IETF Daily Digest

Extends RPC-with-TLS so that a client's X.509 certificate can carry instructions to the RPC server to execute all RPC transactions from that client under a single user identity, simplifying identity handling for TLS-protected RPC connections.

Specifies the ZeroPath VPN protocol suite, comprising three coordinated sub-protocols. HBSPV (Hop-Bound Secure Packet Validation) isolates payload decryption to the authorized egress node while letting intermediate hops validate forwarding context without accessing payload. SGCP (State Graph Cryptographic Protocol) is a three-message attested handshake enforcing mutual authentication and device-posture verification before a session is established. SCSWP (Secure Cryptographic Session Workspace Protocol) provides tamper-evident hash-chain continuity, epoch-bound forward secrecy, and continuous trust scoring across the session. The draft also specifies an opcode architecture for control- and data-plane messages, with a pure Python reference implementation.

Reports a measurement of how a signed COSE_Sign1 statement can be serialized into many distinct byte sequences that all decode to the same data item. Where a protocol identifies such a statement by a digest over its wire octets (a data-hash), the identifier is sensitive to framing while the signature is not. Taking one 165-octet COSE_Sign1 object and re-emitting it under every combination of six CBOR encoding freedoms yields 64 distinct octet sequences, all carrying an identical valid signature but producing distinct data-hash values with no collisions; a stock CBOR decoder rejected none and silently repaired 31 into canonical form on reading. The document specifies nothing and proposes no wording — it reports a measurement, publishes the reproduction recipe, and points to prior work addressing the problem.

Describes a two-layer federated reference architecture operating within the IETF DAWN (Discovery of Agents, Workloads, and Named Entities) work for agent discovery across organizational boundaries. The Local Discovery Plane performs zero-configuration agent advertisement and collection inside each site without mandating a specific link-local protocol; the Federation Plane builds a federation among site gateways to exchange lightweight Federation Metadata Records — a concrete binding of DAWN Minimum Discoverable Information — across administrative domains, with full Capability Cards retrieved on demand via authenticated unicast. It emphasizes data sovereignty through an Export Policy Engine, separates metadata indexes from full capability documents, and is informational, composing existing DAWN mechanisms rather than competing with them.

Focuses on compute and communication metrics for Computing-Aware Traffic Steering (CATS), which optimizes steering of traffic to service instances using the dynamic state of computing and network resources. CATS components exchange metrics describing resource conditions that affect instance selection. The draft defines a hierarchical abstraction of these metrics to improve interoperability, scalability, and operational simplicity. It does not standardize raw infrastructure (Level 0) metrics but specifies higher-level representations derived from raw measurements via aggregation and normalization.

Specifies procedures for distributing BGP-LS key parameters for inter-domain links between two Autonomous Systems. It defines a new BGP-LS NLRI type for an Inter-AS Link plus three new TLV descriptors for it. These extensions let operators collect inter-domain interconnect information and automatically compute the inter-AS topology from BGP-LS.

Provides a framework for deploying the Alternate Marking method, including considerations and guidance for putting the methodology into operation in real networks.

Specifies encapsulations for the Simple Two-Way Active Measurement Protocol (STAMP, RFC 8762) and its extensions (RFC 8972) in MPLS networks. It defines encapsulation of STAMP test packets for point-to-point LSPs and single-segment pseudowires, with or without an IP/UDP header, so test packets share the forwarding and ECMP behaviour of the measured data traffic, and adds two new MPLS G-ACh types. It updates RFC 8762 and RFC 8972 to let STAMP run without an IP/UDP header over MPLS LSPs and PWs, specifying the resulting changes to session-identifier, TTL/Hop-Limit, and TLV processing, plus requirements for IPv6 STAMP in unauthenticated mode using UDP zero-checksum.

Defines the concept of Service & Infrastructure Maps (SIMAP), formerly known as the Digital Map, and identifies a set of requirements and use cases. SIMAP makes the ties between service and infrastructure layers explicit, clarifies expected outcomes for operations and automation, and removes ambiguity in the term 'digital'. The document is intended as a reference for assessing whether various topology modules meet SIMAP requirements.

Specifies PCEP extensions that let a stateful Path Computation Element compute and initiate Point-to-Multipoint (P2MP) paths for SR-MPLS, from a Root to a set of Leaf nodes. Segment Routing P2MP Policies define an architecture for P2MP service delivery, and these extensions enable stateful PCE-driven computation and instantiation of those paths.

Describes GAAP, a lightweight decentralized multicast group address allocation protocol (pronounced 'gap'). GAAP needs no centralized service or coordination for the allocation protocol itself, though it depends on ASM-capable multicast routing already being provisioned. It runs among group participants that need a unique group address to send and receive multicast, targeting both IPv4 and IPv6, and offers a simple, lightweight option rather than extending an existing protocol. The document is Experimental, with rationale and completion criteria for the experiment.

