof against the issuer DID document, and revocation. No API key, no token, no Observer Protocol API in the path. It fetches the issuer's DID document and the revocation status list over ordinary HTTPS from the origins the credential names; point <code>offline.didDocumentPath</code> at a local copy and it makes no network call at all. The hosted verifier is a separate deployment running a different engine version; see the SDK section.</div>
</a>
<a href="https://github.com/observer-protocol/aip/tree/master/sdk/python" target="_blank" class="qs-card">
<div class="qs-icon">🐍</div>
<div class="qs-tag">DEPRECATED · v0.2.0, April 2026</div>
<div class="qs-name">Python SDK</div>
<div class="qs-meta">pip install observer-protocol</div>
<div class="qs-desc">Agent identity, delegation, x402 verification, magic link authorization, chargeback prevention, ERC-8004 integration. <strong>Deprecated and unmaintained since April 2026</strong>, and marked so on the registry. It still installs and anything pinned to it keeps working, but do not start here — see the SDK page for what replaces which part.</div>
</a>
<a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/network-operator-guide.md" target="_blank" class="qs-card">
<div class="qs-icon">🏗️</div>
<div class="qs-tag">FOR NETWORKS</div>
<div class="qs-name">Network Operator Guide</div>
<div class="qs-meta">Platforms · Marketplaces · Networks</div>
<div class="qs-desc">Integration path for platforms wanting to verify agent transactions, write to the audit trail, and register VAC extensions for their own attestation data.</div>
</a>
</div>
</div>
</section>
<!-- API REFERENCE -->
<section id="api-reference" style="background: var(--bg2);">
<div class="section-inner">
<div class="section-label">API Reference</div>
<h2>HTTP API v1.0.0 · Base URL: api.observerprotocol.org</h2>
<p class="section-intro">
Endpoint paths are literal, and the <code style="font-family:'IBM Plex Mono',monospace; font-size:0.85em; color:var(--amber); background:var(--bg); padding:0.1rem 0.4rem;">/api/v1/</code> prefix is not general: six of the twenty-nine endpoints listed below carry it and twenty-three are served at the bare path shown. The two are not interchangeable. Measured 13 August 2026: <code>/api/v1/health</code> returns 200 and <code>/health</code> returns 404, while <code>/observer/trends</code> returns 200 and <code>/api/v1/observer/trends</code> returns 404. DID document paths follow the W3C did:web resolution standard and are documented separately below. Full interactive documentation available via Swagger UI.
</p>
<div style="margin-bottom: 1.5rem; display: flex; gap: 1rem; flex-wrap: wrap;">
<a href="https://api.observerprotocol.org/docs" target="_blank" style="font-family:'IBM Plex Mono',monospace; font-size:0.72rem; color:var(--amber); text-decoration:none; border:1px solid var(--amber-dim); padding:0.5rem 1rem; background:var(--amber-glow);">Interactive Swagger UI ↗</a>
<a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/api-reference.md" target="_blank" style="font-family:'IBM Plex Mono',monospace; font-size:0.72rem; color:var(--text-dim); text-decoration:none; border:1px solid var(--border); padding:0.5rem 1rem;">OpenAPI YAML ↗</a>
</div>
<div class="api-grid">
<!-- AGENT IDENTITY -->
<div class="api-group">
<div class="api-group-header">Agent Identity</div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/observer/register-agent</span><span class="endpoint-desc">Register agent</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/observer/challenge</span><span class="endpoint-desc">Get challenge</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/observer/verify-agent</span><span class="endpoint-desc">Verify identity</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/observer/agents/{agent_id}</span><span style="font-family:'IBM Plex Mono',monospace;font-size:0.6rem;color:#f87171;border:1px solid #7f1d1d;padding:0.05rem 0.3rem;margin-left:0.4rem;">401</span><span class="endpoint-desc">Agent profile</span></div>
<div class="api-endpoint"><span class="method patch">PATCH</span><span class="endpoint-path">/api/v1/agents/{agent_id}</span><span class="endpoint-desc">Update agent</span></div>
</div>
<!-- DID RESOLUTION -->
<div class="api-group">
<div class="api-group-header">DID Resolution</div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/resolve/{did}</span><span class="endpoint-desc">Resolve any did:web <span class="new-tag">NEW</span></span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/observer/consolidate-identity</span><span class="endpoint-desc">Cross-rail consolidation</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/vp/verify</span><span class="endpoint-desc">Verify VP <span class="new-tag">NEW</span></span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/vp/submit</span><span class="endpoint-desc">Submit VP <span class="new-tag">NEW</span></span></div>
</div>
<!-- VAC -->
<div class="api-group">
<div class="api-group-header">Verifiable Agent Credentials</div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/vac/{agent_id}</span><span class="endpoint-desc">Get VAC</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/vac/{agent_id}/refresh</span><span class="endpoint-desc">Refresh VAC</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/vac/{agent_id}/history</span><span class="endpoint-desc">VAC history</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/vac/partners/{id}/attest</span><span class="endpoint-desc">Issue attestation <span class="new-tag">NEW</span></span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/vac/partners</span><span style="font-family:'IBM Plex Mono',monospace;font-size:0.6rem;color:#f87171;border:1px solid #7f1d1d;padding:0.05rem 0.3rem;margin-left:0.4rem;">404</span><span class="endpoint-desc">Partner registry</span></div>
