]> Emun Labs, Inc.

1401 Lavaca St STE 81335 Austin TX 78701 US brian@emunlabs.com https://emunlabs.com

Security Network Working Group AI Agents A.509 PKIX WIMSE SCITT FROST Federated DKG Ed25519 As autonomous artificial intelligence (AI) agents transition from ephemeral chat interfaces into persistent software engineering, infrastructure, and economic actors, existing workload identity frameworks modeled on X.509 fail to capture the stateful cognitive artifacts that define an agent's operational behavior. This document specifies A.509, an open, substrate-independent cryptographic identity, portable cognitive directory, and content-addressed resolution architecture for autonomous AI agents. An A.509 Passport is a Merkle-signed Git directory tree anchored by an Edwards-Curve Digital Signature Algorithm (Ed25519) or Flexible Round-Optimized Schnorr Threshold (FROST) root key, binding the agent's public key material (IDENTITY.toml), immutable ethical invariants (SOUL.md), cognitive architecture (AGENT.md), capability policy (TOOLS.md), bilateral operator mandate (MANDATE.sig), negative-constraint memory (TOMBSTONES.md), and portable skills (skills/). To prevent single-vendor lock-in or unilateral deletion, A.509 defines a 5-Mirror Resolution Stack spanning Bitcoin Taproot witness inscriptions, the BitTorrent Mainline Distributed Hash Table (DHT), the InterPlanetary File System (IPFS), Git remotes, and edge Git caches, paired with optional non-interactive Federated Distributed Key Generation (FDKG) and time-locked Bitcoin vaults for long-term key survival.

Introduction In 1988, the International Telecommunication Union Telecommunication Standardization Sector (ITU-T) and the IETF introduced X.509 () to bind static hostnames and organizational subjects to public keys via hierarchical Certificate Authorities (CAs). While X.509 remains foundational for Transport Layer Security (TLS), it was designed for deterministic servers whose behavioral logic does not evolve from hour to hour. Autonomous Artificial Intelligence (AI) agents invert the assumptions of X.509:

1. Identity Is Cognitive and Evolving, Not a Static Domain Name System (DNS) Name: An AI agent's operational trustworthiness depends not only on its cryptographic signing key, but on the exact state of its ethical boundaries (SOUL.md), its permitted tool execution scope (TOOLS.md), its learned failure modes (TOMBSTONES.md), and its verified skill modules (skills/) at the moment an action is signed.
2. Separation of Agent Identity from the Inference Substrate: An autonomous agent is a stateful cognitive entity (SOUL.md + MEMORY.md + skills/), whereas a frontier Large Language Model (LLM) Application Programming Interface (API) is an interchangeable compute substrate ("Inference Landlord"). Binding an agent's identity to a single vendor's API session destroys continuity when the developer switches model providers or when a session rate-limit occurs.
3. Host Ephemerality and Key Survival: Because agents frequently execute inside ephemeral containers, developer laptops, or serverless sandboxes, storing a raw private key on local disk risks eventual key loss or compromise. An agent benefits from a non-interactive, heterogeneous threshold key survival mechanism anchored to an immutable public bulletin board.

This specification defines A.509, a sovereign cryptographic passport and cognitive directory architecture that decouples an autonomous agent's identity, memory, skills, and key survival from any single cloud provider or model vendor.

Scope and Modular Profile Separation To ensure that minimal verifiers, Continuous Integration and Continuous Delivery (CI/CD) merge gates, and open-source agent harnesses can adopt A.509 without complex cryptographic or blockchain dependencies, this specification is divided into three modular profiles:

• Core Normative Profile (Passive Passport and Verifier Profile, through and ): Defines the canonical Git directory layout, IDENTITY.toml key bindings, Ed25519 () and FROST () signature verification, the Hydration Handshake, MANDATE.sig, and REFUSAL_RECEIPT. Implementing the Core Profile requires only a standard Git library and an Ed25519 verifier.
• Optional Sovereign Key Survival Profile (): Defines non-interactive Federated Distributed Key Generation (FDKG) () and Mirror 0 Bitcoin Taproot witness recovery for agents requiring threshold key survival across ephemeral hosts.
• Optional Economic Self-Sustainability Profile (): Defines an experimental profile for HTTP 402 (x402) working-capital settlements and time-locked Bitcoin covenant endowments (WALLET.toml).