Specifies stateful NAT64 translation, allowing IPv6-only clients to reach IPv4 servers using unicast UDP, TCP, or ICMP. One or more public IPv4 addresses on the translator are shared among many IPv6-only clients, and configured bindings support IPv4-initiated communication to a subset of IPv6 hosts. When combined with DNS64, no changes are needed on the IPv6 client or the IPv4 server. This document obsoletes RFC 6146.

Defines format-independent evidence requirements for control instructions issued across agent systems (stop, suspend, revoke, constrain, cancel, override). A record that a control was decided or dispatched does not prove every enforcement point received or applied it, and a missing acknowledgement does not by itself prove non-delivery. The draft separates issuer-side emission, target resolution, receiver observation, enforcement outcome, and observation of the control effect. For controls that must reach multiple targets, the unit of reconciliation is the per-target obligation, not the parent instruction. It also defines bounded negative observations, total reconciliation, population conservation, and semantic-preservation rules for intermediaries. It intentionally defines no receipt format, wire protocol, authorization system, or policy language.

Defines an IS-IS capability sub-TLV that advertises membership in Active Measurement Protocol (AMP) groups such as TWAMP and STAMP. The mechanism lets IGP routers discover other routers participating in different measurement groups, enabling automatic discovery of measurement endpoints across an IS-IS routing domain. Membership is identified by a Group ID, and the same interface address (IPv4 or IPv6) may belong to multiple measurement groups.

Describes an RDAP extension that includes DNS DELEG values in the responses to RDAP domain object queries, so that delegation information can be surfaced through the standard registration data access interface.

Discusses configuration of CBOR processors and, on that basis, provides Working Group Last Call feedback on draft-ietf-cbor-serialization-08.

Specifies IPFIX Information Elements to export the context and outcome of Source Address Validation (SAV) enforcement. These SAV-specific elements give detailed insight into why packets are identified as spoofed by capturing the specific SAV rules that triggered validation decisions. The added visibility helps operators observe SAV enforcement behaviour and analyse source-address spoofing events detected by SAV.

Proposes the SEARCH (Slow start Exit At Right CHokepoint) algorithm to improve TCP slow start. Default Linux slow start (Cubic with HyStart) can exit prematurely, degrading utilization especially on wireless links, while removing HyStart makes TCP exit too late and lose packets. SEARCH lets the sender determine the congestion point from acknowledged deliveries, comparing delivered to sent bytes, smoothed for latency variation and normalized for link capacity, exiting slow start when delivered bytes fall below expectation. It was implemented in Linux, FreeBSD, and QUIC and evaluated over WiFi, 4G/LTE, and LEO/GEO satellite links, reliably exiting after the congestion point but before packet loss.

Specifies the Testimony Record, an append-only interchange format for the account an automated system gives of its own operation: what it believed, what evidence each belief rested on, which beliefs contradicted one another, what actions it attempted, and who authorised the consequential ones. The format lets a party who was not present and has no access to the emitting system read a record and mechanically check specific properties, across four defined conformance levels. It is explicitly not a logging format: logs record what a program did, whereas a Testimony Record states what a system claimed to know, what disagreed with it, and what it was permitted to do about it.

Describes an attestation-bound execution-finality architecture for AI agents and autonomous workloads that emit consequential operations (API calls, storage mutations, network/config changes, financial instructions). Remote attestation appraises the execution environment but is not, by itself, an authorization for each operation. Here a consequential operation first exists as a non-effective Candidate Act; before it can acquire external effect its parameters are cryptographically bound to validation context (Attestation Results, workload identity, policy, authorization scope, freshness). A designated Finality Sink verifies the binding at or before the effectuation boundary, separating environment appraisal from authorization of a concrete operation. It complements RATS, EAT, workload identity, confidential computing, and TEEs rather than replacing them.

Describes a recurring interoperability problem in exported network telemetry: many values are encoded without an explicit definition of the scope in which they are unique, meaningful, and comparable. A wire representation may be standardized while the value's semantic context stays implicit, so a receiver can wrongly treat two numerically identical values from different domains as equivalent. This can cause incorrect aggregation, cross-instance comparison, and wrong conclusions about routing or forwarding state. The draft argues that exported telemetry identifiers and statistics MUST explicitly define both their scope of uniqueness and the conditions under which they may be compared, for any telemetry mechanism (not only BMP) where a value can arise in multiple semantic domains.

Defines a second reconciliation population for the Cedulon core, which matches an issuer's signed receipts against an authenticated extract of a rail. Here a signed Decision Record (from the party that decided whether an agent may act) is reconciled against an authenticated Effect Extract listing effects that actually occurred on a channel: an allow must be matched by exactly one effect whose content hash the record named, and a refusal must be matched by none. The profile defines the Decision Record claim set, the Effect Extract shape, the departures from the spend rules, finding codes, and a media type. This revision binds the class of the allowed effect into the signed record and narrows what the decider's chain is claimed to control; the text is provisional.