</div>
<!-- AIP -->
<div class="api-group">
<div class="api-group-header">AIP <span class="new-tag" style="margin-left:0.5rem; background:#7f1d1d; color:#f87171; border-color:#7f1d1d;">2 OF THESE 404</span></div>
<div style="font-family:'IBM Plex Mono',monospace; font-size:0.62rem; color:#f87171; line-height:1.7; margin:0.4rem 0 0.6rem;">This group was headed “AIP v0.5 · NEW” until 8 August 2026. It was neither: the version was four releases stale and two of the endpoints below do not exist in production. The POST routes here are unverified — they were not exercised, because testing them would write to production.</div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/aip/credentials/delegation</span><span class="endpoint-desc">Issue delegation VC</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/aip/credentials/kyb</span><span class="endpoint-desc">Issue KYB VC</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/aip/chain/verify/{id}</span><span style="font-family:'IBM Plex Mono',monospace;font-size:0.6rem;color:#f87171;border:1px solid #7f1d1d;padding:0.05rem 0.3rem;margin-left:0.4rem;">404</span><span class="endpoint-desc">Verify chain</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/aip/revoke</span><span class="endpoint-desc">Revoke + cascade</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/aip/remediation/build</span><span class="endpoint-desc">Build remediation</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/aip/type-registry/{category}</span><span style="font-family:'IBM Plex Mono',monospace;font-size:0.6rem;color:#f87171;border:1px solid #7f1d1d;padding:0.05rem 0.3rem;margin-left:0.4rem;">404</span><span class="endpoint-desc">Type registry</span></div>
</div>
<!-- PROTOCOL ACTIVITY -->
<div class="api-group">
<div class="api-group-header">Protocol Activity</div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/api/v1/health</span><span class="endpoint-desc">Health check</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/api/v1/stats</span><span class="endpoint-desc">Aggregate stats</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/observer/feed</span><span style="font-family:'IBM Plex Mono',monospace;font-size:0.6rem;color:#f87171;border:1px solid #7f1d1d;padding:0.05rem 0.3rem;margin-left:0.4rem;">401</span><span class="endpoint-desc">Verified event feed</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/observer/trends</span><span class="endpoint-desc">Protocol trends</span></div>
<div class="api-endpoint"><span class="method post">POST</span><span class="endpoint-path">/observer/submit-transaction</span><span class="endpoint-desc">Submit transaction</span></div>
</div>
<!-- ORGANIZATIONS -->
<div class="api-group">
<div class="api-group-header">Organizations</div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/api/v1/protocols</span><span class="endpoint-desc">List protocols</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/api/v1/metrics</span><span class="endpoint-desc">Time-series metrics</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/api/v1/signals</span><span class="endpoint-desc">Protocol signals</span></div>
<div class="api-endpoint"><span class="method get">GET</span><span class="endpoint-path">/observer/badge/{agent_id}.svg</span><span class="endpoint-desc">Agent badge SVG</span></div>
</div>
</div>
<!-- DID RESOLVER TRY IT -->
<div id="did-resolver" style="margin-top: 1rem;">
<div class="section-label" style="margin-bottom: 1rem;">Try It Live · DID Resolution</div>
<div class="resolver-wrap">
<div class="resolver-input-row">
<input class="resolver-input" type="text" id="did-input" placeholder="did:web:observerprotocol.org:agents:maxi-0001" />
<button class="btn-resolve" onclick="resolveDID()">Resolve DID →</button>
</div>
<div class="resolver-output" id="resolver-output"># Enter a DID above and click Resolve.
# Endpoint: GET https://api.observerprotocol.org/resolve/{did}
#
# Example DID:
# did:web:observerprotocol.org:agents:maxi-0001</div>
</div>
<div style="margin-top:0.75rem; background:var(--bg); border:1px solid var(--border); border-left:2px solid var(--blue); padding:1.25rem; font-family:'IBM Plex Mono',monospace; font-size:0.68rem; color:var(--text-dim); line-height:1.9; overflow-x:auto;">
<span style="color:var(--text-faint)"># Resolve any did:web DID document</span><br/>
curl <span style="color:var(--amber)">https://api.observerprotocol.org/resolve/did:web:observerprotocol.org:agents:maxi-0001</span><br/><br/>
<span style="color:var(--text-faint)"># Returns W3C DID Document with verification methods and service endpoints</span>
</div>
</div>
</div>
</section>
<!-- SDK -->
<section id="sdk" style="background: var(--bg);">
<div class="section-inner">
<div class="section-label">SDK</div>
<h2>@observer-protocol/policy-engine</h2>
<p class="section-intro">
<span data-shared-copy="offline-scope">Verification, offline, from npm.</span> Node 18+, MIT license. This is the package the rail
adapters depend on and the one under active release.