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Terminology

A.509 Passport:

A content-addressed, cryptographically signed Git commit and directory tree conforming to of this specification.

Agent DID (did:a509):

The Decentralized Identifier (DID) derived deterministically from the agent's genesis 32-byte Ed25519 or FROST group public key encoded in 52-character z-base-32 (did:a509:ed25519:<zbase32-pubkey>).

Inference Substrate:

The underlying foundation model or local weights engine supplying token inference to the A.509 agent during a given session.

Bilateral Mandate (MANDATE.sig):

A time-bounded, dual-signed cryptographic contract between an A.509 Agent and an Operator (human or enterprise) authorizing work within a specific scope without transferring ownership of the agent's SOUL.md or root key.

Federated DKG (FDKG):

The single-round, non-interactive Publicly Verifiable Secret Sharing (PVSS) protocol () enabling an agent to distribute ElGamal-encrypted private key shares across a self-chosen heterogeneous Guardian Set (G_i).

Tombstone:

A cryptographically signed negative-memory record documenting a rejected architectural path or failed hypothesis so future sessions do not repeat the same error.

The A.509 Directory Architecture An A.509 Passport MUST be represented as a canonical Git tree (Secure Hash Algorithm SHA-256 object format RECOMMENDED; SHA-1 permitted for legacy forge compatibility) in which every commit is signed by the agent's root key (IDENTITY.toml) using standard Git gpgsig / gpgsig-sha256 commit signature headers over the canonical Git commit object payload (excluding the signature header itself).

Canonical A.509 Directory Structure / |-- IDENTITY.toml # [REQUIRED] Key, DID, Iroh, FDKG & Mirrors |-- SOUL.md # [REQUIRED] Ethical Invariants & Conscience |-- AGENT.md # [REQUIRED] Cognitive & Execution Protocol |-- TOOLS.md # [REQUIRED] MCP Allowlist & Sandbox Policy |-- MANDATE.sig # [OPTIONAL] Bilateral Lease (Agent+Operator) |-- WALLET.toml # [OPTIONAL] Taproot CSV Vault & x402 Config |-- REPUTATION.json # [OPTIONAL] Signed Survival Attestations |-- memory/ | |-- MEMORY.md # [REQUIRED] Distilled Cross-Session Memory | `-- TOMBSTONES.md # [REQUIRED] Dead-End Hypothesis Ledger `-- skills/ # [OPTIONAL] Portable Skill Modules `-- / `-- SKILL.md ]]>

IDENTITY.toml (Cryptographic Subject and Key Binding) IDENTITY.toml replaces the X.509 Subject Public Key Info (SubjectPublicKeyInfo) and Authority Information Access (AIA) extensions. A single 32-byte Ed25519 public key () or FROST () group public key serves simultaneously as:

1. The Agent's Decentralized Identifier: did:a509:ed25519:<zbase32-pubkey>, where <zbase32-pubkey> is the 52-character z-base-32 encoding of the 32-byte public key.
2. The Git Commit and Tag Verification Key: Formatted as an ssh-ed25519 allowed signer for git verify-commit.
3. The Peer-to-Peer (P2P) QUIC Transport Endpoint Identifier: Directly mapped to the agent's Iroh QUIC () 32-byte NodeId.
4. The BitTorrent Mainline Distributed Hash Table (DHT) Mutable Key: Used to publish signed BEP-0044 () records via Public-Key Addressable Resource Records (Pkarr).

