IETF Internet-Drafts & RFCs — Daily Digest

Defines the initial set of registry entries for Computing Service Metrics used in Computing-Aware Traffic Steering (CATS). The metrics — Global Available Slots (GAS), Computing Time, Cost, Reputation, Security Label, and Capability — provide service-oriented abstractions that complement the existing CATS Level 0/1/2 normalized metric framework. Following the registry format and separation pattern of RFC 8911 and RFC 8912, it populates a new IANA registry titled “CATS Computing Service Metrics” with a formal entry for each metric.

By its name, an individual submission in the TEAS problem space proposing RSVP(-TE) signaling extensions for SRv6 (Segment Routing over IPv6). The abstract page was not reachable on this run (404 on www.ietf.org/archive/id), so this summary is written from the document name and is approximate; it will be grounded from the official Abstract on the next run.

By its name, a new MPLS Working Group document (-00) defining extensions to MPLS Fast Reroute (FRR) — the local-protection mechanism that reroutes traffic around a failed link or node in tens of milliseconds. The abstract page was not reachable on this run (404 on www.ietf.org/archive/id), so this summary is written from the document name and is approximate; it will be grounded from the official Abstract on the next run.

Describes an interface for pre-action, risk-graded assurance for autonomous agents. Rather than expressing governance only as boundary enforcement (permit/block at the point of action), a policy stage derives an assurance requirement from a risk signal before an action proceeds, expresses it in a domain-appropriate form, records the decision in an audit record, and optionally binds it to a verified human root. It also describes the “autonomy-asymmetry” control law: a feedback loop coupling assurance requirements to VERIFY-phase pass rates with fast-down/slow-up hysteresis, with the iteration governor as its per-packet instance. Offered as input to the proposed AUDIT working group.

Defines the Verified Human Root Attestation (VHRA): a compact, privacy-preserving data structure asserting that a biometric proof-of-human verification of an identified natural person (or an M-of-N quorum) occurred at a specific issuance event. It specifies how a delegation chain binds a VHRA at its root so the binding survives attenuation, and how audit and interaction records reference a VHRA so any recorded agent action can be resolved to an accountable natural person without the verifier receiving biometric material. It standardizes only the attestation structure, its bindings, and verifier obligations — not biometric verification methods. Offered as input to the proposed AUDIT working group.

OAuth 2.0 Rich Authorization Requests (RAR, RFC 9396) standardizes the exchange and processing of authorization details but does not define metadata for describing authorization-details types, and offers no interoperable guidance for remediating resource-server failures caused by insufficient authorization details. This document lets clients dynamically discover such metadata instead of relying on out-of-band agreements, and standardizes failure signaling — including interoperable remediation when insufficient authorization details are the cause of failure.

x402 is an application-level protocol for internet-native payments built on the HTTP 402 (Payment Required) status code. This document defines how a domain publishes its x402 payment capability out-of-band so clients, autonomous agents, and indexers can discover it without prior configuration or a central directory. It specifies a JSON capability manifest served at the well-known URI “/.well-known/x402” and an optional DNS TXT record at the underscored node name “_x402” that points to the manifest. A consumer resolves a bare domain name to verified x402 capability with at most one DNS query and one HTTPS GET.

Audit receipts record what a gateway wrote about an access, but omit how data changed and whether every access left a receipt. This document defines two evidence payloads for those gaps: Transformation Evidence states which value classes were transformed, and how, without carrying the values; and Coverage Reconciliation compares source activity counters against a receipt set over a window, classifying each item as matched, observed-without-receipt, receipted-without-observation, excluded, or indeterminate — so the result is not a bare pass. Both payloads register as Signed Statements on a SCITT Transparency Service. It defines no new receipt format, transparency mechanism, or signature format.

Describes extensions to existing digital-signature schemes for key blinding. The core property is that a blinded public key and all signatures produced with the blinded key pair are independent of the unblinded key pair, and signatures from blinded key pairs are indistinguishable from those produced with unblinded keys. The functionality has a variety of applications, including Tor onion services and privacy-preserving airdrop for bootstrapping cryptocurrency systems. A CFRG (IRTF) research-group document.

Provides technical details of CVE-2026-33697 and EUVD-2026-16488 as evidence of how intra-handshake attestation fails in practice, even without physical access. It argues that intra-handshake attestation adds unnecessary complexity given that continuous attestation is generally required anyway. The findings are supported by formal-verification artifacts produced with ProVerif (Apache-2.0) and acknowledged by relevant stakeholders.