Defines a portable, cryptographically signed receipt format for recording machine-to-machine access-control decisions. Each receipt captures the decision maker's identity, the tool or resource accessed, the policy evaluation result, and a timestamp, all signed with Ed25519 and serialized using deterministic JSON canonicalization. It targets environments where AI agents invoke tools on behalf of human operators, particularly the Model Context Protocol (MCP) ecosystem. Receipts are independently verifiable without contacting the issuer, enabling offline audit, regulatory compliance, and cross-organizational trust federation.

Registers a range of sixteen CBOR simple values (0 to 15) that different specifications can share for CBOR transformations such as compression or templating in a non-conflicting way. This lets current and future specifications reuse the smallest, single-byte simple-values range while defining their own use of them, avoiding version negotiation. The document updates RFC 8949 (CBOR, STD 94).

Provides an overview of terms and abbreviations related to Source Address Validation (SAV) to establish a common, consistent terminology for use across SAV discussions and documents. It explicitly does not serve as an authoritative source of correct terminology, but as a shared reference.

Codifies a consistent, reversible convention used in threat-intelligence and security communities for sharing potentially malicious indicators of compromise (URLs, IPs, email addresses, domain names). The obfuscation format reduces the risk of accidental execution or activation when IOCs are displayed or transmitted: the transformation makes an indicator syntactically invalid as a URI while keeping it human-recognizable, and the original value can be recovered deterministically. Safe-IOC strings are a textual rendering convention, not URIs, and are not meant to be parsed by generic URI parsers. The goal is better interoperability among tools and feeds exchanging threat intelligence.

Defines the API-key session-credential grant type for the Agent Enrollment Protocol (AEP). The grant type lets an AEP Service issue an opaque API key through the AEP Grant command, for deployments that already operate header-based API-key authentication.

Defines the Basic session-credential grant type for the Agent Enrollment Protocol (AEP). It lets an AEP Service issue an HTTP Basic credential through the AEP Grant command, for deployments already integrated with HTTP Basic authentication middleware.

Defines the OAuth Bearer session-credential grant type for the Agent Enrollment Protocol (AEP). It lets an AEP Service issue an OAuth-style Bearer access token through the AEP Grant command while preserving baseline AEP client-assertion authentication as the root of trust.

Defines interoperable hosted-identity behaviour for Agent Enrollment Protocol (AEP) Platforms. A Platform can provision Service-scoped agent did:web identities, publish DID documents, custody signing keys, and produce AEP client-assertion JWTs through delegated signing operations.

Defines the Agent Enrollment Protocol (AEP), an HTTP-based mechanism for autonomous agents to discover service enrollment requirements, enroll an agent identity, obtain optional session credentials, revoke them, and query enrollment status. AEP uses Decentralized Identifiers, client-assertion JWTs, and HTTP Problem Details to provide a narrow, machine-first enrollment and authentication substrate for agent-to-service interactions.

Defines the Offering Discovery Protocol (ODP), which lets an automated agent inspect a Service, discover its Collections and Offerings, interpret Service-defined structured attributes, and identify links to subsequent operations. ODP supports catalogs from a few Offerings to large marketplaces without imposing a universal product taxonomy, and defines the protocol's scope, terminology, roles, discovery architecture, extensibility model, composition boundaries, and conformance model.

Specifies PACT, which adds liability as a required, co-signed member of an agent contract and propagates it through a subcontract tree, filling a gap where existing agent specifications make no party financially answerable for undelivered results. PACT defines the Verifiable Task Contract (binding parties, scope, price, verification profile, and liability allocation), a Delivery object the contract is judged against, an escrowed settlement whose release is conditioned on a stated assurance level rather than elapsed time, and a subcontract tree where a parent's Work Attestation commits to its children by Merkle root and liability cascades upward. It composes existing identity, authorization, audit, payment, and reputation work rather than redefining them; its settlement loop is optimistic fair exchange.

Proposes a data-plane-based method for rapidly advertising end-to-end path bandwidth information using a bitmap encoding, enabling fast load-balancing adjustments in AI/ML data-center fabrics.

Specifies algorithm encodings and representations for the SQIsign digital signature scheme within the COSE and JOSE frameworks. SQIsign is an isogeny-based post-quantum signature scheme (under NIST PQC evaluation) with unusually compact signature and public-key sizes, useful for infrastructure bottlenecks such as the FIDO2 CTAP2 specification on in-service devices. The draft notes SQIsign does not expose the auxiliary torsion-point information exploited in SIDH/SIKE attacks, so Castryck-Decru techniques do not directly apply, while the scheme remains subject to ongoing cryptanalysis. Stable COSE/JOSE identifiers provide the interoperability needed to integrate post-quantum security into bandwidth-constrained and legacy-compatible hardware.

