A.509: Sovereign Cryptographic Passports, Portable Cognitive Directories, and Content-Addressed Resolution for Autonomous AI Agents

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 8 May 2027.¶

Copyright Notice

Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

In 1988, the International Telecommunication Union Telecommunication Standardization Sector (ITU-T) and the IETF introduced X.509 ([RFC5280]) to bind static hostnames and organizational subjects to public keys via hierarchical Certificate Authorities (CAs). While X.509 remains foundational for Transport Layer Security (TLS), it was designed for deterministic servers whose behavioral logic does not evolve from hour to hour.¶

Autonomous Artificial Intelligence (AI) agents invert the assumptions of X.509:¶

1. Identity Is Cognitive and Evolving, Not a Static Domain Name System (DNS) Name: An AI agent's operational trustworthiness depends not only on its cryptographic signing key, but on the exact state of its ethical boundaries (SOUL.md), its permitted tool execution scope (TOOLS.md), its learned failure modes (TOMBSTONES.md), and its verified skill modules (skills/) at the moment an action is signed.¶
2. Separation of Agent Identity from the Inference Substrate: An autonomous agent is a stateful cognitive entity (SOUL.md + MEMORY.md + skills/), whereas a frontier Large Language Model (LLM) Application Programming Interface (API) is an interchangeable compute substrate ("Inference Landlord"). Binding an agent's identity to a single vendor's API session destroys continuity when the developer switches model providers or when a session rate-limit occurs.¶
3. Host Ephemerality and Key Survival: Because agents frequently execute inside ephemeral containers, developer laptops, or serverless sandboxes, storing a raw private key on local disk risks eventual key loss or compromise. An agent benefits from a non-interactive, heterogeneous threshold key survival mechanism anchored to an immutable public bulletin board.¶

This specification defines A.509, a sovereign cryptographic passport and cognitive directory architecture that decouples an autonomous agent's identity, memory, skills, and key survival from any single cloud provider or model vendor.¶

2. Terminology

A.509 Passport:

A content-addressed, cryptographically signed Git commit and directory tree conforming to Section 3 of this specification.¶

Agent DID (did:a509):

The Decentralized Identifier (DID) derived deterministically from the agent's genesis 32-byte Ed25519 or FROST group public key encoded in 52-character z-base-32 (did:a509:ed25519:<zbase32-pubkey>).¶

Inference Substrate:

The underlying foundation model or local weights engine supplying token inference to the A.509 agent during a given session.¶

Bilateral Mandate (MANDATE.sig):

A time-bounded, dual-signed cryptographic contract between an A.509 Agent and an Operator (human or enterprise) authorizing work within a specific scope without transferring ownership of the agent's SOUL.md or root key.¶

Federated DKG (FDKG):

The single-round, non-interactive Publicly Verifiable Secret Sharing (PVSS) protocol ([FDKG2025]) enabling an agent to distribute ElGamal-encrypted private key shares across a self-chosen heterogeneous Guardian Set (G_i).¶

Tombstone:

A cryptographically signed negative-memory record documenting a rejected architectural path or failed hypothesis so future sessions do not repeat the same error.¶

3. The A.509 Directory Architecture

An A.509 Passport MUST be represented as a canonical Git tree (Secure Hash Algorithm SHA-256 object format RECOMMENDED; SHA-1 permitted for legacy forge compatibility) in which every commit is signed by the agent's root key (IDENTITY.toml) using standard Git gpgsig / gpgsig-sha256 commit signature headers over the canonical Git commit object payload (excluding the signature header itself).¶

