# Agent Blueprint Protocol v0.1.1 - Table of Contents

> Portable, non-authorizing agent blueprint and deployment manifest protocol.

## Pages

- [Agent Blueprint Protocol](readme.md)
- [Changelog](changelog.md)
- [Agent Blueprint Protocol — normative protocol document](protocol.md)
- [Federation profile — the A2A / MCP Tasks field mapping](federation-mapping.md)
- [ADR: compiled-in extension registry](compiled-registry.md)
- [ADR: deny-default protected-bound clamps](deny-default-clamps.md)
- [ADR: detached JWS signature envelope](detached-jws-envelope.md)
- [ADR: federation lanes — A2A primary, MCP draft-tracking](federation-lanes.md)
- [ADR: no version tokens in identifiers](no-versioning-rule.md)
- [ADR: the non-authorizing boundary](non-authorizing-boundary.md)
- [ADR: two-consumer rule amendment](two-consumer-amendment.md)
- [LICENSE](license.md)
- [NOTICE](notice.md)
- [Security policy](security.md)
- [Agent Blueprint Protocol usage rules](usage-rules.md)

## Modules

- [AgentBlueprintProtocol](AgentBlueprintProtocol.md): Portable, non-authorizing contracts for agent blueprints and their
environment-local deployment manifests.
- [AgentBlueprintProtocol.Base64Url](AgentBlueprintProtocol.Base64Url.md): Strict unpadded base64url codec: the RFC 4648 §5 URL-safe alphabet with
all trailing `=` omitted (RFC 7515 §2 permits omission on the wire; this
protocol's wire form never carries padding, so padded input rejects).
- [AgentBlueprintProtocol.Blueprint](AgentBlueprintProtocol.Blueprint.md): The Blueprint artifact (base §6): an immutable, portable, inert statement
of intent, decoded and validated through the ONE generic field-registry
engine (`AgentBlueprintProtocol.Registry`) parameterized by this module's
18-member table.
- [AgentBlueprintProtocol.Bounds](AgentBlueprintProtocol.Bounds.md): Parse ceilings for the bounded JSON decoder — resource-exhaustion guards,
distinct from the eight operational ceilings an artifact declares.
- [AgentBlueprintProtocol.BoundsAlgebra](AgentBlueprintProtocol.BoundsAlgebra.md): The bounds algebra: the pointwise narrowest intersection of the
Blueprint's declared bounds, the Deployment Manifest's `host_bounds`, and
the host's live policy, over the closed 13-bound vocabulary.
- [AgentBlueprintProtocol.BoundsAlgebra.Bound](AgentBlueprintProtocol.BoundsAlgebra.Bound.md): One named bound: `name` from the closed 13, `class` (`:operational` /
`:protected`), `unit` (`:count | :millisecond | :token | :money |
:ordinal`), and the family's value shape.
A bound is data about limits and carries no authority.

- [AgentBlueprintProtocol.BoundsAlgebra.BoundSet](AgentBlueprintProtocol.BoundsAlgebra.BoundSet.md): A (possibly partial) set of the closed 13. Construction validates every
PRESENT name and value (`:bound_unknown` / `:bound_value_invalid`);
totality — all thirteen present — is demanded of all three sources at
`intersect/1` time, never defaulted, because an implicit default is the
silent-widening hole.
A bound set is data about limits and carries no authority.

- [AgentBlueprintProtocol.BoundsAlgebra.ClampEvidence](AgentBlueprintProtocol.BoundsAlgebra.ClampEvidence.md): The typed evidence of one permitted narrowing (base §Evolution
`:155-156`): the field, its class and unit, the requested and effective
values, the source that produced the effective value (a Deployment or
host term, never a tenant or principal), and whether the host
acknowledged a protected clamp.
Clamp evidence is a record of narrowing, not a decision.

- [AgentBlueprintProtocol.BoundsAlgebra.Result](AgentBlueprintProtocol.BoundsAlgebra.Result.md): The effective set plus the clamp evidence list (name-sorted). The
result records what the bounds imply; it is not a decision.

- [AgentBlueprintProtocol.BoundsAlgebra.Sources](AgentBlueprintProtocol.BoundsAlgebra.Sources.md): The three intersection sources plus the protected-clamp posture
(default `:deny`). Intersection inputs are host-supplied facts that
carry no authority.

- [AgentBlueprintProtocol.Canonicalization](AgentBlueprintProtocol.Canonicalization.md): RFC 8785 JSON Canonicalization Scheme over the closed tagged algebra
produced by `AgentBlueprintProtocol.Json`.
- [AgentBlueprintProtocol.Compatibility](AgentBlueprintProtocol.Compatibility.md): The compatibility surface : identity-exact or
error. A manifest identity — one `build_identities` member entry — is
matched only by an observed identity carrying the EXACT
`(kind, name, version, digest)` tuple. Version ranges deny
`:compatibility_identity_inexact` on BOTH sides (a range is malformed,
never silently unmatchable — the manifest side is decode-checked through
the registry table; `verify/2` re-asserts it for struct-bypassed inputs,
the structural-bypass rim lesson, and checks the host-built observed side, which
never passes a decoder).
- [AgentBlueprintProtocol.Compatibility.Observed](AgentBlueprintProtocol.Compatibility.Observed.md): The host's observed build identities: what the environment actually
resolved. Host-built (never decoded), so `verify/2` type-checks the
list itself.
Observed identities are host-supplied facts that carry no authority.