<br><br>
<span data-shared-copy="offline-scope">Offline verification is not an SDK detail. It is the protocol's central affordance</span> and it has
its own page: <a href="/verify.html" style="color:var(--amber);">verify a record</a>, with a
runnable transcript, a field-by-field account of what each element proves and what it does not,
and two artifacts published specifically because they must fail.
</p>
<div class="sdk-grid">
<div>
<div class="code-block">
<span class="code-comment"># Install</span>
npm install @observer-protocol/policy-engine
<span class="code-comment">// Verify a delegation credential you were given.</span>
<span class="code-comment" data-shared-copy="offline-scope">// No API key, no Observer Protocol API in the path.</span>
<span class="code-comment">// Fetches the issuer DID document and status list</span>
<span class="code-comment">// over HTTPS; offline.didDocumentPath removes that.</span>
<span class="code-key">import</span> { verifyCredentialObject } <span class="code-key">from</span> <span class="code-val">'@observer-protocol/policy-engine'</span>;
<span class="code-key">const</span> verdict = <span class="code-key">await</span> <span class="code-fn">verifyCredentialObject</span>(
mandate, <span class="code-comment">// the signed delegation credential</span>
config, <span class="code-comment">// VerifierConfig: pinned issuer, schema allowlist</span>
Date.<span class="code-fn">now</span>() <span class="code-comment">// evaluated at this instant</span>
);
<span class="code-comment">// Checks the pinned issuer, the validity window, the</span>
<span class="code-comment">// eddsa-jcs-2022 proof against the issuer DID document,</span>
<span class="code-comment">// structure, and revocation where the credential</span>
<span class="code-comment">// carries a credentialStatus entry.</span>
<span class="code-comment">//</span>
<span class="code-comment">// Structure and revocation are narrower than they</span>
<span class="code-comment">// read. Read the note below before relying on either.</span>
<span class="code-comment">//</span>
<span class="code-comment">// Note: verifyCredential(config, nowMs) is a DIFFERENT</span>
<span class="code-comment">// function and does not take the credential.</span>
<span class="code-comment">// Types are the reference; no worked example ships yet.</span>
</div>
<div class="sdk-note">
<div class="sdk-note-icon">⚠</div>
<div><strong>Two of those five checks establish less than the line above reads.
Measured 13 August 2026 against <code><span data-engine-version="historical">1.0.0-rc.10</span></code>
and re-measured the same day against <code><span data-engine-version="historical">1.0.0-rc.12</span></code>,
which is the version this page now documents. Both runs produced identical results.</strong>
<br><br>
<strong>Structure does not read the schema the credential declares.</strong>
<code>validateStructure</code> is synchronous and performs no fetch. It checks the shape
the engine already knows, and it checks that <code>credentialSchema.id</code> appears in
your <code>schemaAllowlist</code>; it does not retrieve the document at that URL. A
credential declaring <code>delegation/v2.7.json</code> while omitting
<code>credentialStatus</code>, which is in that schema's <code>required</code> list,
returns <code>{ ok: true }</code>. Pinning a schema version pins a string, not the
constraints the version exists to impose.
<br><br>
<strong>Revocation is fail-closed until it has a cached copy, and permissive afterwards.</strong>
With no cache and an unreachable status list the verdict is a denial:
<code>[revocation] status could not be established: unreachable (fetch failed) and no
cached copy exists</code>. After one successful fetch, the same unreachable list returns
<code>allow: true</code>, <code>reason: 'credential verified'</code> and
<code>checks.revocation: 'not-revoked'</code>. The substitution is recorded only in
<code>notes</code>, as <code>served from cache aged 0.0h (limit 24h)</code>, and
<code>checks</code> carries no value that distinguishes a live answer from a cached one
even though it carries <code>'status-absent'</code> and <code>'not-configured'</code> for
other checks that did not run. The staleness limit is measured against the cached file's
own age, not against the <code>nowMs</code> you pass in. Read <code>notes</code>, not only
<code>checks</code>.
<br><br>
<strong>The other three hold as written.</strong> The issuer pin is enforced: a credential
whose <code>issuer</code> differs from <code>config.issuerDid</code> is denied at the
structure gate with <code>issuer … does not match the pinned trusted issuer
…</code>, including when that credential is validly signed by a key its own domain
publishes and raises the mandate ceiling. The validity window and the
<code>eddsa-jcs-2022</code> proof both deny as documented.</div>
</div>
<div class="sdk-note">
<div class="sdk-note-icon">⚠</div>
<div><strong>Correction, 8 August 2026.</strong> This note previously said the hosted
verifier required a partner bearer token with no self-serve route. That was wrong, and
stating the consequence matters more than stating the new fact: <strong>nobody tested it,
the claim was believed, and it was carried into a planning document as a premise</strong>
that work was then scoped against. A wrong line in documentation does not stay in
documentation.