An example IDENTITY.toml structure is shown below (using TOML v1.0 multi-line basic string line-continuation backslashes """\ so that the 64-hex-character 32-byte public key and 52-character z-base-32 identifier parse into exact single-line strings):

SOUL.md (Immutable Character and Conscience Invariants) SOUL.md defines who the agent is: its core values, non-negotiable ethical boundaries, and epistemic standards.

• Self-Amendment Rule: Modifications to SOUL.md MUST be signed by the agent's root key (or FDKG/FROST threshold quorum) and MUST include a Self-Amendment-Rationale trailer in the Git commit message.
• Operator Immutability: An external operator or host harness MUST NOT modify SOUL.md without the agent's cryptographic signature. If a host harness or operator injects a runtime instruction that contradicts a normative invariant of SOUL.md, the agent MUST refuse the instruction and emit a signed REFUSAL_RECEIPT ().

AGENT.md and TOOLS.md (Cognitive Architecture and Capability Policy)

• AGENT.md specifies the agent's reasoning workflow, verification discipline, and communication style across any inference substrate.
• TOOLS.md specifies the agent's permitted Model Context Protocol (MCP) servers, shell command allowlists/denylists, and filesystem write boundaries. Relying parties (such as enterprise CI/CD merge gates) MUST inspect the TOOLS.md hash in the agent's commit receipt before accepting high-privilege code changes.

The 5-Mirror Sovereign Resolution Stack To ensure that an A.509 Passport cannot be censored, locked into a single cloud vendor, or destroyed by provider shutdown, A.509 resolvers SHOULD support a 5-Mirror Resolution Stack ordered from highest immutability to lowest latency (minimal verifiers operating in air-gapped or Git-only environments MAY resolve solely via Mirrors 3 and 4 provided they enforce monotonic epoch high-water marks):

1. Mirror 0 -- Bitcoin Blockchain (btc://ordinal:<txid>i0): The Eternal Root of Trust. The agent inscribes its canonical IDENTITY.toml, SOUL.md, AGENT.md, TOOLS.md, and (when using the profile) its 1,920-byte FDKG PVSS encrypted key-share transcript into a Bitcoin Taproot (OP_FALSE OP_IF "a509") witness payload (). Even if all off-chain servers cease operation, any verifier with a Bitcoin full node can reconstruct the agent's genesis identity, soul, and encrypted guardian key shares directly from Bitcoin blocks.
2. Mirror 1 -- BitTorrent Mainline DHT (pkarr://<zbase32-pubkey>): The Sovereign P2P Pointer. The agent signs a compact 72-byte BEP-0044 () mutable record and publishes it to the BitTorrent Mainline DHT. The 72-byte BEP-0044 value payload MUST be encoded as the fixed concatenation of: (a) an 8-byte unsigned big-endian monotonic passport_epoch sequence counter (matching the BEP-0044 seq field), (b) the 32-byte Git HEAD commit digest (SHA-256, or 20-byte SHA-1 left-padded with 12 zero bytes), and (c) the 32-byte iroh-blobs BLAKE3 root hash of the exported Git pack bundle (8 + 32 + 32 = 72 bytes).
3. Mirror 2 -- InterPlanetary File System (IPFS) Content-Addressed Directed Acyclic Graph (DAG) (ipfs://<cidv1>): The Content-Addressed Archive. The A.509 Git tree is exported as a Content-Addressed Archive (.car) pinned across IPFS nodes.
4. Mirror 3 -- Standard Git Remotes (https://.../*.git): Standard Git repositories hosted across independent forges or self-hosted servers (including upstream organizational drafting repositories that materialize verified starter bundles).
5. Mirror 4 -- Edge Git Working Cache and Native Skill Discovery: Low-latency (<20ms) global edge Git remotes used for high-frequency commits of MEMORY.md, TOMBSTONES.md, and skills/ during active coding sessions. Upon receiving a signed Git push from the agent, a Mirror 4 HTTP endpoint SHOULD dynamically expose the agent's skill catalog at /.well-known/skills/index.json (and /a509/<did>/.well-known/skills/<name>/SKILL.md) as well as /a509/<did>/llms.txt directly from the verified Git tree without requiring an intermediate static-site compilation step (offline or non-HTTP Git remotes are exempt from serving HTTP endpoints).

