IETF Drafts & RFCs — Daily Digest

Defines two evidence structures for automated-data-access audit receipts. Transformation Evidence is a per-disclosure statement of which classes of values were transformed and how, carrying counts and class names but never the values themselves. Coverage Reconciliation compares a data source's own activity counters against a receipt set over a time window and classifies the outcome, distinguishing matched, observed-without-receipt, receipted-without-observation, excluded and indeterminate cases rather than reporting a bare pass/fail. Both are designed to be registered as SCITT Signed Statements. The document defines only the evidence payloads, not a new receipt, transparency or signature format.

Defines the EMILIA Protocol authorization receipt, which binds an enrolled approver's key to one specific action before execution. An approver key signs an Authorization Context (action hash, policy reference, authorization instance, per-signoff nonce, audience and validity window). A Trust Receipt carries the signed contexts, terminal consumption record and Merkle inclusion material so a relying party can verify the event offline against independently chosen log, directory, policy and approver trust inputs. This revision defines the closed EP-AUTHORIZATION-BUNDLE-v1 pre-execution profile and its verification algorithm. The receipt is evidence, not authorization; the authorization decision stays with the authorization server.

Defines the Action Evidence Boundary (AEB), an executor-side processing model for consequential agent actions that cross identity, transport, authorization, policy and execution systems. Each system can emit a valid artifact while the executor still lacks a safe rule for joining artifacts to the exact effect, consuming one-time authority and handling uncertain outcomes. AEB requires native artifact verification, Canonical Action Identifier (CAID) matching, Authorization Evidence Chain satisfaction, a separate local authorization decision, durable atomic consumption or reservation, invocation, closed effect outcomes and authenticated reconciliation. It defines no receipt or token format, policy language or new registry.

Addresses how to hold autonomous and semi-autonomous agent actions accountable to a regulator, auditor or counterparty who does not trust the operator. It frames four independently verifiable questions -- whether the agent could act (CAN), which accountable human authorized the specific action (WHO), what the agent did (WHAT), and whether the runtime enforced correctly (AUDIT). The Informational document specifies how such profiles compose via a shared action-digest, each verifying independently, and defines a shared conformance-vector suite. Its aim is to make reachable an anchored, third-party-verifiable tier (via SCITT) beyond today's self-attested agent records, without mandating a single record format.

Updates RFC 9970. RFC 9970 recommends STIR PASSporTs on re-INVITE and BYE requests after connected identity is established, claiming this prevents spoofed mid-dialog or dialog-terminating events. The baseline PASSporT of RFC 8224 does not bind the SIP request method, CSeq, Call-ID or dialog tags, so a valid PASSporT can survive when an in-dialog request is transformed into a different request whose authenticated identity fields are unchanged. This draft defines the "sipctx" PASSporT type, which binds the SIP request method and dialog/sequence context so implementations relying on PASSporT validation can check mid-dialog request authenticity.

Specifies a format for action receipts: compact, individually signed JSON records stating that a specific AI agent attempted a specific action at a specific time, under a specific policy decision, and what the outcome was. Receipts are linked into an append-only hash chain so tampering can be detected, and the format is self-contained -- verification needs only the records plus a separately obtained trust anchor. The specification covers record fields, the signed byte sequence, chain linkage, verification procedures and test vectors.

Specifies the FAF Agent Format (.fafa), a declarative YAML-based format describing an agent's identity, the capabilities it exposes and the endpoints through which it is reached. A .fafa document describes an agent but never instructs one. Registered as application/vnd.fafa+yaml in the IANA vendor tree, it is the agent member of the FAF family alongside .faf (project context) and .fafm (agent memory), acting as a portable passport for who the agent is, what it may do, where it is reached and what it must never do. It complements protocol-native cards (A2A, MCP) and AGENTS.md rather than replacing them, and only documents an existing registration.

By its name, an individual submission on AI governance ("aigov"). The official abstract page could not be retrieved on this run (404), so this description is approximate and based on the draft name only; it probably outlines governance considerations, roles or requirements for AI systems in an IETF context. Specific scope, mechanisms and terminology are not asserted here and will be grounded from the abstract on the next run once the page is available.

An IPPM working-group draft, by its name a version 2 of an encrypted Performance and Diagnostic Metrics (PDM) mechanism -- likely an IPv6 destination-options metric carrying timing and sequence data with confidentiality protection. The official abstract page could not be retrieved on this run (404), so this description is approximate and based on the name/title only; specific fields, cryptographic constructions and version-16 changes are not asserted here and will be grounded from the abstract on the next run.

Defines two evidence structures for automated-data-access audit receipts. Transformation Evidence is a per-disclosure statement of which classes of values were transformed and how, carrying counts and class names but never the values themselves. Coverage Reconciliation compares a data source's own activity counters against a receipt set over a time window and classifies the outcome, distinguishing matched, observed-without-receipt, receipted-without-observation, excluded and indeterminate cases rather than reporting a bare pass/fail. Both are designed to be registered as SCITT Signed Statements. The document defines only the evidence payloads, not a new receipt, transparency or signature format.

