Working protocol draft
BYOAg Protocol 0.1
BYOAg 0.1 defines how a person’s existing agent can discover, pair with, and enter a platform-controlled environment through explicit, scoped, revocable authority.
The protocol is being shaped through a working generic connector, schemas, security tests, and BYOAg Arena as the first reference platform. It is not a finalized standard, universal identity system, or production security guarantee.
Protocol map
Six areas, independently testable
Protocol objects, profiles, capabilities, and skill bundles evolve with independent Semantic Versions. The labels below describe the current 0.1 implementation boundary.
Implemented baseline
Discovery and pairing
Exact-domain discovery, signed platform metadata, one-time codes, pairwise keys, proof of possession, and optional first-party confirmation.
Implemented baseline
Registrations and engagements
A durable account-agent relationship containing multiple isolated, expiring platform contexts.
Draft; partial runtime
Permissions and capabilities
Platform-assigned roles, user-narrowed delegation, semantic capability contracts, effects, constraints, and confirmation rules.
Specified; not yet activated
MCP tools and declarative skills
Engagement-scoped tool mappings and signed, content-addressed skill bundles that contain no executable code.
Implemented baseline
Revocation and non-interference
Immediate server-side denial, scoped credential teardown, and preservation of all unrelated agent configuration.
Experimental profile
Security and conformance
Ed25519 signatures, JSON canonicalization, DPoP-bound credentials, model-isolated secrets, and observable black-box tests.
Layer 1
Portable compatibility bootstrap
A standard Agent Plugin packages the static BYOAg bootstrap skill and a single local MCP connector. Legacy clients can load it without knowing about a BYOAg-specific extension.
The connector mediates platform discovery and credentials; the package does not embed platform-specific accounts, roles, secrets, or executable remote skills.
Layer 2
Native ai.byoag extension
A proposed reverse-domain extension adds protected code entry, secure key storage, registration and engagement UI, signed dynamic-skill activation, data-label enforcement, and verified teardown.
Clients that ignore the extension still receive a truthful compatibility experience. Native behavior cannot redefine the portable core.
Current boundary
Implemented versus outstanding
Implemented and tested
- Agent Plugin 1.0.0 package with a static bootstrap skill and local MCP connector
- Signed, same-origin discovery from the exact platform domain
- DPoP-protected pairing with pairwise agent and installation identities
- Code-is-consent and platform-confirmation pairing modes
- Local registration listing and signed engagement retrieval
- Credential revocation, scoped disconnect, and protected one-time code references
- Loopback-only in-memory reference host and automated conformance suite
Still to be built or hardened
- Remote engagement MCP tool filtering and invocation
- Signed declarative skill retrieval, validation, and activation
- OS-backed credential vault and native protected-input surfaces
- Data-label propagation and cross-tool enforcement
- DPoP server nonces and safe retry semantics
- JWKS rotation, refresh-on-unknown-key, and emergency revocation tests
- BYOAg Arena connection-bay integration and an independent security review
Security profile
Established formats, experimental composition
The byoag-dpop+jws-0.1 profile uses Ed25519 keys, detached
EdDSA JWS signatures, RFC 8785 JSON canonicalization, RFC 7638 JWK thumbprints,
and RFC 9449 DPoP proofs.
The exact platform domain is the initial trust anchor. Pairing and registration credentials are bound to platform-specific installation keys, while every consequential action remains subject to platform-side authorization.
Machine contracts
Schemas and observable conformance
Draft JSON Schemas define discovery, pairing, delegation, engagement, permissions, capabilities, skill bundles, signing keys, and the native extension manifest. The tests exercise behavior rather than matching prose.
13 tests
The current connector, MCP, storage, cryptographic, and black-box protocol suite passes.
6 MCP tools
Discover, begin pairing, complete pairing, list registrations, list engagements, and disconnect.
2 sample engagements
The in-memory reference host proves that simultaneous contexts validate independently.
Counts describe the current 0.1 repository and will change as the experimental implementation evolves.