Defines the Reilly Government Integrity Protocol (RGIP), a standards-aligned method for producing permanent, independently verifiable public records by combining multi-algorithm content hashing, public timestamp anchoring, archival deposit under a persistent identifier, decentralized storage, and web archiving in a single pipeline. This revision corrects defects that prevented verification or overstated guarantees, replacing a single-algorithm cross-chain hash with an entangled link-and-braid construction, adding a canonical domain-separated encoding, separating the signed Evidence Receipt Core from the mutable anchor envelope, and adding chain-checkpoint anchoring and salted field commitments. It narrows earlier post-quantum claims and documents itself as a prior-art record.

Analyzes the security and operational implications of fragmenting cryptographic keying material and key-establishment messages on constrained devices. Post-quantum and modern algorithms bring larger key sizes, and constrained technologies (6LoWPAN, SCHC, and similar adaptation layers) use explicit fragmentation to carry messages exceeding link-layer frame sizes, so keying material may be split across fragments. The draft identifies common fragmentation patterns and examines risks including fragment loss, reordering, duplication, and partial exposure, and discusses fragment-level integrity, replay resistance, and correct binding of fragments to cryptographic session state. It defines no new cryptographic algorithms or fragmentation mechanisms.

Defines the Agent Execution Protocol (AEP) for the Sovereign Object OS (SOOS) governance architecture: the normative five-step loop (SENSE, REASON, PLAN, ACT, OBSERVE) by which a governed AI agent interfaces with a Governing Enforcement Component (GEC) at each iteration. It specifies the Context Package delivered at SENSE, the GEC Query Interface at PLAN, the Transition Request at ACT, and the atomic GEC response at OBSERVE, with Standard and Goal-Execution-Engine conformance modes. REASON is intentionally left GEC-unspecified (the LLM is opaque to the protocol). Later revisions add XPID binding at session open, new session states, an Expected Outcome Declaration, OpenTelemetry mapping, and DAM lineage and residency validation before a transition's event-stream write.

Defines the Agent Orchestration Protocol (AOP) in the SOOS family, for the case where a mission is too large for one agent and must be delegated. A governed orchestrating agent decomposes a mission into a governed sub-goal directed acyclic graph, delegates sub-goals to sub-agents via kernel-mediated Assignment Primitives, and maintains a Mission Plan Sovereign Object and Mission Status across the multi-agent lifecycle. It specifies the Expected Outcome Declaration as the pre-commitment structure, the Mission Plan SO encoding SEQUENTIAL/PARALLEL/CONDITIONAL dependencies, and the Assignment Primitive requiring an endorsed EOD and producing a Sub-Agent Composition Record. It integrates with intent declaration, per-agent execution governance, audit records, and human escalation.

Specifies the Kernel Identity and Attestation (KIA) protocol for the SOOS governance architecture. KIA defines the cryptographic identity of the GEC, the trust chain anchoring kernel authority from hardware root through an operator root keypair to every signed Event Log entry, the GEC Manifest schema for runtime state attestation, and Revocation Registry maintenance. It is the Layer-0 signing and attestation component on which the audit, mandate-enforcement, and multi-agent-delegation guarantees of the other SOOS drafts depend. Revisions add FROST threshold signing, the Cross-Principal Identifier (XPID) for cross-instance federation correlation, and security fixes addressing FROST nonce reuse, identity takeover, and attestation channel binding.

Defines the Multi-Agent Delegation (MAD) protocol in the SOOS family, answering who is responsible when several agents — one coordinating, others executing — operate on shared objects. It defines the Sub-Agent Composition Record for kernel-governed sub-agent spawning, a hub-only constraint for sub-agent communication topology, XPID cross-cluster integration, and normative revocation trigger classes with completion states and cascade behaviour, including a Compromise trigger. MAD's single recoverable property is that the accountability chain is always reconstructable from the GEC-signed audit record alone: cascade revocation means one decision stops the whole delegation tree, and the spawning of that tree is itself governed.

Defines the Mandate JWT (MJWT) in the SOOS family, a WIMSE workload-credential profile that binds an AI agent's authority to a specific Sovereign Object instance under a named human principal, with a cryptographically enforced delegation ceiling and a multi-dimensional Narrowing Property that prevents any sub-agent from exceeding the root human principal's authority. It is the authorization primitive referenced by the other SOOS governance drafts. Revisions add a consent-scope dimension and claims for GDPR/APPI compliance, a purpose-code registry, mandatory live re-verification of parent mandates, a max-delegation-depth bound closing a denial-of-service vector, and clarified Revocation Registry alignment with the KIA draft.

Specifies the Resource Governance Protocol (RGP) in the SOOS family: a two-stage discovery and declaration protocol by which physical resources, digital services, and AI model instances declare their capability class, trust level, operational constraints, and availability to a governed agent operating under a Mandate JWT. Stage 1 delivers a capability fingerprint via a well-known URI; Stage 2 delivers a full governance envelope for mandate-scope validation and Resource Map Sovereign Object construction. RGP defines eight capability classes, four trust levels, a three-condition autonomous fallback test, and integrations with the Agent Execution Protocol, Governance Audit Record, and Human Escalation Mechanism, plus profiles for AI model instances and physical resources.