- [AgentBlueprintProtocol.Conformance.Cli](AgentBlueprintProtocol.Conformance.Cli.md): The conformance CLI : `--corpus <dir>` is REQUIRED
— no default, so a vacuous run is impossible — and the exit status is the
agreement verdict
- [AgentBlueprintProtocol.Conformance.Cli.Main](AgentBlueprintProtocol.Conformance.Cli.Main.md): The escript entry: the one place the package halts the VM. Delegates to
`AgentBlueprintProtocol.Conformance.Cli.run/1` for everything else — argv
parsing, corpus loading, execution, and the report are all tested pure
surfaces there.
The escript entry reports conformance facts; it never authorizes anything.

- [AgentBlueprintProtocol.Conformance.Corpus](AgentBlueprintProtocol.Conformance.Corpus.md): The pure conformance-corpus loader and integrity verifier:
`load/1` takes `%{path => binary}` and performs no I/O — only
the CLI touches the filesystem.
- [AgentBlueprintProtocol.Conformance.Report](AgentBlueprintProtocol.Conformance.Report.md): The pure report builder over a loaded corpus and runner results: overall
agreement, exit status, counts.
- [AgentBlueprintProtocol.Conformance.Runner](AgentBlueprintProtocol.Conformance.Runner.md): The pure case executor over a loaded corpus: dispatches each
case against the package's PUBLIC module surface — the runner adds no
protocol capability of its own — and compares the result to the case's
expectation.
- [AgentBlueprintProtocol.Deployment](AgentBlueprintProtocol.Deployment.md): The Deployment Manifest artifact (base §7, re-derived 2026-08-22): binds
exactly ONE Blueprint release digest to one local environment — portable
as a shape, resolved values local. Decoded and validated through the ONE
generic field-registry engine (`AgentBlueprintProtocol.Registry`)
parameterized by this module's 19-member table : the table, the
scan's open regions, and the digest domain are the only deltas from the
Blueprint pipeline.
- [AgentBlueprintProtocol.Deployment.Observations](AgentBlueprintProtocol.Deployment.Observations.md): The host-supplied inputs to `verify_binding/3`'s observation-gated
stages: the host clock, the host's maximum tolerable attestation age,
and the currently OBSERVED descriptor digests by logical operation.
Absent inputs skip exactly their stages — see `Deployment`'s moduledoc.
Observed facts are host-supplied records that carry no authority.
Observed facts are host-supplied records that carry no authority.

- [AgentBlueprintProtocol.Digest](AgentBlueprintProtocol.Digest.md): Tagged content digests over RFC 8785 canonical bytes.
- [AgentBlueprintProtocol.Error](AgentBlueprintProtocol.Error.md): The typed failure record: `code` + `subject` + optional
`detail`. This is the failure shape of the bounds-algebra surface; the
decode surfaces still return bare reason atoms and migrate here with the
composed import (a recorded contract delta).
- [AgentBlueprintProtocol.Evidence](AgentBlueprintProtocol.Evidence.md): The evidence record : the non-authorizing result of
a verification pass — per-surface checks, effective bounds, clamp
evidence, and extension facts.
- [AgentBlueprintProtocol.Extension](AgentBlueprintProtocol.Extension.md): The positional extension envelope shared by BOTH artifact tables:
`{"critical": {namespace → payload}, "optional": {namespace → payload}}`,
digest-covered, with namespace form and total cardinality. Extracted from
Blueprint so the Deployment table carries the same judgment as
DATA instead of a copy of it — one envelope, one definition, two tables.
- [AgentBlueprintProtocol.ExtensionRegistry](AgentBlueprintProtocol.ExtensionRegistry.md): The COMPILED-IN extension registry: entries are module-attribute
data, so registry content is a code release — drift is unrepresentable and
a beam-census architecture gate asserts nothing reads a registry file at
runtime.
- [AgentBlueprintProtocol.Federation](AgentBlueprintProtocol.Federation.md): The federation profile: the 23-member TaskEnvelope, the
lossy-aware A2A/MCP state codecs, and the carrier placement laws — the
executable half of the field-by-field mapping published as
`federation_mapping/0` data.
- [AgentBlueprintProtocol.Federation.Context](AgentBlueprintProtocol.Federation.Context.md): The receiving context `verify_commitment/2` compares a receipt
against: trusted keys, the issuer/subject/audience pins (each `nil` =
the receiver does not pin that member), and the previously-verified
terminal facts for conflict detection.
- [AgentBlueprintProtocol.Federation.Mapping.Row](AgentBlueprintProtocol.Federation.Mapping.Row.md): One row of the published field-by-field mapping: the logical field
(bijective with an envelope wire member), the A2A location, the MCP
Tasks location, and the verdict (`:native` | `:partial` |
`:extension`) re-derived against the pinned live sources.
A mapping row is published data that carries no authority.
A mapping row is published data that carries no authority.