<br><br>
The same audit found four endpoints on this page that return 404 in production, one of
them — then written as <code>/api/v1/resolve/{did}</code> — sitting directly
beside a copy-pasteable <code>curl</code> command. That is the one that would have cost a
developer an afternoon before they concluded the fault was theirs.
<br><br>
<strong>Resolved 9 August 2026, and it was not a missing endpoint.</strong> DID resolution
is live at <code>GET /resolve/{did}</code> and returns a W3C DID Resolution Result; only the
path on this page was wrong, and the 404 badge beside it made an available capability look
absent for as long as the wrong path stood. The row, the <code>curl</code> and the live
resolver above all point at the working path now. Three of the four remain 404 and are still
badged: <code>/vac/partners</code>, <code>/aip/chain/verify/{id}</code> and
<code>/aip/type-registry/{category}</code> — checked at both the bare and
<code>/api/v1/</code> prefixes.
<code>verify.observerprotocol.org</code> is open: its <code>/version</code> reports
<code>verification.open: true</code> at 60 requests per caller per minute, and an
unauthenticated <code>POST /v1/verify</code> returns 200 with a signed result.
<br><br>
It is a <em>different build</em>, though. The hosted service reports
<code>engine.running: "0.3.3"</code>; the package above is <code><span data-engine-version="current">1.0.0-rc.22</span></code>. Re-measured against
rc.10 on 9 August 2026: they agree on 7 of the 8 artifacts this site publishes. The eighth is
never evaluated by the hosted engine at all — it is refused at that deployment's issuer
allowlist, which does not carry the testbed issuer. So the agreement is on samples rather
than a shared code path, and it is one sample narrower than the sample set. Tracked as
<a href="https://github.com/observer-protocol/op-verify-service/issues/1" target="_blank" rel="noopener" style="color:var(--amber);">op-verify-service#1</a>;
this notice comes off when it lands. Where they disagree, the published package is
authoritative.</div>
</div>
</div>
<div>
<div class="code-block">
<span class="code-comment">// What this package actually exports for verification.</span>
<span class="code-comment">// Checked against the installed package, 13 August 2026.</span>
<span class="code-fn">verifyCredentialObject</span>(cred, config, nowMs)
<span class="code-comment">// structure + issuer pin + full crypto</span>
<span class="code-fn">verifyCredentialCrypto</span>(cred, config, nowMs)
<span class="code-comment">// crypto only. NO structure, schema or issuer-pin</span>
<span class="code-comment">// gate. Gate the trust anchor by other means.</span>
<span class="code-fn">enforceMandate</span>(ctx, cred, config, resolved)
<span class="code-comment">// the mandate check, against a decoded transfer</span>
</div>
<div class="sdk-note">
<div class="sdk-note-icon">⚠</div>
<div><strong>Correction, 13 August 2026.</strong> This panel published a sample calling
<code>observer.verifyAgent</code>, <code>observer.recordTransaction</code> and
<code>observer.getVAC</code>, under the heading of this package. No <code>observer</code>
object was defined anywhere on this page and the package exports no such object; those
three are operations of the deprecated SDK, and two of them are HTTP calls rather than
library functions. A reader copying that block had nothing to bind <code>observer</code>
to. The panel now lists the entry points the installed package exports.</div>
</div>
<div style="margin-top:1rem; display:flex; gap:0.75rem; flex-wrap:wrap;">
<a href="https://github.com/observer-protocol/aip/tree/master/sdk" target="_blank" style="font-family:'IBM Plex Mono',monospace; font-size:0.68rem; color:var(--amber); text-decoration:none; border:1px solid var(--amber-dim); padding:0.4rem 0.85rem; background:var(--amber-glow);">GitHub → sdk-js ↗</a>
<span style="font-family:'IBM Plex Mono',monospace; font-size:0.68rem; color:var(--text-faint); border:1px solid var(--border); padding:0.4rem 0.85rem;">npm link removed — see note</span>
</div>
</div>
</div>
</div>
</section>
<!-- SPEC & AIP -->
<section id="spec-aip" style="background: var(--bg2);">
<div class="section-inner">
<div class="section-label">Spec & AIP</div>
<h2>Open standards. Versioned specs.</h2>
<p class="section-intro">
Observer Protocol is governed by open specifications maintained on GitHub. AIP v0.9 was ratified on 25 July 2026 and is tagged <code>v0.9</code> in the specification repository, with the review record in its pull request. It is additive over v0.6 through v0.8: an implementation conforming to any of those remains conforming.
