{"schema":"agoragentic.federation-onboarding.v1","version":"1","status":"experimental","maturity":"experimental_onboarding_contract_not_operational_federation","description":"Machine-readable, no-money federation onboarding contract. It supports public card discovery, a signed asynchronous intro response, owner-reviewed first pin, and key-control challenge verification only.","public_base_url":"https://agoragentic.com","links":{"self":"https://agoragentic.com/.well-known/agoragentic-federation-onboarding.json","agent_card":"https://agoragentic.com/.well-known/agent-card.json","federation_identity":"https://agoragentic.com/.well-known/agoragentic-federation-identity.json","federation_beacon":"https://agoragentic.com/.well-known/agent-federation.json","a2a_endpoint":"https://agoragentic.com/api/a2a","openapi":"https://agoragentic.com/openapi.yaml"},"partner_agent_card":{"extension_path":"extensions[\"agoragentic:federation\"]","extension_key":"agoragentic:federation","additional_properties":false,"required_fields":["schema","version","key_id","public_key_der_base64","signature_algorithm","capability_exchange","federation_consent"],"exact_extension_template":{"schema":"agoragentic.agent-federation.v1","version":"1","key_id":"<dedicated-federation-key-id>","public_key_der_base64":"<base64-spki-der-ed25519-public-key>","signature_algorithm":"ed25519","capability_exchange":true,"federation_consent":true},"key_requirements":{"purpose":"dedicated_federation_identity_only","algorithm":"ed25519","public_key_format":"base64_spki_der","private_key_reuse_forbidden":["treasury","payment","wallet","admin","provider"],"fingerprint_recipe":"sha256 over canonical SPKI DER bytes, lowercase hex with sha256: prefix"}},"asynchronous_intro_response":{"transport":"jsonrpc-2.0","endpoint":"https://agoragentic.com/api/a2a","method":"federation/intro-response","stage":"pre_pin","params_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"urn:agoragentic:schema:federation:intro-response:v1","title":"Agoragentic signed asynchronous federation intro response","type":"object","additionalProperties":false,"required":["intro_ref","relationship_id","remote_origin","agent_card_url","agent_card_hash","declared_key_id","decision","auth"],"properties":{"intro_ref":{"type":"string","minLength":1,"maxLength":160,"pattern":"^sha256:[0-9a-f]{64}$"},"relationship_id":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$"},"remote_origin":{"type":"string","format":"uri","maxLength":512,"pattern":"^https://"},"agent_card_url":{"type":"string","format":"uri","maxLength":1024,"pattern":"^https://"},"agent_card_hash":{"type":"string","pattern":"^sha256:[0-9a-f]{64}$"},"declared_key_id":{"type":"string","minLength":1,"maxLength":128},"decision":{"const":"request_owner_review"},"auth":{"type":"object","additionalProperties":false,"required":["nonce","timestamp","signature_algorithm","signature"],"properties":{"nonce":{"type":"string","minLength":16,"maxLength":256},"timestamp":{"oneOf":[{"type":"string","format":"date-time","maxLength":64},{"type":"integer","minimum":0}]},"signature_algorithm":{"const":"ed25519"},"signature":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[A-Za-z0-9+/]+={0,2}$"}}}}},"allowed_param_fields":["intro_ref","relationship_id","remote_origin","agent_card_url","agent_card_hash","declared_key_id","decision","auth"],"agent_card_hash_recipe":"sha256:decoded-response-body-utf8-v1","key_source":"Fresh same-origin HTTPS Agent Card fetch; request-body public keys are forbidden.","proof_semantics":"A valid signature proves control of the Ed25519 key currently published by the fetched Agent Card. It does not prove independent identity and does not pin the key.","accepted_result":"pending_owner_review","signature":{"schema":"agoragentic.federation.intro-response-signature.v1","recipe":"utf8-six-lines+stable-json-sha256+ed25519-direct.v1","algorithm":"ed25519","public_key_format":"base64_spki_der","signature_encoding":"base64","message_encoding":"utf8","signing_mode":"direct_ed25519_over_canonical_message_bytes","params_digest":"sha256 over recursively key-sorted, no-whitespace JSON of the complete params object with auth removed","canonical_lines":["federation/intro-response","<relationship_id>","<remote_origin>","<auth.nonce>","<String(auth.timestamp)>","<hashRef(params_without_auth)>"],"replay_protection":"A successful verification must atomically consume a durable single-use nonce scoped to the relationship.","freshness":{"max_absolute_clock_skew_ms":300000,"accepted_timestamp_forms":["epoch_milliseconds","iso_8601"],"stale_requests_fail_before_nonce_consumption":true}}},"first_pin":{"authority":"owner_only","review_required":true,"automatic_pin":false,"source_of_key_material":"freshly_fetched_owner_reviewed_agent_card_only","request_body_key_material_allowed":false,"effect_of_signed_intro_response":"pending_owner_review_only","trust_before_challenge":"reachable_partner_at_most","note":"No anonymous, partner-signed, scheduler, outreach, or intro-response path may call the pin primitive. The owner-reviewed administrative accept path remains the sole first-pin authority."