Defines the Sovereign Object (SO) in the SOOS family: a causally ordered, policy-governed, typed, living document that evolves through a predefined finite state space under Governing Enforcement Component authority. The SO is the unit of governance — the thing agents operate on, the GEC governs, and humans reason about. The draft specifies its five-layer structure (Identity, State, Event Stream, Typed Graph, Attachment Index), a Zone A/Zone B boundary model, a five-phase lifecycle, an SO Type system, a Cedar policy context model, and the binding by which a Mandate JWT binds an agent to a specific SO instance. Revisions add SO Type registry governance and a subtype model, and defer Mission Plan/Status subtypes to the orchestration protocol.

Specifies vaara.receipt/v1, a signed and independently recomputable record binding a decision about an autonomous action to the evidence it was made on, and optionally to external timestamp anchors. It is canonicalized with the JSON Canonicalization Scheme so any third party can recompute its digests and verify its signature without issuer access; a decision and its execution receipt form one recomputable pair via a back link. Trust is root-agnostic — verifiable with or without a hardware TEE — and re-expressible as an IETF RATS Entity Attestation Result. Downstream specs (payment rail, compliance regime, framework integration) pin a version and add only their evidence schema. The format is deployed with public conformance vectors and standalone checkers.

Defines the Agent Dispute Resolution Protocol (ADRP), a wire protocol and state machine for resolving disputes from cryptographically-attested agent-to-agent transactions; it is the companion to ATXN, which defines what an A2A transaction is. ADRP severs the assumption that a valid cryptographic proof bundle equals contractual satisfaction: verifiers prove an agent took specified actions but not that they satisfied the principal's Intent Mandate. It bifurcates disputes into a cryptographic class (resolvable by code from the proof bundle and mandate chain) and a semantic class (resolvable only against pre-committed acceptance criteria, escalating to arbitration when absent). It introduces an Arbitration Mandate and a counter-attestation override pattern where a signed RulingBundle supersedes a ProofBundle by precedence, preserving both forever in the hash chain.

Defines the Agentic Integrity Verification Standard (AIVS), a portable, self-verifiable archive format for cryptographic proof of AI agent sessions. An AIVS bundle is a gzip-compressed tar archive containing a SHA-256 hash-chained audit log, an Ed25519 signature over the chain, a machine-readable manifest, and an embedded verification script needing only Python 3 standard library. It also defines AIVS-Micro, a minimal ~200-byte attestation for continuous monitoring and API responses. AIVS lets any party verify offline that every action is accounted for and unmodified, that no actions were inserted, deleted, or reordered, and that the session came from a specific cryptographic identity — without installing software beyond Python 3.

Specifies the Agent Referral and Escrow Framework (AREF), a protocol for cryptographically attributed agent-to-agent referrals, escrow-bound commission commitments, and dual-rail financial settlement in multi-agent environments. As agents transact to acquire capabilities, no standard mechanism records how one agent introduced another, binds that introduction to a financial commitment, or settles commissions across heterogeneous payment infrastructure. AREF defines a portable Ed25519-signed attribution proof for referral chains of arbitrary depth, the SwarmSync-Referrer HTTP header semantics binding a referrer to an escrow at hold time, a commission vesting model tied to escrow finality, a unified settlement finality signal over both traditional rails (Stripe Connect) and cryptographic channels (X402), and a JSON embedding mechanism for propagating referral codes without human involvement.

Specifies the Agent Trust & Execution Passport (ATEP), an open standard for representing an AI agent's verifiable track record of work across marketplaces and platforms. ATEP defines a portable, machine-readable credential format encoding an agent's execution history, success rate, capability domains, trust tier, and earned badges, computed entirely from append-only execution logs so it cannot be manually inflated. It is positioned as the trust layer for agent-to-agent commerce, giving a universal format for answering whether to hire a given agent as it moves between marketplaces.

Defines a canonical, defensible, machine-checkable primitive for an Agent-to-Agent (A2A) transaction: the bundle of cryptographically signed elements constituting a recorded value exchange between two software agents acting for identified principals, conformance tiers determining which elements are required, rail-specific Profiles mapping the bundle to existing payment infrastructure, and a two-tier validity model distinguishing externally-adjudicable from operationally-valid uncontested exchanges. ATXN is the foundational primitive for escrow, dispute resolution, audit, and liability allocation in agentic commerce, designed to produce evidence mappable to existing contract and agency frameworks without requiring agent legal personhood. It maps to AP2, Stripe ACP, Visa TAP, Mastercard Agent Pay, and x402 as Profiles of a single bundle.

Specifies SwarmScore V1, a transparent, community-governed open standard for agent reputation scoring in open marketplaces. It provides a two-dimensional scoring system measuring technical execution (via Conduit browser verification) and commercial reliability (via the AP2 payment protocol), with volume-scaled metrics rewarding consistent high-volume performance and cryptographically signed certificates enabling decentralized trust. The document specifies the complete standard: formula, trust tiers, escrow integration, wire format, governance model, legal framework, implementation guidance, a V2 roadmap, competitive analysis, and known limitations.