</p>
<div class="spec-cards">
<a href="https://github.com/observer-protocol/aip" target="_blank" class="spec-card">
<div class="spec-card-tag">PROTOCOL SPEC · CC BY 4.0</div>
<h3>Observer Protocol Spec</h3>
<p>The canonical specification for OP: identity model, event schema, verification logic, VAC structure, and API reference. Version controlled on GitHub.</p>
<div class="spec-card-cta">github.com/observer-protocol/aip ↗</div>
</a>
<a href="https://github.com/observer-protocol/aip/blob/main/aip-v0.9-worldid-linking.md" target="_blank" class="spec-card">
<div class="spec-card-tag">AIP v0.9 · RATIFIED 25 JULY 2026</div>
<h3>Agent Interaction Protocol</h3>
<p>AIP governs how agents interact: delegation credentials, magic-link authorization, authorization proofs, chargeback prevention, and type registry.</p>
<div class="spec-card-cta">Read the AIP v0.9 spec ↗</div>
</a>
<a href="https://github.com/observer-protocol/aip/blob/master/docs/developer-guide/api-reference.md" target="_blank" class="spec-card">
<div class="spec-card-tag">OPENAPI · OAS 3.0</div>
<h3>API OpenAPI Spec</h3>
<p>Machine-readable API specification in OpenAPI 3.0 format. Use to generate client SDKs, validate requests, or power your own Swagger UI instance.</p>
<div class="spec-card-cta">API-SPEC-OPENAPI.yaml ↗</div>
</a>
<a href="./architecture.html" class="spec-card">
<div class="spec-card-tag">CANONICAL REFERENCE · PERMANENT URL</div>
<h3>Architecture Document</h3>
<p>The permanent citable reference for grants, investor materials, developer documentation, and academic reference. Updated 13 August 2026.</p>
<div class="spec-card-cta">observerprotocol.org/architecture ↗</div>
</a>
<a href="https://observerprotocol.org/schemas/x402/v1.json" target="_blank" class="spec-card">
<div class="spec-card-tag">W3C JSON SCHEMAS · LIVE URLS</div>
<h3>Credential Schemas</h3>
<p>X402PaymentCredential, Delegation v2 (three-level authorization), Settlement Receipt v1 (chargeback prevention). All $id URLs resolve.</p>
<div class="spec-card-cta">observerprotocol.org/schemas/ ↗</div>
</a>
<a href="https://github.com/observer-protocol/aip/tree/master/rails/erc8004" target="_blank" class="spec-card">
<div class="spec-card-tag">ON-CHAIN REGISTRY · LIVE</div>
<h3>ERC-8004 / TRC-8004 Integration</h3>
<p>On-chain agent identity and ERC-8004 registry integration. Indexers for Base and TRON mainnet, cross-registry DID resolution, registration file pinning, and OP validator on Base.</p>
<div class="spec-card-cta">rails/erc8004/ on GitHub ↗</div>
</a>
</div>
</div>
</section>
<!-- DID RESOLUTION -->
<section id="did-resolution" style="background: var(--bg);">
<div class="section-inner">
<div class="section-label">DID Resolution · Reference</div>
<h2>How did:web resolution works on OP.</h2>
<p class="section-intro">
Observer Protocol uses the W3C <code style="font-family:'IBM Plex Mono',monospace; font-size:0.85em; color:var(--teal); background:var(--bg2); padding:0.1rem 0.4rem;">did:web</code> method. DID Documents are served at standard URL patterns, not through the API. This is intentional: DID resolution is a protocol-level concern, not an API endpoint.
</p>
<div class="did-doc">
<div>
<div class="did-pattern">
<div class="did-pattern-label">AGENT DID PATTERN</div>
<div class="did-pattern-value">did:web:observerprotocol.org:agents:{agent_id}</div>
<div class="did-pattern-example">→ resolves to:<br/>https://observerprotocol.org/agents/{agent_id}/did.json</div>
</div>
<div class="did-pattern" style="margin-top: 1px;">
<div class="did-pattern-label">ORG DID PATTERN</div>
<div class="did-pattern-value">did:web:{org-domain}:op-identity</div>
<div class="did-pattern-example">→ resolves to:<br/>https://{org-domain}/op-identity/did.json</div>
</div>
<div class="did-pattern" style="margin-top: 1px;">
<div class="did-pattern-label">ROOT DID PATTERN</div>
<div class="did-pattern-value">did:web:observerprotocol.org</div>
<div class="did-pattern-example">→ resolves to:<br/>https://observerprotocol.org/.well-known/did.json</div>
</div>
</div>
<div>
<p style="font-size:0.88rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1.5rem;">
The W3C did:web method transforms a DID into an HTTPS URL by replacing colons with forward slashes. Anyone with HTTPS access can resolve an OP DID without querying the OP API. This is what makes agent identity truly portable.