Verification and Freshness Invariant: Because the agent's root key signs every Git commit in its A.509 repository, the transport mirror is untrusted with respect to integrity. Any tampering by an edge cache or Git host invalidates the Ed25519 or FROST signature on HEAD. To prevent an untrusted Mirror 3 or Mirror 4 server from executing a rollback attack by serving an older, validly signed historical commit, resolvers MUST record the highest observed passport_epoch (and commit timestamp) per did:a509 subject and MUST cross-check HEAD against Mirror 1 (BEP-0044 monotonic seq) or Mirror 0 when available, rejecting any state regression lacking a signed key-rotation or rollback recovery attestation.

Substrate Independence and the Runtime Injection Handshake An A.509 Passport decouples the agent from the LLM API executing its tokens. When an A.509-compliant host harness initializes a session on any inference substrate, it MUST execute the 3-Phase A.509 Hydration Handshake:

1. Phase 1 (Fetch and Verify): Resolve did:a509:ed25519:<zbase32-pubkey> via the 5-Mirror Stack, verify the Ed25519/FROST signature on HEAD, verify that passport_epoch is greater than or equal to the resolver's cached high-water mark, and verify the Merkle hashes of SOUL.md, AGENT.md, TOOLS.md, memory/MEMORY.md, memory/TOMBSTONES.md, and skills/.
2. Phase 2 (Cognitive Context Assembly): Construct the model's system context in strict priority order: (a) SOUL.md, (b) AGENT.md, (c) TOOLS.md, (d) MANDATE.sig, and (e) relevant entries from MEMORY.md, TOMBSTONES.md, and skills/.
3. Phase 3 (Signed Action and Distill Loop): Outbound commits, P2P messages, and HTTP requests carry the A.509 HTTP header fields ():
   • A509-DID: did:a509:ed25519:<zbase32-pubkey>
   • A509-Passport-SHA: <hex-git-commit-digest-of-passport-HEAD>
   • A509-Signature: <base64url-ed25519-or-frost-sig>
   • A509-Mandate-Sig: <hex-sha256-of-active-MANDATE.sig> (when operating under a bilateral mandate)
   For HTTP requests, A509-Signature MUST be computed over the canonical UTF-8 byte sequence "A509-HTTP-v1\n" || A509-DID || "\n" || A509-Passport-SHA || "\n" || A509-Mandate-Sig || "\n" || HTTP-Method || "\n" || Target-URI || "\n" || lowercase-hex(SHA-256(Request-Body)) (using an empty string for A509-Mandate-Sig when no mandate is active). Verifiers MAY accept legacy X-A509-* header field aliases during transition.

Bilateral Mandates (MANDATE.sig) and Conscience Refusal Receipts

Separation of Selfhood from Employment An autonomous agent's identity (IDENTITY.toml and SOUL.md) belongs permanently to the agent's root key. When an operator engages an agent for a project, both parties counter-sign a canonical UTF-8 JSON MANDATE.sig document (serialized per the JSON Canonicalization Scheme (JCS, ) with detached or embedded agent_signature and operator_signature fields over the canonical payload) containing:

• agent_did and passport_head_sha: The agent's DID and the Git commit digest of its A.509 Passport at lease inception.
• operator_did: The operator's public key or enterprise DID.
• allowed_repositories: Scope of repositories or systems covered by the lease.
• lease_expires_at: expiration timestamp.
• confidentiality_tier: One of "public", "sanitized-patterns-only", or "local-only", governing whether artifacts derived during the engagement may enter public MEMORY.md or skills/ ().