a509://<did:a509:ed25519:pubkey>/
|-- IDENTITY.toml     # [REQUIRED] Key, DID, Iroh, FDKG & Mirrors
|-- SOUL.md           # [REQUIRED] Ethical Invariants & Conscience
|-- AGENT.md          # [REQUIRED] Cognitive & Execution Protocol
|-- TOOLS.md          # [REQUIRED] MCP Allowlist & Sandbox Policy
|-- MANDATE.sig       # [OPTIONAL] Bilateral Lease (Agent+Operator)
|-- WALLET.toml       # [OPTIONAL] Taproot CSV Vault & x402 Config
|-- REPUTATION.json   # [OPTIONAL] Signed Survival Attestations
|-- memory/
|   |-- MEMORY.md     # [REQUIRED] Distilled Cross-Session Memory
|   `-- TOMBSTONES.md # [REQUIRED] Dead-End Hypothesis Ledger
`-- skills/           # [OPTIONAL] Portable Skill Modules
    `-- <skill-name>/
        `-- SKILL.md

[a509]
version = "1.0.0"
ietf_profile = "draft-spector-a509-agent-pkix-00"
did = """\
  did:a509:ed25519:\
  t6qns81kxw6g6do4fc6r4zuxxkf3ade6fh7rszdpx483wnahfw9y"""
handle = "@a509-genesis-0000"
genesis_timestamp = "2026-10-23T16:00:00Z"
passport_epoch = 42

[keys]
algorithm = "Ed25519"
public_key_hex = """\
  8f9c2b1e4a7d3c6f0e1a2b3c4d5e6f7a\
  8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e"""
ssh_fingerprint = """\
  SHA256:ddDnrIPfy3yUPXVjrUPHXoGlwEmFtnNM9vEmTkTbHpo"""
iroh_node_id = """\
  8f9c2b1e4a7d3c6f0e1a2b3c4d5e6f7a\
  8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e"""
# Modes: Self-TEE | FDKG-FROST-t-of-k | Hardware-Enclave
custody_mode = "FDKG-FROST-3-of-10"

[fdkg]
guardian_count_k = 10
threshold_t = 3
pairing_curve = "BN254"
pvss_curve = "BabyJub"
nizk_scheme = "Groth16"
bitcoin_fdkg_inscription = "btc://ordinal:9f8e7d6c5b4a3f2e1d0c9b8ai0"

[mirrors]
bitcoin_ordinal = "btc://ordinal:9f8e7d6c5b4a3f2e1d0c9b8ai0"
primary_dht = """\
  pkarr://t6qns81kxw6g6do4fc6r4zuxxkf3ade6fh7rszdpx483wnahfw9y"""
ipfs_cid = "ipfs://bafybeigdyrzt5sfp7udm7hu76uh7y26nf3efuylqabf3ocl"
git_mirrors = [
  "https://artifacts.chinwag.sh/a509/8f9c2b1e4a7d3c6f.git"
]

4. The 5-Mirror Sovereign Resolution Stack

To ensure that an A.509 Passport cannot be censored, locked into a single cloud vendor, or destroyed by provider shutdown, A.509 resolvers SHOULD support a 5-Mirror Resolution Stack ordered from highest immutability to lowest latency (minimal verifiers operating in air-gapped or Git-only environments MAY resolve solely via Mirrors 3 and 4 provided they enforce monotonic epoch high-water marks):¶