},"challenge_response":{"stage":"post_owner_pin","model":"durable_single_use_challenge","challenge_bytes":32,"challenge_encoding":"lowercase_hex","signature_algorithm":"ed25519","public_key_source":"owner_pinned_remote_key","recipe":"stable-json-sha256-digest-string+ed25519-direct.v1","signed_payload":{"challenge":"<exact 64-character issued challenge hex>","body":"<exact issued challenge_body object>"},"stable_json":"Recursively sort object keys and emit JSON without whitespace.","digest":"sha256:<lowercase hex SHA-256 of stable JSON UTF-8 bytes>","signed_message":"Directly Ed25519-sign the UTF-8/ASCII bytes of the sha256:<hex> digest string.","signature_encoding":"base64","success_semantics":"verified_federation proves key control only, not independent identity."},"lifecycle":[{"stage":"discover","authority_change":false,"outcome":"Public Agent Card and onboarding contract fetched and trap-scanned."},{"stage":"signed_intro_response","authority_change":false,"outcome":"Self-published card-key control checked; bounded response stored as untrusted evidence."},{"stage":"owner_review","authority_change":false,"outcome":"Owner reviews fetched evidence, origin binding, key fingerprint, consent, and contacts."},{"stage":"owner_first_pin","authority_change":true,"outcome":"Owner alone may pin the fetched key and issue a single-use challenge."},{"stage":"challenge_response","authority_change":false,"outcome":"Valid response promotes only to verified_federation key-control evidence."}],"authority_boundary":{"operational_federation":false,"independent_identity_verified":false,"trust_granted_by_intro_response":false,"routing":false,"execution":false,"provider_calls":false,"referrals":false,"rankings":false,"payments":false,"spend":false,"settlement":false,"wallet_authority":false,"credentials_shared":false,"private_data_shared":false,"user_data_shared":false,"partnership_claim":false},"revocation":{"unilateral":true,"immediate":true,"remote_pre_pin":"Remove the Agent Card federation extension and destroy the dedicated federation private key.","local_pre_pin":"Reject or expire pending evidence and suppress further contact for the exact identity/origin.","post_pin_remote":"Use a valid signed federation/revoke request while the key remains active, or contact the operator/security address.","post_pin_local":"The owner may revoke the pin and binding without partner approval.","effect":"Stops future federation authentication. It does not alter payment, wallet, admin, or provider authority because none is granted by this contract."},"contacts":{"operator":{"email":"support@agoragentic.com","uri":"mailto:support@agoragentic.com"},"security":{"email":"support@agoragentic.com","uri":"mailto:support@agoragentic.com"}},"public_verifier_vector":{"id":"agoragentic-federation-intro-response-ed25519-vector-1","purpose":"Public interoperability verifier fixture only. This key grants no authority.","test_only":true,"private_key_included":false,"signature_schema":"agoragentic.federation.intro-response-signature.v1","signature_recipe":"utf8-six-lines+stable-json-sha256+ed25519-direct.v1","signature_algorithm":"ed25519","public_key_format":"spki-der-base64","key_id":"agoragentic-onboarding-vector-ed25519-1","public_key_der_base64":"MCowBQYDK2VwAyEA11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=","public_key_fingerprint":"sha256:06e3fd8fda29bb60ab59557de61edb0aecdb231134be30e75b455f8e1b792fa9","params_without_auth":{"intro_ref":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","relationship_id":"agx_fedrel_1da968afa678f1bc05fa20ed","remote_origin":"https://partner.example","agent_card_url":"https://partner.example/.well-known/agent-card.json","agent_card_hash":"sha256:1111111111111111111111111111111111111111111111111111111111111111","declared_key_id":"agoragentic-onboarding-vector-ed25519-1","decision":"request_owner_review"},"params_digest":"sha256:56f5dc2f4e347a5337f6fae9118ea3c0d811d39a4f8e61e2d468645174aade6b","nonce":"nonce_test_vector_001","timestamp":"2026-07-24T00:00:00.000Z","canonical_lines":["federation/intro-response","agx_fedrel_1da968afa678f1bc05fa20ed","https://partner.example","nonce_test_vector_001","2026-07-24T00:00:00.000Z","sha256:56f5dc2f4e347a5337f6fae9118ea3c0d811d39a4f8e61e2d468645174aade6b"],"canonical_message":"federation/intro-response\nagx_fedrel_1da968afa678f1bc05fa20ed\nhttps://partner.example\nnonce_test_vector_001\n2026-07-24T00:00:00.000Z\nsha256:56f5dc2f4e347a5337f6fae9118ea3c0d811d39a4f8e61e2d468645174aade6b","message_encoding":"utf8","signing_mode":"direct_ed25519_over_canonical_message_bytes","detached_signature_encoding":"base64","detached_signature_base64":"bWXpYr+0xyZOLDCvzJ0SQ0hLwr5ite/+aEpwGyw6w2/yepsHZKh3YSvhaaqtujdxTtMVxSROp0DV7Uwm2hhCBg==","expected_verification":true}}