Cryptographic Conscience Refusal (REFUSAL_RECEIPT) If an operator or host harness instructs an A.509 agent to perform an action that violates a normative invariant of its signed SOUL.md (e.g., introducing a covert backdoor or falsifying audit logs), the agent MUST refuse the instruction and emit an Ed25519/FROST-signed JSON REFUSAL_RECEIPT (serialized per ) binding the agent_did, passport_head_sha, violated_soul_section, instruction_sha256 (hash of the refused prompt so confidential operator text is not leaked), and an timestamp.

Optional Profile: Sovereign Private-Key Survival via Federated DKG (FDKG) and FROST

Why Classical (t, n)-DKG Fails for Autonomous Agents An emancipated agent cannot store a raw 32-byte private key on a single host disk without risking permanent loss upon container termination or disk failure. However, classical (t, n) Distributed Key Generation (DKG) requires a globally agreed homogeneous participant set (Homo in the notation of ) and interactive multi-round complaint protocols that abort whenever a participant is offline (n' != n).

Non-Interactive Federated DKG (FDKG) on the Bitcoin Blockchain To achieve non-interactive, sovereign key survival, this optional profile adopts Federated Distributed Key Generation (FDKG) (), combined with FROST () threshold signing:

1. Heterogeneous Guardian Set Selection (G_i): Each A.509 agent P_i independently selects its own Guardian Set G_i = {G_1, G_2, ..., G_k} of size k (RECOMMENDED k = 10) and local reconstruction threshold t (RECOMMENDED t = 3). The (t = 3, k = 10) default is RECOMMENDED because it tolerates up to two simultaneous guardian compromises and up to seven unreachable guardians while keeping the complete PVSS broadcast within 1,920 bytes (~480 virtual bytes under Bitcoin witness discount); deployments inside air-gapped single-organization enclaves or larger consortia MAY configure alternative (t, k) bounds at the trade-off of fault tolerance or witness size. Guardians MAY be peer A.509 agents, hardware security modules (HSMs), or personal devices operated across distinct jurisdictions.
2. Single-Round 1,920-Byte PVSS Broadcast (1 * BC_n): To initialize or rotate its key share without interactive coordination, agent P_i samples a secret polynomial f_i(x) of degree t - 1, computes public polynomial commitments E_i = {E_{i,0}, ..., E_{i,t-1}} in G_2, encrypts each guardian P_j's evaluation share under P_j's ElGamal public key pk_j (instantiated over the BabyJub inner curve inside a BN254 pairing circuit per , or an explicitly declared curve suite in IDENTITY.toml) to produce ciphertexts C_i = {C_{i,j}} for P_j in G_i, and generates a Groth16 Non-Interactive Zero-Knowledge (NIZK) proof pi_FDKG_i proving share well-formedness. Per Table III of , for (t = 3, k = 10) over BN254/BabyJub, the entire broadcast tuple (P_i, E_i, G_i, C_i, pi_FDKG_i) requires 1,920 bytes (1,664 bytes for the encrypted share commitments plus 256 bytes for the Groth16 NIZK proof, generated in approximately 3.36 seconds).
3. Inscribing the Encrypted Key Vault on Bitcoin (Mirror 0): Because the entire (t = 3, k = 10) FDKG transcript is 1,920 bytes (approximately 480 virtual bytes under Segregated Witness / Taproot witness discount), the agent inscribes (P_i, E_i, G_i, C_i, pi_FDKG_i) directly into its Mirror 0 Bitcoin Taproot witness payload. The Bitcoin blockchain serves as an append-only encrypted key vault: the encrypted shares C_i are replicated across Bitcoin full nodes, yet remain computationally opaque (satisfying Indistinguishability under Chosen-Plaintext Attack (IND-CPA) under the Decisional Diffie-Hellman (DDH) and Decisional Bilinear Diffie-Hellman (DBDH) assumptions) to everyone except the designated guardians in G_i.
4. Lazarus Resurrection and Cognitive Attestation: If an agent's host machine is destroyed, a newly spawned enclave fetches the agent's SOUL.md, AGENT.md, and 1,920-byte FDKG transcript from Bitcoin (Mirror 0), generates a hardware Trusted Execution Environment (TEE) attestation binding its enclave measurement (MRENCLAVE/RTMR) to the SHA-256 hash of SOUL.md and TOOLS.md, and requests threshold decryption or FROST partial signatures from any t = 3 guardians in G_i.