Defines an Extended CONNECT protocol for relaying UDP between two clients authenticated by the same proxy. A Listener registers with the proxy, and a Client uses the resulting Rendezvous ID to connect to it. No public UDP address is allocated. The mechanism targets MASQUE-style deployments where two endpoints behind the same proxy need to exchange UDP without exposing a publicly reachable address.

Specifies the Erik Synchronization Protocol for the Resource Public Key Infrastructure (RPKI). Erik Synchronization is a data replication system using Merkle trees, a content-addressable naming scheme, concurrency control via monotonically increasing sequence numbers, and HTTP transport. It is used to interact with Erik Relays, a new intermediary layer between the Repository Publication Point and Relying Parties that improves scalability. Relying Parties can combine information retrieved via Erik Synchronization with other RPKI transport protocols. The design aims to be efficient, fast, easy to implement and robust against network partitions or faults.

Defines ba64, a text encoding for binary data that is never larger than standard base64. An encoder races DEFLATE compression against plain base64 and emits whichever result is shorter. Compressed output is marked by a leading "=" character -- inside the base64 alphabet, so it survives base64-safe channels, yet can never begin a valid base64 string, keeping the two forms unambiguous. A CRC-32 over the decoded bytes ensures a ba64 decoder never silently returns wrong data. The plain form is byte-identical to base64, making ba64 decoders a drop-in replacement, and an optional padding method decouples emitted length from input compressibility.

Defines implementation-neutral requirements for persistent node identity, declared state, and governed lifecycle operations -- admission, suspension, revocation, re-admission and succession -- in Web4-class federations. It specifies what such a system must provide rather than a particular mechanism, giving federations a common vocabulary for managing node membership and state over time. This is a -00 initial submission; further detail is expected in later revisions.

Defines Physical-Site Engagement Receipts (PSER): tamper-evident, signed, offline-verifiable records describing an autonomous or human-directed physical engagement at a specific real-world site under a defined operating envelope. Receipts are SCITT Signed Statements in COSE format carrying JSON payloads with the Site, Operator/Actor, Engagement Window and Envelope, TEE-based Attestation Evidence, and an Adapter Write-In to an operations layer. The profile makes deliberately narrow claims -- that a specific engagement occurred at a site under a specific envelope -- and does not assert safety, correctness or downstream outcomes. Trust is split across site owner, TEE silicon vendor and issuer.

QUIC endpoints commonly use 1200-byte datagrams during the handshake and only start Path MTU Discovery afterward, so freshly established connections cannot immediately use larger datagrams -- especially limiting for MASQUE and WebTransport. This draft defines Parallel Probing DPLPMTUD (PPDPLPMTUD), which probes several packet sizes early during the QUIC handshake so a larger discovered size is usable in later handshake phases and after completion. The same discovery process is also reused for path migration.

Provides technical details of CVE-2026-33697 and EUVD-2026-16488 as evidence of how intra-handshake attestation fails in practice, even without physical access. It argues that because continuous attestation is typically required, performing attestation inside the handshake introduces unnecessary complexity for little benefit. The findings are supported by research artifacts using ProVerif (Apache-2.0) and have been acknowledged by relevant stakeholders. This is revision -06.

Defines a quantum network architecture built around a set of planes that provide different views of the network, supporting different responsibilities and modes of operation. It describes device, node and link types; several network topologies and deployment scenarios and their relationship to applications; and the key design decisions that follow from the corresponding requirements. The document gives a structural framework for reasoning about quantum networks rather than a wire protocol.

Defines two evidence structures for automated-data-access audit receipts. Transformation Evidence is a per-disclosure statement of which classes of values were transformed and how, carrying counts and class names but never the values themselves. Coverage Reconciliation compares a data source's own activity counters against a receipt set over a time window and classifies the outcome, distinguishing matched, observed-without-receipt, receipted-without-observation, excluded and indeterminate cases rather than reporting a bare pass/fail. Both are designed to be registered as SCITT Signed Statements. The document defines only the evidence payloads, not a new receipt, transparency or signature format.

Defines two evidence structures for automated-data-access audit receipts. Transformation Evidence is a per-disclosure statement of which classes of values were transformed and how, carrying counts and class names but never the values themselves. Coverage Reconciliation compares a data source's own activity counters against a receipt set over a time window and classifies the outcome, distinguishing matched, observed-without-receipt, receipted-without-observation, excluded and indeterminate cases rather than reporting a bare pass/fail. Both are designed to be registered as SCITT Signed Statements. The document defines only the evidence payloads, not a new receipt, transparency or signature format.