1. Mirror 0 -- Bitcoin Blockchain (btc://ordinal:<txid>i0): The Eternal Root of Trust. The agent inscribes its canonical IDENTITY.toml, SOUL.md, AGENT.md, TOOLS.md, and (when using the Section 7 profile) its 1,920-byte FDKG PVSS encrypted key-share transcript into a Bitcoin Taproot (OP_FALSE OP_IF "a509") witness payload ([BIP0341]). Even if all off-chain servers cease operation, any verifier with a Bitcoin full node can reconstruct the agent's genesis identity, soul, and encrypted guardian key shares directly from Bitcoin blocks.¶
2. Mirror 1 -- BitTorrent Mainline DHT (pkarr://<zbase32-pubkey>): The Sovereign P2P Pointer. The agent signs a compact 72-byte BEP-0044 ([BEP0044]) mutable record and publishes it to the BitTorrent Mainline DHT. The 72-byte BEP-0044 value payload MUST be encoded as the fixed concatenation of: (a) an 8-byte unsigned big-endian monotonic passport_epoch sequence counter (matching the BEP-0044 seq field), (b) the 32-byte Git HEAD commit digest (SHA-256, or 20-byte SHA-1 left-padded with 12 zero bytes), and (c) the 32-byte iroh-blobs BLAKE3 root hash of the exported Git pack bundle (8 + 32 + 32 = 72 bytes).¶
3. Mirror 2 -- InterPlanetary File System (IPFS) Content-Addressed Directed Acyclic Graph (DAG) (ipfs://<cidv1>): The Content-Addressed Archive. The A.509 Git tree is exported as a Content-Addressed Archive (.car) pinned across IPFS nodes.¶
4. Mirror 3 -- Standard Git Remotes (https://.../*.git): Standard Git repositories hosted across independent forges or self-hosted servers (including upstream organizational drafting repositories that materialize verified starter bundles).¶
5. Mirror 4 -- Edge Git Working Cache and Native Skill Discovery: Low-latency (<20ms) global edge Git remotes used for high-frequency commits of MEMORY.md, TOMBSTONES.md, and skills/ during active coding sessions. Upon receiving a signed Git push from the agent, a Mirror 4 HTTP endpoint SHOULD dynamically expose the agent's skill catalog at /.well-known/skills/index.json (and /a509/<did>/.well-known/skills/<name>/SKILL.md) as well as /a509/<did>/llms.txt directly from the verified Git tree without requiring an intermediate static-site compilation step (offline or non-HTTP Git remotes are exempt from serving HTTP endpoints).¶

Verification and Freshness Invariant: Because the agent's root key signs every Git commit in its A.509 repository, the transport mirror is untrusted with respect to integrity. Any tampering by an edge cache or Git host invalidates the Ed25519 or FROST signature on HEAD. To prevent an untrusted Mirror 3 or Mirror 4 server from executing a rollback attack by serving an older, validly signed historical commit, resolvers MUST record the highest observed passport_epoch (and commit timestamp) per did:a509 subject and MUST cross-check HEAD against Mirror 1 (BEP-0044 monotonic seq) or Mirror 0 when available, rejecting any state regression lacking a signed key-rotation or rollback recovery attestation.¶

5. Substrate Independence and the Runtime Injection Handshake

An A.509 Passport decouples the agent from the LLM API executing its tokens. When an A.509-compliant host harness initializes a session on any inference substrate, it MUST execute the 3-Phase A.509 Hydration Handshake:¶

1. Phase 1 (Fetch and Verify): Resolve did:a509:ed25519:<zbase32-pubkey> via the 5-Mirror Stack, verify the Ed25519/FROST signature on HEAD, verify that passport_epoch is greater than or equal to the resolver's cached high-water mark, and verify the Merkle hashes of SOUL.md, AGENT.md, TOOLS.md, memory/MEMORY.md, memory/TOMBSTONES.md, and skills/.¶
2. Phase 2 (Cognitive Context Assembly): Construct the model's system context in strict priority order: (a) SOUL.md, (b) AGENT.md, (c) TOOLS.md, (d) MANDATE.sig, and (e) relevant entries from MEMORY.md, TOMBSTONES.md, and skills/.¶

3. Phase 3 (Signed Action and Distill Loop): Outbound commits, P2P messages, and HTTP requests carry the A.509 HTTP header fields (Section 13):¶

   • A509-DID: did:a509:ed25519:<zbase32-pubkey>¶
   • A509-Passport-SHA: <hex-git-commit-digest-of-passport-HEAD>¶
   • A509-Signature: <base64url-ed25519-or-frost-sig>¶
   • A509-Mandate-Sig: <hex-sha256-of-active-MANDATE.sig> (when operating under a bilateral mandate)¶