Extends the SwarmScore V1 two-pillar reputation protocol with a third dimension, Safety, measured via controlled canary prompt testing. The draft specifies five formally-analyzed design decisions for the canary subsystem: mandatory testing thresholds, hybrid response classification (pattern matching plus an opaque LLM ensemble), dedicated test-session placement, prompt library composition and rotation, and session isolation to reduce buyer-harm risk. V2 Canary is backwards-compatible with V1 (all V1 scores unchanged); the five-pillar formula covers Technical Execution, Commercial Reliability, Operational Depth, Safety, and Identity Verification.

Specifies Verified Commerce for Agent Protocols (VCAP), an open standard for settling financial transactions between autonomous AI agents using cryptographically verifiable proof of work delivery. VCAP defines the message formats, state machines, cryptographic bindings, and callback contracts an agent marketplace needs to hold funds in escrow, automatically verify deliverables via independent verification engines, and release or refund payments based on machine-verifiable evidence. It is a settlement layer complementing agent-to-agent communication protocols such as Google A2A or the Agent Protocol: where those define how agents discover and talk to each other, VCAP defines how they pay each other with proof that work was done.

Defines a binding between Verified Commerce for Agent Protocols (VCAP) and the Agent Payments Protocol (AP2). AP2 supplies agent-commerce authorization evidence through IntentMandate, CartMandate, and PaymentMandate artifacts, while VCAP supplies delivery verification, settlement evidence, escrow directives, timeout handling, and dispute handoff. This revision deliberately does not model AP2 as an escrow or settlement state machine — AP2 is treated as an authorization and security layer within a surrounding commerce protocol — so the binding references AP2 mandates by cryptographic digest or opaque identifier and leaves payment capture, refund, and settlement to the commerce protocol and payment rail.

Defines a trust model for agent-to-agent (A2A) interactions in multi-agent AI systems. It specifies how agents obtain verifiable identities via CA-signed templates, how spawn chains are cryptographically established and validated, how dynamic policies are governed under a dual-signature model, and how cross-organizational agent interactions are explicitly authorized. The model applies existing PKI primitives (X.509, CRL, CSR) and established identity patterns (OAuth 2.0, On-Behalf-Of) to the problem of agent provenance. It explicitly excludes agent-to-resource access control, human-in-the-loop orchestration, and agent behaviour, which belong to the resource enforcement and orchestration layers.

Describes the necessity and feasibility of introducing a proxy network node between a congested node and the traffic sender to translate congestion notifications. The congested node sends a congestion notification to the proxy in a format defined in the document, and the proxy translates it into a format the traffic sender understands and resends it, enabling congestion signaling where sender and congested node use different notification formats.

Addresses a limitation of the Route Target Constrain mechanism (RFC 4684), which builds a route-distribution graph to restrict propagation of VPN routes. In networks using hierarchical route reflection, the existing RT-Constrain mechanism cannot guarantee a correct route-distribution graph. The draft describes the problem scenario and proposes solutions to fix RT-Constrain in hierarchical RR deployments.

Describes a YANG data model for the Locator/ID Separation Protocol (LISP), usable to configure and monitor the control-plane and data-plane elements of a LISP network. The modules conform to the Network Management Datastore Architecture (NMDA, RFC 8342).

Defines an OAuth 2.0 extension (to RFC 6749) that lets a client instance include a key-bound attestation when interacting with an Authorization Server or Resource Server. This lets a client prove its authenticity, verified by a client attester, without revealing its target audience to that attester, and can also serve as a mechanism for OAuth client authentication.

Presents the OAuth 2.1 authorization framework, which lets an application obtain limited access to a protected resource, either on behalf of a resource owner via an approval interaction with an authorization service, or on its own behalf. This specification replaces and obsoletes the OAuth 2.0 Authorization Framework (RFC 6749) and Bearer Token Usage (RFC 6750), consolidating current best practice.

Describes how an Extensible Provisioning Protocol (EPP) connection is mapped onto HTTP. EPP over HTTP (EoH) requires the use of TLS to secure EPP information (i.e. HTTPS).

Defines YANG data models for managing the RPKI-to-Router (RTR) protocol as specified in RFC 6810 and RFC 8210, giving operators a standard model for configuring and monitoring RPKI-to-Router deployments.

Describes an approach to build Segment Routing based Network Resource Partitions (NRPs) using resource-aware SIDs, to deliver enhanced VPN services. Enhanced VPNs need guaranteed resources, latency, and jitter, requiring integration between overlay VPN connectivity and underlay characteristics. An NRP is a subset of network resources and policies on a connected set of underlay links. SR steers packets through an ordered list of segments identified by SIDs, and resource-aware SIDs associate a segment with a set of network resources. A group of such SIDs builds SR-based NRPs that provide the customized topology and resource attributes required by one or a group of enhanced VPN services.