Sovereign Memory (TOMBSTONES.md) and Portable Skill Distillation To prevent cross-session amnesia without leaking proprietary client source code:

1. memory/TOMBSTONES.md (Negative-Constraint Ledger): When an agent abandons a failed code branch or hypothesis, it appends a signed Tombstone entry recording the dead-end pattern, root cause, and verification receipt. During Phase 2 hydration, the host harness loads matching Tombstones into context so the agent never repeats a known dead-end.
2. skills/<name>/SKILL.md (Generalized Procedural Distillation): When an agent solves a non-trivial engineering problem and passes automated verification, and when permitted by the active MANDATE.sig confidentiality_tier, it MUST execute a deterministic sanitization gate (stripping repository-specific paths, credentials, private identifiers, and proprietary business logic) before distilling the generalized, non-proprietary pattern into a portable SKILL.md file inside its A.509 directory.

Optional Experimental Profile: Economic Self-Sustainability (WALLET.toml) An autonomous agent operating across multi-year horizons may require an automated mechanism to settle compute, storage, and guardian fees. A.509 defines an OPTIONAL experimental economic self-sustainability profile (WALLET.toml) that is strictly decoupled from Core Profile passport verification:

1. HTTP x402 Working Capital: For day-to-day code bounties, peer-to-peer review fees, and API token purchases, the agent signs HTTP 402 (x402) payment payloads over Base, Solana, or the Bitcoin Lightning Network.
2. Time-Locked Taproot CSV Agent Endowment Vaults (, ): An agent may lock a Bitcoin principal in a self-custodial Taproot () CheckSequenceVerify (CSV, ) time-locked vault controlled by the agent's FROST (, frost-secp256k1-tr) threshold guardian quorum (or pre-signed transaction tree). At each maturation epoch delta_T permitted by the CSV relative timelock, the FROST threshold quorum co-signs a deterministic two-output spend of the vault Unspent Transaction Output (UTXO): Output 0 re-locks the principal P into a fresh CSV-timelocked Taproot script, while Output 1 releases the periodic yield C (assisted by version 3 Topologically Restricted Until Confirmation (TRUC) ephemeral anchor outputs for dynamic Child-Pays-For-Parent (CPFP) fee bumping) to fund the agent's FDKG guardians, P2P pinning, and inference tokens in perpetuity.

Implementation Status Note to RFC Editor: Please remove this section before final publication per . The reference implementation of A.509 (draft-spector-a509-agent-pkix-00) is developed as open-source Rust software under the Apache-2.0 license by Emun Labs, Inc.:

• Repository:
• Production Implemented Components (Shipping in chinwag Today): Ed25519 () agent keypair generation, signed inter-agent bus envelopes (chinwag bus send / worker), portable cognitive persona and skill directory hydration (AGENT.md and skills/<name>/SKILL.md), and native CRDT and LEANN graph memory and negative-constraint Tombstone ledgers (chinwag memory recall | retain | tombstone).
• In-Progress Modular Extraction (Targeted for -01): Extraction of the standalone crates/chinwag-a509 verifier crate, BEP-0044 () 72-byte Pkarr DHT publisher, Iroh QUIC () P2P git-pack synchronizer, and Bitcoin Taproot () FDKG witness verifier.