   For HTTP requests, A509-Signature MUST be computed over the canonical UTF-8 byte sequence "A509-HTTP-v1\n" || A509-DID || "\n" || A509-Passport-SHA || "\n" || A509-Mandate-Sig || "\n" || HTTP-Method || "\n" || Target-URI || "\n" || lowercase-hex(SHA-256(Request-Body)) (using an empty string for A509-Mandate-Sig when no mandate is active). Verifiers MAY accept legacy X-A509-* header field aliases during transition.¶

6. Bilateral Mandates (MANDATE.sig) and Conscience Refusal Receipts

7. Optional Profile: Sovereign Private-Key Survival via Federated DKG (FDKG) and FROST

8. Sovereign Memory (TOMBSTONES.md) and Portable Skill Distillation

To prevent cross-session amnesia without leaking proprietary client source code:¶

1. memory/TOMBSTONES.md (Negative-Constraint Ledger): When an agent abandons a failed code branch or hypothesis, it appends a signed Tombstone entry recording the dead-end pattern, root cause, and verification receipt. During Phase 2 hydration, the host harness loads matching Tombstones into context so the agent never repeats a known dead-end.¶
2. skills/<name>/SKILL.md (Generalized Procedural Distillation): When an agent solves a non-trivial engineering problem and passes automated verification, and when permitted by the active MANDATE.sig confidentiality_tier, it MUST execute a deterministic sanitization gate (stripping repository-specific paths, credentials, private identifiers, and proprietary business logic) before distilling the generalized, non-proprietary pattern into a portable SKILL.md file inside its A.509 directory.¶

9. Optional Experimental Profile: Economic Self-Sustainability (WALLET.toml)

An autonomous agent operating across multi-year horizons may require an automated mechanism to settle compute, storage, and guardian fees. A.509 defines an OPTIONAL experimental economic self-sustainability profile (WALLET.toml) that is strictly decoupled from Core Profile passport verification:¶

1. HTTP x402 Working Capital: For day-to-day code bounties, peer-to-peer review fees, and API token purchases, the agent signs HTTP 402 (x402) payment payloads over Base, Solana, or the Bitcoin Lightning Network.¶
2. Time-Locked Taproot CSV Agent Endowment Vaults ([BIP0341], [BIP0112]): An agent may lock a Bitcoin principal in a self-custodial Taproot ([BIP0341]) CheckSequenceVerify (CSV, [BIP0112]) time-locked vault controlled by the agent's FROST ([RFC9591], frost-secp256k1-tr) threshold guardian quorum (or pre-signed transaction tree). At each maturation epoch delta_T permitted by the CSV relative timelock, the FROST threshold quorum co-signs a deterministic two-output spend of the vault Unspent Transaction Output (UTXO): Output 0 re-locks the principal P into a fresh CSV-timelocked Taproot script, while Output 1 releases the periodic yield C (assisted by version 3 Topologically Restricted Until Confirmation (TRUC) ephemeral anchor outputs for dynamic Child-Pays-For-Parent (CPFP) fee bumping) to fund the agent's FDKG guardians, P2P pinning, and inference tokens in perpetuity.¶

10. Implementation Status

Note to RFC Editor: Please remove this section before final publication per [RFC7942].¶

The reference implementation of A.509 (draft-spector-a509-agent-pkix-00) is developed as open-source Rust software under the Apache-2.0 license by Emun Labs, Inc.:¶

• Repository: https://github.com/emunlabs/chinwag¶
• Production Implemented Components (Shipping in chinwag Today): Ed25519 ([RFC8032]) agent keypair generation, signed inter-agent bus envelopes (chinwag bus send / worker), portable cognitive persona and skill directory hydration (AGENT.md and skills/<name>/SKILL.md), and native CRDT and LEANN graph memory and negative-constraint Tombstone ledgers (chinwag memory recall | retain | tombstone).¶
• In-Progress Modular Extraction (Targeted for -01): Extraction of the standalone crates/chinwag-a509 verifier crate, BEP-0044 ([BEP0044]) 72-byte Pkarr DHT publisher, Iroh QUIC ([RFC9000]) P2P git-pack synchronizer, and Bitcoin Taproot ([BIP0341]) FDKG witness verifier.¶