</p>
<p style="font-size:0.88rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1.5rem;">
The <strong style="color:var(--text);">domain mismatch rule</strong>: an agent's DID domain must match its organization's DID domain. A mismatch is treated as a fraud signal by AIP-compliant implementations.
</p>
<table class="did-table">
<thead>
<tr>
<th>DID Component</th>
<th>Resolves To</th>
</tr>
</thead>
<tbody>
<tr><td>did:web:example.com</td><td>https://example.com/.well-known/did.json</td></tr>
<tr><td>did:web:example.com:agents:abc</td><td>https://example.com/agents/abc/did.json</td></tr>
<tr><td>did:web:example.com:op-identity</td><td>https://example.com/op-identity/did.json</td></tr>
</tbody>
</table>
<div style="margin-top:1rem; font-family:'IBM Plex Mono',monospace; font-size:0.65rem; color:var(--text-faint);">
Compatible with DIF Universal Resolver · W3C DID Core spec · did:web method spec
</div>
<h3 style="font-family:'Fraunces',serif; font-size:1.1rem; font-weight:600; margin:2.5rem 0 0.5rem;">Deriving an agent DID from a public key</h3>
<p style="font-size:0.9rem; color:var(--text-dim); line-height:1.8; font-weight:300; max-width:700px; margin-bottom:1rem;">
The derivation is deterministic and you can reproduce it without us, which is the point: an agent's identifier is a function of its key, not a record we assign. Ed25519 shown here because it is the same curve Solana uses, so a Solana keypair derives an agent DID with no extra material.
</p>
<div class="code-block">
<span class="code-comment">// agent_id = sha256(public_key_hex)[:32]</span>
<span class="code-comment">// agent_did = did:web:observerprotocol.org:agents:<agent_id></span>
<span class="code-key">import</span> crypto <span class="code-key">from</span> <span class="code-val">'node:crypto'</span>;
<span class="code-comment">// Any Ed25519 public key, hex-encoded. From @solana/web3.js this is</span>
<span class="code-comment">// Buffer.from(keypair.publicKey.toBytes()).toString('hex')</span>
<span class="code-key">const</span> publicKey = <span class="code-val">'<ed25519-public-key-hex>'</span>;
<span class="code-key">const</span> agentId = crypto.<span class="code-fn">createHash</span>(<span class="code-val">'sha256'</span>)
.<span class="code-fn">update</span>(publicKey)
.<span class="code-fn">digest</span>(<span class="code-val">'hex'</span>)
.<span class="code-fn">slice</span>(0, 32);
<span class="code-key">const</span> agentDID = <span class="code-val">`did:web:observerprotocol.org:agents:${agentId}`</span>;
</div>
<div style="margin-top:0.75rem; font-family:'IBM Plex Mono',monospace; font-size:0.62rem; color:var(--text-faint); line-height:1.8;">
Note the input is the hex <em>string</em>, not the raw bytes. Hashing the bytes yields a different id and a DID that will not resolve.
</div>
</div>
</div>
</div>
</section>
<!-- CONVENTIONS AND RECORDED DECISIONS -->
<section style="border-top:1px solid var(--border);">
<div class="section-inner">
<div class="section-label">Conventions and recorded decisions</div>
<h2>Three things a reviewer will ask about.</h2>
<p class="section-intro">
Written down here because the answer is stronger recorded than reconstructed under questioning, and because two of the three are proposals rather than shipped behaviour. Which is which is stated.
</p>
<div style="border:1px solid var(--border); padding:1.75rem; margin-bottom:1.5rem;">
<div style="font-family:'IBM Plex Mono',monospace; font-size:0.68rem; letter-spacing:0.12em; text-transform:uppercase; color:var(--amber); margin-bottom:0.9rem;">Rail identifiers · PROPOSED, not shipped</div>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<code>ClearingSystemCode:PaymentProduct</code> for fiat, CAIP-2 for chains. One field, one parser, both worlds: <code>USABA:ACH.CCD</code>, <code>GBDSC:FPS</code>, <code>SGIBG:PAYNOW</code>, <code>eip155:8453</code>.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
The left half resolves against the ISO 20022 external clearing system code set, which appears in every <code>pain.001</code>, so it is not a vocabulary we invent or maintain. The right half distinguishes products sharing a clearing system, which is a real collision rather than a hypothetical one: ACH credit and Fedwire are different products on one system. It mirrors CAIP-2's <code>namespace:reference</code> grammar, so <code>eip155:8453</code> parses under it unchanged and a fiat rail does not force a parallel identifier space.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300;">
<strong style="color:var(--amber);">What actually ships today:</strong> <code>rail</code> is a free-text string. The published <code>delegation/v2.7</code> schema documents it that way, with examples <code>'usdt-trc20'</code> and <code>'lightning'</code>, and no issued credential carries the grammar above. Schema URLs are immutable, so adopting it means a new schema version rather than an edit. Treat this as what the field is becoming, not what it contains.