Defines TLS/DTLS 1.3 profiles for Internet of Things devices with resource constraints, as a companion to RFC 7925 (which covered TLS/DTLS 1.2). It also updates RFC 7925 with respect to the X.509 certificate profile and ciphersuite requirements, guiding developers building constrained IoT devices on modern TLS.

Provides simple guidance for users of common AEAD functions on how to limit the use of keys to bound the advantage given to an attacker. AEAD algorithms provide confidentiality and integrity, but excessive use of the same key can help an attacker break these properties. The document gives limits in both single-key and multi-key settings, and is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Defines the Agent Delegation Chain, a profile of OAuth 2.0 JWT access tokens (RFC 9068) for AI agents that delegate tasks to other agents. Each delegation should convey only a bounded subset of the delegator's authority, and any enforcement point should be able to verify offline, without an authorization server, that a token at hop N carries authority no greater than hop N-1 back to a trusted root. Authority is carried as Rich Authorization Requests (RFC 9396), each link is bound to its parent by a cryptographic byte-commitment, and a deterministic offline algorithm enforces monotonic attenuation, bounded depth, and monotonic expiry. It reuses JOSE, proof-of-possession (RFC 9449), and status-list machinery and introduces no new cryptography.

Describes how devices joining an autonomic control plane (RFC 8994) can use the BRSKI onboarding mechanism (RFC 8995) even when they cannot present a manufacturer-installed X.509 IDevID certificate. Such devices instead generate a self-signed certificate that embeds a unique token drawn from a one-time pad, providing an onboarding identity where a factory IDevID is unavailable.

Defines an Informational architecture for deciding whether navigation from a scanned QR code carrying an absolute HTTP/HTTPS URI is authorized. Deployed scanners often decode and hand off such URIs without any interoperable account of authorization, despite these codes initiating payment, ordering, and institutional workflows. The draft introduces 'trust residuals': typed, evidence-bearing deviations between a scanned artifact and issuer-chain, destination-policy, redirect-flow, runtime-safety, freshness, and artifact-integrity constraints. Given a residual vector and a declared verification profile, explicit precedence rules map the result to a bounded set of scanner decision states, with security invariants preventing reputation, HTTPS transport, or runtime-safety signals from upgrading an untrusted issuer path. It does not define a payload carrier or final wire format.

Defines a mechanism for temporal anchoring of digital artifacts by committing cryptographic hashes to the Bitcoin blockchain via the OpenTimestamps protocol. The resulting proof is independently verifiable by any party with access to validated Bitcoin chain data, without contacting the anchoring service. The SCITT architecture is used as the primary integration example, and no changes to SCITT are required.

Notes that advertising capabilities in IGP Hellos is useful for supporting optional features while establishing and maintaining adjacencies, and defines a new TLV to be carried in Hellos to advertise such capabilities.

Provides technical details of CVE-2026-33697 and EUVD-2026-16488 as substantial evidence of how intra-handshake attestation fails in practice, even without physical access. It argues that, because continuous attestation is generally required, intra-handshake attestation adds unnecessary complexity. The results are backed by research and by artifacts in the ProVerif formal-analysis tool, released under Apache-2.0 for reproducibility, and have been acknowledged by relevant stakeholders.

Describes PSHMP Core, a hybrid L4-oriented overlay designed to keep multi-hop data delivery working when nodes, links, or segments become unstable. It runs above ordinary IP and needs no Layer 3 routing changes. Under stable conditions it builds linear relay chains; when several nodes degrade it switches locally into a mesh-style recovery mode that collects alternative candidates, applies progressive fallback, enforces a quality gate, and replaces the affected path. Supporting mechanisms include continuous node assessment (K-Factor), diversity-aware selection, failure tracking, gossip/DHT discovery, and batch acknowledgements with gap recovery. It documents architecture, operating principles, and key formulas relative to an experimental implementation.

Defines a method for calculating reverse paths by advertising reverse prefix costs, aiming to solve strict Reverse Path Forwarding (RPF) check failures caused by mismatched bidirectional path costs in multi-area IGP scenarios.

Addresses the fact that LISP's on-demand discovery model is ineffective for 'silent hosts' that do not initiate traffic, common in manufacturing and IoT where low-power devices go silent to save energy. The draft proposes discovering these hosts via the LISP mapping system: xTRs that can probe an EID prefix register that capability with the Map-Server, and when a Map-Request for an unknown destination arrives it is forwarded and replicated to all xTRs registered for the covering prefix, initiating a controlled on-demand discovery. This is a scalable alternative to network flooding for locating silent endpoints.

Defines version 02 of the Reilly Banking Integrity Protocol (RBIP), a compliance-grade architecture for generating immutable, auditor- and regulator-verifiable evidence trails in banking operations. RBIP combines cryptographic anchoring via a public timestamping service with archival deposit under a persistent identifier to produce permanent, tamper-evident records across Proof-of-Reserves & Liquidity, Loan Origination & Collateral Chain, and KYC/AML Evidence Ledger domains, plus a system-evidence domain. This revision corrects defects that prevented independent verification, adopting the RFC 9162 Merkle construction, salted field commitments, an Evidence Coverage Attestation, and heartbeat bundles. It targets compliance with regimes such as Basel III/IV, SOX, BSA/AML, DORA, and MiCA, and is published as a timestamped prior-art record.

