Specification Overview¶
This page is a map of the specification, the formal rulebook that anyone building or checking Agent Manifests follows. Read it if you are writing your own implementation, auditing one, or want to know where a rule lives; if you only want to try the tool, start with Getting started instead.
The Agent Manifest Specification v0.2 is a formal RFC 2119 document (its rules use the standard words MUST, SHOULD and MAY with fixed meanings) defining a verifiable declaration of an AI agent's deployment content: a signed list of what the agent was approved to run with.
TL;DR
The spec has 10 sections covering the problem statement, data model for all 10 artifact bindings, Ed25519 and post-quantum cryptographic protocols, the verification protocol, integration with AGT and cMCP, the threat model, conformance Levels 0 to 3, and regulatory mapping. The generated test inventory records the collected reference cases.
Full specification: spec/agent-manifest-spec-v0.2.md (1,500+ lines)
In progress for v0.2: spec/agent-manifest-cose-envelope-v0.2.md specifies the COSE_Sign1 signature envelope that replaces the v0.1 canonical-JSON detached signature, aligning with RFC 9943 (SCITT). It is gated on the manifest version field, so v0.1 manifests keep verifying unchanged. See ADR-0011 for why.
Structure¶
| Section | Content |
|---|---|
| 1 - Problem Statement | The agent attestation gap; why software attestation is insufficient |
| 2 - Overview | Design principles, manifest lifecycle, canonical serialization, version negotiation |
| 3 - Data Model | All 10 artifact bindings, attestation, delegation chain, HITL records, signature, revocation |
| 4 - Cryptographic Protocols | Standard (Ed25519) and post-quantum (ML-DSA-65) profiles, Merkle tree construction |
| 5 - Verification Protocol | HTTP endpoint, result schema, evidence pack, revocation protocol |
| 6 - Integration Architecture | AGT, cMCP, and MCP integration with field cross-checks |
| 7 - Threat Model | 10 threat classes addressed; explicit out-of-scope threats |
| 8 - Conformance | Levels 0 to 3; reference conformance modules and generated inventory |
| 9 - Regulatory Mapping | EU AI Act, DORA, GDPR, HIPAA, PCI-DSS, FedRAMP |
| 10 - Roadmap | v0.2 targets, v1.0 CoSAI WS4 contribution |
Conformance test modules¶
| Module | Coverage |
|---|---|
| AM-BIND | Artifact binding correctness, hash computation, Merkle trees |
| AM-CRYPTO | Signature generation and verification, RFC 8785 canonicalization |
| AM-ATTEST | TEE attestation binding, field cross-checks, per-platform formats |
| AM-VERIFY | Verification endpoint, mismatch detection, delegation, revocation |
| AM-COMPAT | AGT integration, cMCP integration, MCP protocol extension |
Collected case totals and per-module counts, including parametrization, are maintained only in the generated inventory. See Running and citing the reference tests and the generated node-ID inventory. Collection is separate from passed/skipped results and level-specific coverage.
Key normative references¶
| RFC / Standard | Use in spec |
|---|---|
| RFC 8785 - JCS | All canonical JSON serialization |
| RFC 8032 - EdDSA | Ed25519 signature scheme |
| RFC 9162 - CT v2 | Merkle tree construction with domain separation |
| RFC 9334 - RATS | Remote attestation architecture |
| RFC 9562 - UUID v7 | Manifest and hop identifiers |
| NIST FIPS 204 - ML-DSA | Post-quantum signature scheme |
| Sigstore / Rekor | Transparency log integration |