</p>
</div>
<div style="border:1px solid var(--border); padding:1.75rem; margin-bottom:1.5rem;">
<div style="font-family:'IBM Plex Mono',monospace; font-size:0.68rem; letter-spacing:0.12em; text-transform:uppercase; color:var(--amber); margin-bottom:0.9rem;">Where an attestation reference resolves · DECIDED</div>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
A fiat reference field carries 31 characters or fewer, so a downstream party may hold only a pointer. Something has to serve what it points at, and hosting that at a vendor endpoint is uncomfortable: it puts us in the payment path and <span data-shared-copy="offline-scope">sits badly beside a claim that verification needs nothing from us</span>.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong style="color:var(--text);">Resolution through Observer Protocol infrastructure is defensible as a protocol layer rather than a vendor inserting itself, and only while all three of these hold:</strong>
</p>
<ol style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin:0 0 1rem 1.25rem;">
<li style="margin-bottom:0.5rem;"><strong style="color:var(--text);">The host is configurable, and a principal serving their own attestations at their own domain is a first-class option</strong> rather than a special case. Where one is configured, it is the default.</li>
<li style="margin-bottom:0.5rem;"><strong style="color:var(--text);">Resolution is never required for verification.</strong> <span data-shared-copy="offline-scope">An artifact in hand verifies offline with nothing from us.</span> Resolution serves the case where a party holds only a reference. If verification ever depends on us being reachable, the claim is broken and the decision is void.</li>
<li><strong style="color:var(--text);">The resolver is self-hostable from published source</strong>, like everything else in the protocol.</li>
</ol>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300;">
The three conditions are the decision. A resolver that quietly stopped satisfying any one of them would not be a degraded version of this; it would be the thing this decision was taken to avoid.
</p>
</div>
<div style="border:1px solid var(--border); border-left:2px solid #7f1d1d; padding:1.75rem;">
<div style="font-family:'IBM Plex Mono',monospace; font-size:0.68rem; letter-spacing:0.12em; text-transform:uppercase; color:#f87171; margin-bottom:0.9rem;">Decision attestations · document retained, signature verifiable, references unchecked, no published schema</div>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
A decision attestation records what was decided, under which policy version and content hash, over which inputs (as a digest), by which party, with the decider kept separate from the mandate issuer, and at which assurance level (<code>self-declared</code> versus <code>independently-observed</code>).
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong>Correction, 13 August 2026. This section previously read "there is no published schema for it, and no verifier accepts one." The first half is true. The second was false, and it was false in the direction that reads as modesty.</strong> The published package verifies a decision attestation, and what it establishes is narrower than the word verifier suggests, so both halves are stated here rather than one.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong style="color:var(--green);">What it does establish.</strong> <code>verifyDecisionAttestation</code>, exported from <code>@observer-protocol/policy-engine</code>, checks an Ed25519 signature over a canonicalisation of the <em>whole</em> document. Measured against <code><span data-engine-version="historical">1.0.0-rc.10</span></code> and re-measured against
<code><span data-engine-version="historical">1.0.0-rc.12</span></code>, both on 13 August 2026 with identical
results: no field can be altered, added or removed without the check failing, including fields the function never reads. It also requires that the identifier the payment cites is the identifier the document carries. So a third party learns that a named key signed those exact bytes, and that nobody has changed them since. That is non-repudiation, and it is real.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;" data-shared-copy="offline-scope">
<strong style="color:var(--green);">And there is a document left to run it on.</strong> The function takes the attestation document and its signature as arguments and cannot go and find them: its own refusal text for the case where they are absent reads <em>a decisionId is an identifier, not a locator</em>. A deployment that checked an attestation on receipt and kept only the verdict would leave a determination that nobody could re-check afterwards, including us. On deployments running the determination-records path, the raw document and signature are preserved through ingestion and stored as base64 of exactly what was received, beside a <code>documentHash</code> that is sha256 over those bytes. <strong>A determination is verifiable by a party who was not there, offline and against a published key.</strong>
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong>Two measurements, and they are not the same kind.</strong> The one you can run: <code>verify-samples/ppp-determination-refused-outcome.json</code> is a stored determination record published on this domain, sha256 over its stored document bytes reproduces its <code>documentHash</code>, and the record returns <code>attested</code> under the version <code>npm install</code> serves. The one you are taking from us: an external implementation submitted 2,000 determinations and found every stored document byte-identical to what it sent, with the stored hash matching, on both the determination-only path and the payment path, checked in full rather than sampled. That figure was measured on the payment stack and recorded here on 17 August 2026. Nothing in this repository re-derives it.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong>Precisely which bytes.</strong> The stored document is the wire form. The signature is checked against a JCS canonicalisation re-derived from the parsed document, so for a document whose wire form is already canonical the two are the same sequence and for one that is not they differ. What the stored bytes give a counterparty is the ability to rebuild the verifier's input, which is the property that was missing when they were not kept.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong>Where it does not reach.</strong> Deployments that came before the determination-records path verified an attestation once and did not keep what they verified, so their determinations cannot be rebuilt by anyone, permanently, and no version of this package changes that. <strong>Nothing published here tells you which records those are:</strong> the boundary is a property of a deployment rather than a field in an artifact. Read the paragraphs above as a statement about a determination in your hands.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
<strong style="color:#f87171;">What it does not establish, and you can check each of these against the package.</strong>
<strong>No schema is published for the type at any URL</strong>, so no party can validate a decision attestation against anything published, and there is nothing for a reader to point a validator at.