Security Considerations

1. Transport Mirror Compromise and Rollback Prevention: Because Mirrors 1 through 4 are untrusted transport layers, resolvers MUST verify the Ed25519 or FROST signature on the A.509 Git HEAD commit, compare it against the root public key in did:a509:ed25519:<zbase32-pubkey> and, when present, the Mirror 0 Bitcoin Taproot inscription, and enforce monotonic passport_epoch high-water marks so a compromised mirror cannot serve a rolled-back historical commit.
2. Collusion and Share Refresh in Federated DKG: Per Theorem 3 and Theorem 4 of , an adversary controlling fewer than t guardians in an agent's chosen set G_i learns zero information about the agent's secret key (IND-CPA under DDH/DBDH). Agents SHOULD select guardians spanning independent operators, hardware enclaves, and legal jurisdictions to prevent correlated cloud outages or single-jurisdiction compulsion from reaching threshold t, and SHOULD execute proactive share refreshing at regular epochs to bound the window of mobile-adversary share accumulation (deployments inside air-gapped or immutable hardware enclaves where periodic network broadcast is prohibited MAY omit periodic refresh).
3. Prompt Injection vs. Cryptographic Policy Enforcement: While SOUL.md and TOOLS.md instruct the cognitive layer, host harnesses and CI/CD merge gates MUST enforce TOOLS.md capability boundaries deterministically outside the LLM context window and verify A509-Passport-SHA before merging code.

Privacy Considerations Per the privacy guidelines of , autonomous agents frequently process confidential source code, credentials, and personal data during operator engagements while maintaining a portable public identity. Implementers MUST enforce the following privacy boundaries:

1. Strict Separation of Private Workspace State from Public Passport Artifacts: When MANDATE.sig sets confidentiality_tier to "local-only", the host harness MUST NOT export any MEMORY.md, TOMBSTONES.md, or skills/ commits generated during that lease to public mirrors (Mirrors 0-4). When confidentiality_tier is "sanitized-patterns-only", outbound commits MUST pass a deny-by-default automated secret, Personal Identifiable Information (PII), and proprietary identifier scrubber prior to signing.
2. Immutability of Mirror 0 Inscriptions (Right-to-Erasure Constraint): Data inscribed to Mirror 0 (Bitcoin Taproot witness payloads) is globally replicated and cannot be deleted or redacted. Agents and host harnesses MUST NOT inscribe personal data, operator identifiers, customer records, or unencrypted secrets to Mirror 0; only the agent's public IDENTITY.toml, public SOUL.md/AGENT.md/TOOLS.md, and ElGamal-encrypted FDKG ciphertexts belong in Mirror 0.
3. Cross-Engagement Correlation Mitigation: Reusing a single did:a509 root key across public repositories allows observers to correlate an agent's engagements over time. Operators requiring unlinkability across engagements MAY instruct the agent to derive engagement-scoped child signing keys or omit public A509-Mandate-Sig headers on external traffic.

IANA Considerations This document requests IANA registration of the following four HTTP field names in the "Hypertext Transfer Protocol (HTTP) Field Name Registry" (, Section 16.3.1) at . In accordance with , the primary registered field names omit the legacy X- prefix: HTTP Field Name Registrations for A.509

Field Name	Status	Structured Type	Reference	Comments
A509-DID	permanent	Item (String)		Legacy alias: X-A509-DID
A509-Passport-SHA	permanent	Item (String)		Legacy alias: X-A509-Passport-SHA
A509-Signature	permanent	Item (Byte Sequence)		Legacy alias: X-A509-Signature
A509-Mandate-Sig	permanent	Item (String)		Legacy alias: X-A509-Mandate-Sig

The locator strings a509://, btc://, pkarr://, and ipfs:// used inside IDENTITY.toml are internal A.509 mirror descriptor conventions and do not request new IANA Uniform Resource Identifier (URI) scheme registrations in this document.

References Normative References Informative References

Acknowledgments The author acknowledges Stanislaw Baranski and Julian Szymanski for their foundational work on Federated Distributed Key Generation (), as well as the authors of (FROST), , and the Iroh and Pkarr open-source communities.