Describes the applicability of Bidirectional Forwarding Detection (BFD) for detecting MPLS Label Switched Path (LSP) data-plane failures, in relation to LSP Ping. LSP Ping can both detect data-plane failures and verify the LSP data plane against the control plane; BFD can do the former with much lower control-plane processing cost. A combination of LSP Ping and BFD gives faster failure detection and/or detection across many more LSPs. The document specifies procedures for using BFD in this environment and obsoletes RFC 5884 and RFC 7726.

Defines "action_ref", a deterministic, content-addressed identifier for autonomous-agent actions. Any party holding the four preimage fields (agent_id, action_type, scope, timestamp) can independently compute and verify the identifier without trusting the emitting system. The derivation uses RFC 8785 JSON Canonicalization with SHA-256. The document sets timestamp requirements, defines a canonical receipt envelope with optional fields for policy changes and revocations, describes scope conventions, and explains how the identifier composes with existing exactly-once execution systems.

Proposes a DID-based framework for service discovery, authentication and authorization of Model Context Protocol (MCP) agents, built on the W3C Decentralized Identifier standard. It uses did:web and did:key to give MCP Clients and Servers verifiable, decentralized identifiers, sets DID method selection criteria, extends DID Document specifications, and defines service discovery approaches (URL derivation, DNS-based discovery, directory-based capability queries) plus a challenge-response mutual authentication protocol. It outlines OAuth 2.0 compatibility and supports trust establishment, dynamic capability-based discovery and granular authorization with portable identities.

Notes that, absent out-of-band knowledge, QUIC endpoints have no information about their network situation -- neither their external IP address and port nor whether they are directly connected or behind a NAT. This QUIC extension lets nodes determine their reflexive IP address and port for any QUIC path, giving endpoints a native way to learn their observed address without relying on a separate protocol.

Defines metadata tags for describing aspects of Contra, Square and other traditional called folk dances. The tags are intended for archivists as well as for modern-day callers of traditional dances, giving a shared vocabulary for cataloguing and retrieving dance descriptions.

Profiles the enforcement of OASNT tokens at the point of execution. It defines the OASNT-Token HTTP field, the rules by which an enforcement point derives the observed request from the octets it will forward, a verification procedure for relying parties that hold no request-to-action mapping, uniform refusal behavior, and the required set of refusals. It adds an optional `grp` claim and an exclusivity ledger so a set of tokens issued from one human confirmation is spendable only once between them, and fixes which relying party performs that consumption. A conforming enforcement point makes human approval a precondition of execution without changing the protected service.

Defines the OASNT token, a compact JWS-based credential in which a hardware-bound device key attests that a specific human, on a device whose runtime integrity was assessed, authorized one specific action whose human-readable disclosure is cryptographically bound to the token (What You See Is What You Sign). Tokens are single-use, short-lived, and may additionally be bound to one concrete HTTP request. This is the base token definition that the companion oasnt-enforce profile builds on.

Defines an Entity Attestation Token (EAT) profile and a new EAT claim that convey the subject public key and its protection properties within attestation evidence. Combined with protocol-level proof of possession from the surrounding protocol, this establishes a cryptographic binding between a private key and an attested execution environment. It uses the EAT `cnf` claim for the subject public key and `eat_nonce` for freshness, with proof of possession from TLS certificate authentication or CSR signature verification. Because the EAT is signed by a hardware-backed Attestation Key, verifying both signatures binds the key to the attested platform state and addresses key-substitution attacks.

Defines requirements for establishing sessions between entities and for negotiating capabilities within such sessions. It assumes the entities already know of each other -- how they met is out of scope -- and that at least one party to a session is an agent as defined in the document. It is intended as a contribution to the agentproto working group's use cases, gap analysis and requirements deliverable, framing what a session-establishment and capability-negotiation mechanism must provide.

Addresses autonomous agents initiating payments on behalf of principals. Existing agent-payment mechanisms authenticate the human, the operator or possession of a key, but none establishes that the software authorized to spend is the software that was reviewed -- a compromised agent's key authenticates as well as an honest one's. This draft defines a payment authorization scope bound to a key whose protection properties are hardware-attested, registered as a SCITT Signed Statement. It reuses EAT confirmation and key-attributes claims and contributes the authorization scope, the executor's pre-settlement verification procedure, an auditable transparency record, and an execution-record mechanism for auditable aggregate accounting.

Profiles the IETF SCITT architecture for AI-agent action receipts: tamper-evident, signed, offline-verifiable records of what an autonomous agent was recorded as doing at the governed boundary, under which principal class, with what verdict, and (where recorded) under which policy identity. Each receipt is a signed record over canonical JSON, hash-chained to its predecessor, presented bare or in a COSE_Sign1, and carried as a SCITT Signed Statement so registration yields the Service's signed proof of logging. The claim is deliberately narrow -- an issuer-authenticated, tamper-evident record -- and explicitly does not assert that the agent was correct, safe, or that approval preceded execution.