- [AgentBlueprintProtocol.Json](AgentBlueprintProtocol.Json.md): Bounded JSON decoder over Erlang/OTP's `:json.decode/3` custom-decoder hook.
- [AgentBlueprintProtocol.Negotiation](AgentBlueprintProtocol.Negotiation.md): Negotiation: the evolution gate an importing host runs
after canonical verification, before any semantic read. In a standalone
pass it runs immediately after canonical verification; in the composed
import (`Reconcile.reconcile/3`) the pinned stage order is
`canonical → digest → negotiation → structure → portability →
signatures → bind → bounds` — the digest stage runs BEFORE negotiation
(the supersession of the "integrity last" ordering).
- [AgentBlueprintProtocol.Negotiation.Outcome](AgentBlueprintProtocol.Negotiation.Outcome.md): The negotiation result: the exact artifact revision, the honored
required-core-field list, the supported critical / retained optional /
quarantined namespaces, and typed notices (reason atoms — the typed
Error notices are the Evidence surface).
The outcome lists facts about revisions and extensions — it is not a decision.
The outcome lists facts about revisions and extensions — it is not a decision.

- [AgentBlueprintProtocol.Negotiation.Support](AgentBlueprintProtocol.Negotiation.Support.md): The consumer's negotiation posture: the revision SET it supports, the
core fields it implements, an optional HOST-PINNED registry view
(`%{namespace => ExtensionRegistry.t()}` layered over the compiled
registry — hosts may supply lifecycle states, never remove compiled
entries), and the host-supplied schemas for critical namespaces
(`%{namespace => schema_document}`).
A support posture is a consumer's declaration that carries no authority.
A support posture is a consumer's declaration that carries no authority.

- [AgentBlueprintProtocol.Portability](AgentBlueprintProtocol.Portability.md): The never-portable structural guard: member-name and
value-shape denylists over tagged values.
- [AgentBlueprintProtocol.Predicate](AgentBlueprintProtocol.Predicate.md): The closed, portable boolean predicate algebra carried by
`deterministic_predicate` evaluation assertions (base §6.6).
- [AgentBlueprintProtocol.Reconcile](AgentBlueprintProtocol.Reconcile.md): The one call per import : the composed
non-authorizing pass over a Blueprint + Deployment pair under host
inputs. Stage order is PINNED — canonical → digest → negotiation →
structure → portability → signatures → bind → bounds — each stage
reject-or-annotate, never repair, the earliest defect reported.
- [AgentBlueprintProtocol.Reconcile.Inputs](AgentBlueprintProtocol.Reconcile.Inputs.md): The host inputs reconcile needs: host policy bounds, negotiation
support, trusted public keys, the protected-clamp posture, and the
bind-time observations (host clock, max attestation age, observed
descriptor digests — the binding-surface delta
kept for parity). Observed BUILD IDENTITIES are deliberately
NOT an input: the pinned eight-stage order has no
compatibility stage, so carrying the field would manufacture false
assurance — hosts call `verify_compatibility/2` for that surface (a
recorded contract delta: its descriptive Inputs list names observed
identities).
Reconcile inputs are caller-supplied facts that carry no authority.

- [AgentBlueprintProtocol.Registry](AgentBlueprintProtocol.Registry.md): The generic field-registry decode/validate engine: ONE
table-driven walk, parameterized by the registry table an artifact layer
supplies — `Blueprint` today, `Deployment` next. The engine knows tables,
not domains: every domain judgment (bounded schemas, signature envelopes,
predicates, extension forms, cross-field rules) arrives as data — checker
functions carried in the table and defined in the owning artifact module —
so the dependency direction is always artifact → engine.
- [AgentBlueprintProtocol.Schema](AgentBlueprintProtocol.Schema.md): Bounded JSON Schema 2020-12 dialect + instance validator.
- [AgentBlueprintProtocol.Signature](AgentBlueprintProtocol.Signature.md): Detached JWS signature envelope: RFC 7515 compact serialization with the
RFC 7797 `b64=false` unencoded, detached payload, Ed25519 signatures
verified through `:crypto`. **Verify-only** — the package never signs,
never accepts a private key on any function, and performs no key
discovery or trust selection; hosts supply the trusted keys.
- [AgentBlueprintProtocol.Signature.Attributes](AgentBlueprintProtocol.Signature.Attributes.md): The validated signed attributes of a signature entry, with
`content_digest` parsed to a `Digest` value and `purpose` the closed
purpose atom.
Signed attributes are signature evidence that carries no authority.

- [AgentBlueprintProtocol.Signature.PublicKey](AgentBlueprintProtocol.Signature.PublicKey.md): A host-supplied Ed25519 public key, matched by the producer-chosen
`key_id`. The package performs no discovery or trust selection.
A public key is verification input that carries no authority.