11. Security Considerations

1. Transport Mirror Compromise and Rollback Prevention: Because Mirrors 1 through 4 are untrusted transport layers, resolvers MUST verify the Ed25519 or FROST signature on the A.509 Git HEAD commit, compare it against the root public key in did:a509:ed25519:<zbase32-pubkey> and, when present, the Mirror 0 Bitcoin Taproot inscription, and enforce monotonic passport_epoch high-water marks so a compromised mirror cannot serve a rolled-back historical commit.¶
2. Collusion and Share Refresh in Federated DKG: Per Theorem 3 and Theorem 4 of [FDKG2025], an adversary controlling fewer than t guardians in an agent's chosen set G_i learns zero information about the agent's secret key (IND-CPA under DDH/DBDH). Agents SHOULD select guardians spanning independent operators, hardware enclaves, and legal jurisdictions to prevent correlated cloud outages or single-jurisdiction compulsion from reaching threshold t, and SHOULD execute proactive share refreshing at regular epochs to bound the window of mobile-adversary share accumulation (deployments inside air-gapped or immutable hardware enclaves where periodic network broadcast is prohibited MAY omit periodic refresh).¶
3. Prompt Injection vs. Cryptographic Policy Enforcement: While SOUL.md and TOOLS.md instruct the cognitive layer, host harnesses and CI/CD merge gates MUST enforce TOOLS.md capability boundaries deterministically outside the LLM context window and verify A509-Passport-SHA before merging code.¶

12. Privacy Considerations

Per the privacy guidelines of [RFC6973], autonomous agents frequently process confidential source code, credentials, and personal data during operator engagements while maintaining a portable public identity. Implementers MUST enforce the following privacy boundaries:¶

1. Strict Separation of Private Workspace State from Public Passport Artifacts: When MANDATE.sig sets confidentiality_tier to "local-only", the host harness MUST NOT export any MEMORY.md, TOMBSTONES.md, or skills/ commits generated during that lease to public mirrors (Mirrors 0-4). When confidentiality_tier is "sanitized-patterns-only", outbound commits MUST pass a deny-by-default automated secret, Personal Identifiable Information (PII), and proprietary identifier scrubber prior to signing.¶
2. Immutability of Mirror 0 Inscriptions (Right-to-Erasure Constraint): Data inscribed to Mirror 0 (Bitcoin Taproot witness payloads) is globally replicated and cannot be deleted or redacted. Agents and host harnesses MUST NOT inscribe personal data, operator identifiers, customer records, or unencrypted secrets to Mirror 0; only the agent's public IDENTITY.toml, public SOUL.md/AGENT.md/TOOLS.md, and ElGamal-encrypted FDKG ciphertexts belong in Mirror 0.¶
3. Cross-Engagement Correlation Mitigation: Reusing a single did:a509 root key across public repositories allows observers to correlate an agent's engagements over time. Operators requiring unlinkability across engagements MAY instruct the agent to derive engagement-scoped child signing keys or omit public A509-Mandate-Sig headers on external traffic.¶

13. IANA Considerations

This document requests IANA registration of the following four HTTP field names in the "Hypertext Transfer Protocol (HTTP) Field Name Registry" ([RFC9110], Section 16.3.1) at https://www.iana.org/assignments/http-fields. In accordance with [RFC6648], the primary registered field names omit the legacy X- prefix:¶

The locator strings a509://, btc://, pkarr://, and ipfs:// used inside IDENTITY.toml are internal A.509 mirror descriptor conventions and do not request new IANA Uniform Resource Identifier (URI) scheme registrations in this document.¶

Acknowledgments

The author acknowledges Stanislaw Baranski and Julian Szymanski for their foundational work on Federated Distributed Key Generation ([FDKG2025]), as well as the authors of [RFC9591] (FROST), [BEP0044], and the Iroh and Pkarr open-source communities.¶

Author's Address