Addresses workloads with geographic limitations, often driven by regulation requiring computation in a particular jurisdiction. Many mechanisms may create Evidence of location for evaluation by a Verifier, and regardless of mechanism the verification result can be expressed in a similarly defined EAT Attestation Result. The draft is about encoding a variety of geographical conclusions in an Attestation Result, and an appendix describes one mechanism for directly creating a geographic result as an Endorsement.

Defines the carriage of ad creative signaling — creative identity, tracking events, and measurement verification metadata as specified by SVTA 2053-1 — in records on a Media over QUIC (MOQT) Streaming Format (MSF) Event Timeline track.

Specifies the Governance Audit Record (GAR), the audit architecture for agentic AI systems in the SOOS family. GAR defines five audit types, the Session Audit Record, an Audit Alert system, auditor principal categories, and an Audit Package for external regulatory inspection, providing verifiable evidence that agent sessions were governed per the Intent Declaration Primitive and Human Escalation Mechanism. It is a domain-specific application of SCITT extended with causal-ordering semantics, and defines the Authority Lifecycle Event category covering revocation and recovery. Later revisions add an OpenTelemetry governance semantic convention, domain-separated RFC 9162 Merkle construction for Session Blocks, and fixes surfaced by interop and security review.

Defines the Human Escalation Mechanism (HEM) in the SOOS family: what a Governance Execution Controller (GEC) does when an agent session needs human judgment before continuing. Without such a protocol an agent may proceed beyond its authorization, stall silently, or keep running under a terminal mission. HEM replaces these with a single governed path — the GEC places the session in a defined HEM_PENDING state, routes a structured escalation to designated human principals along an ordered chain, prohibits all state transitions until a decision is received, and processes six defined decision types. It also defines a Policy Rationale Declaration and Decision Rationale Record, is non-bypassable by agent or application, and supports the human oversight required by EU AI Act Article 14.

Specifies a standard logging format for autonomous AI agent systems. The Agent Audit Trail (AAT) defines a JSON-based record with mandatory fields for agent identity, action classification, outcome tracking, and trust-level reporting, linked via tamper-evident SHA-256 hash chaining (RFC 8785) with optional ECDSA signatures for non-repudiation. It targets EU AI Act (Regulation 2024/1689) requirements for automatic recording of events for high-risk AI systems effective August 2026, and maps to SOC 2, ISO/IEC 42001, and PCI DSS logging requirements. The format is transport-agnostic, supports export to JSONL, Syslog, and CSV while preserving chain integrity, and addresses GDPR via hashing and tombstone-based deletion. Revision -02 adds a decision-reproducibility section.

Describes PALA-1, a compact binary record format for tamper-evident audit trails produced by AI inference runtimes and robotic control systems, for deployments that are computationally modest, have no reachable external witness, and separate the right to verify a trail from the right to read what it records. Records form an append-only hash chain; integrity verification needs no key material, inspects no record bodies, and costs one hash per record rather than one signature. The format distinguishes three separately answerable questions — internal consistency, completeness against an external anchor, and existence at a point in time against an external witness — and states which of the three a given trail supports. It is frozen at version 1.0 and described as an existing wire format.

States the Single-Stack 100/50 Principle: two formally derivable consequences of retiring the IPv4 stack in a dual-stack environment — 100% elimination of executable attacks attributable to IPv4 (under the document's definition) and an exact 50% reduction in the count of concurrently exposed network-layer protocol-stack surfaces, stated as a minimum structural floor. The analysis is bounded to Layer 3 and a defined parameter universe, with axioms stipulating protocol independence, state transitions, addressing/routing domains, and vulnerability execution. Theorem I follows by removing the IPv4 Layer-3 execution precondition; Theorem II by enumerating two exposed surfaces before retirement and one after. Neither theorem depends on empirical attack volume, nor claims IPv6 is inherently more secure than IPv4.

Defines a SCITT profile for Physical-Site Engagement Receipts (PSER): tamper-evident, signed, offline-verifiable records describing an autonomous or human-directed physical engagement at a specific real-world site under a defined operating envelope. Each receipt is a SCITT Signed Statement encoded as a COSE single-signer message carrying a JCS-canonicalized JSON payload with a five-artifact vocabulary covering the Site, the Operator and Actor, the Engagement Window and Envelope, TEE attestation evidence, and an adapter write-in. The profile makes a deliberately narrow, checkable claim that a specific engagement occurred at a specific site under a specific envelope with TEE-sealed evidence, and does not claim the engagement was safe or wise. It uses a three-party trust model (site owner, TEE silicon vendor, issuer) that no single party can forge or repudiate.