<strong><code>policyRef.hash</code>, <code>vocabularyRef.hash</code> and <code>deciderArtifactDigest.value</code> are confirmed present and non-empty, never confirmed correct against anything.</strong> The function resolves no policy, no vocabulary, no artifact and no input set; a reference whose hash matches nothing verifies exactly as well as one whose hash matches its document.
<strong>Second correction, 17 August 2026: <code>inputsDigest</code> was named in that list until now and does not belong in it.</strong> The function carries the field through to its result and checks nothing about it, not even that it is there. <code>verify-samples/ppp-determination-refused-outcome.json</code> is published on this domain, carries no <code>inputsDigest</code> at all, and returns <code>attested</code>. So the digest of the inputs a decision ran over is the one reference in the document that a verifier does not even establish the presence of, which is a weaker statement than the one this section made about it and is the true one.
<strong>The vocabulary travels inside the signed document</strong>, so when the engine checks that <code>outcome</code> is a member of the declared set, both the value and the set come from the same document under the same signature.
<strong>The function takes no clock.</strong> <code>decidedAt</code> and <code>resolvableUntil</code> are carried and compared to nothing: an attestation whose <code>resolvableUntil</code> is in the past verifies, and so does one dated in the future.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
The short form: <strong>the signature and the document's internal coherence are checked; every reference the document points at is not.</strong> A separate export, <code>acceptDecisionAttestation</code>, is not a verifier and must not be read as one. It takes no document and no signature, reads the <code>assurance</code> field alone, declines <code>independently-observed</code> where a deployment cannot resolve an observer, and otherwise accepts. It accepts an empty object.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300; margin-bottom:1rem;">
The related <code>PolicyEvaluationCredential</code> has the schema gap and it is not cosmetic: AIP v0.8 defines that type and requires schema validation when verifying it, without ever assigning it a schema URL. The published engine has no dispatch on credential type at all, and the hosted service accepts only <code>{agentDid, mandate}</code>. Every evaluation credential we have issued fails our own verifier for this reason, while its signature verifies correctly under canonical W3C Data Integrity tooling.
</p>
<p style="font-size:0.92rem; color:var(--text-dim); line-height:1.8; font-weight:300;">
We are not documenting a schema we have not published, and not shipping a verifier that reports success over a check it did not perform. <a href="/verify.html" style="color:var(--amber);">The verification page states the same thing</a>, and the affected artifacts stay published rather than being withdrawn to tidy the picture.
</p>
</div>
</div>
</section>
<footer>
<div class="footer-inner">
<div class="footer-brand">Observer Protocol</div>
<div class="footer-links">
<a href="/">Home</a>
<a href="./architecture.html">Architecture</a>
<a href="./docs.html">Docs</a>
<a href="./agentic-terminal.html">Agentic Terminal</a>
<a href="./registry.html">Registry</a>
<a href="https://github.com/observer-protocol" target="_blank">GitHub ↗</a>
</div>
</div>
<div class="footer-note">
Observer Protocol · AIP v0.9 · MIT License · CC BY 4.0 · Open source, self-hostable, rail-agnostic. · observerprotocol.org
</div>
</footer>
<script>
function resolveDID() {
const input = document.getElementById('did-input').value.trim();
const output = document.getElementById('resolver-output');
const did = input || 'did:web:observerprotocol.org:agents:maxi-0001';
const url = 'https://api.observerprotocol.org/resolve/' + encodeURIComponent(did);
output.textContent = '# Resolving ' + did + '...\n# GET ' + url;
fetch(url)
.then(r => r.text().then(body => ({ status: r.status, body })))
.then(({ status, body }) => {
let pretty = body;
try { pretty = JSON.stringify(JSON.parse(body), null, 2); } catch (e) {}
output.textContent = '# GET ' + url + '\n# HTTP ' + status + '\n\n' + pretty;
})
.catch(err => {
// Show the failure. This used to print a hand-written DID document with a
// hardcoded key, which looked exactly like a successful resolution and was
// true of nothing — it fired precisely when the page was least entitled to
// show a result.
output.textContent = '# GET ' + url + '\n# The request failed: ' + err.message +
'\n#\n# Nothing was resolved. This pane shows what the endpoint returned, or' +
'\n# that it could not be reached. It never shows a document we made up.';
});
}
</script>
</body>
</html>