AEGIS Protocol

Reference implementation of the AEGIS v1 portable evidence and public-acceptance interfaces.

AEGIS connects six controlled interfaces: capture (ARC1), portable commitment (ARC2), outside verification (ARC3), independent evidence custody (ARC4), auditor-owned procedure and report (ARC5), and competent-forum judgment (ARC6). This repository implements the v1 ARC2--ARC3 profile and includes illustrative capture adapters. The independent audit repository retains the received bundle, scope, identity, custody history, procedures, exceptions and auditor report.

Paper: Alex Chengyu Li, AEGIS: A Portable Evidence Interface Between AI-Agent Logging Duties and Independent Audit (2026). Stable archival record · SSRN.

Quick start

Node.js 20+ uses built-in cryptographic APIs. The Python verifier uses Python 3.10+ with the dependencies in replication/requirements.txt.

python -m pip install -r replication/requirements.txt
npm run test:all
node examples/demo.js
node src/verify.js examples/bundle.json --public-key examples/demo-public-key.pem
python replication/python_verifier.py examples/bundle.json --public-key examples/demo-public-key.pem

The demo generates an ephemeral signing key, writes a demonstration bundle and its public key, and retains no private key. In an audit deployment, the --public-key file comes from the independently authenticated key-discovery process. The key inside the bundle is checked against that external key.

The v1 interface

The specification fixes the admitted input domain, frame bytes, certificate fields and acceptance rule.

Object	Contents
Chain	Chain and agent identifiers, creation time, genesis commitment, ordered events
Event	Sequence number, event type, timestamp, payload hash, predecessor hash, event hash
Certificate	Version, identifiers, times, genesis, event count, head hash, permitted extension metadata
Bundle	Exactly chain, certificate, signature, public_key
Verification receipt	Profile and verifier version, received-file digest, V1--V4 checks, decision and errors

Genesis and event hashes use SHA-256 over AEGIS-FRAME-v1 domain-separated, named, length-prefixed fields. An Ed25519 signature covers the UTF-8 JCS bytes of the complete certificate. The verifier checks every chain link, the external public key, the signature, and all six chain-derived certificate bindings.

The v1 JSON domain admits ASCII object keys, well-formed Unicode string values, booleans, null, dense arrays, objects, safe integers and finite fixed-decimal numbers. Invalid Unicode, duplicate keys, undefined values, unsafe integers and exponent-form numbers are rejected. Python uses RFC 8785 serialization for the same admitted values, including decimals such as 0.000001.

Architecture and profiles

The implementation labels L1 (adapters), L2 (sequence commitment), and L3 (certificate/verification paths) describe code roles inside ARC1--ARC3. ARC4 custody, ARC5 audit procedure and report ownership, and ARC6 forum judgment retain their separate architectural roles.

Cryptographic algorithms, authenticated data structures, encodings and anchoring mechanisms are replaceable profile choices. A conforming alternative publishes its own unambiguous byte and acceptance contract while preserving the ARC1--ARC6 interfaces and control allocation. src/crypto.js and src/extensions.js expose the corresponding extension points.

The bundled timestamp, blockchain, TEE and ZKP classes are interface simulations; deployment profiles supply actual services, trust material and verification rules. CRYSTALS_Dilithium_JCS is an explicitly labelled Ed25519 migration stub, not a post-quantum provider. Full architectural deployments add platform mediation and reconciliation, independent custody, an appointed auditor and the forum handoff around the evidence interface.

Checks and replication

npm test
python -m unittest replication/test_python_verifier.py

Checks cover frame boundaries, Unicode rejection, duplicate-key parsing, canonical decimals, signature and cross-object binding, event mutations, key mismatch, and cross-language canonical bytes. The current positive bundles are experiments/s1-bundle.json and experiments/s4-bundle.json.

The older benchmark scripts in replication/ preserve a historical encoding snapshot; their README identifies that scope. experiments/run-experiments.js is an optional local benchmark, while experiments/published-run-summary.json preserves the earlier reported measurements. Benchmark output is separate from the v1 conformance definition.

API

• canonicalize(value): strict v1 JCS text.
• parseJson(text): strict v1 JSON parsing, including duplicate-key and numeric-token checks.
• new Chain(chainId, agentId): initialize a chain; append(type, payload, timestamp?) commits a payload, and appendPayloadHash(...) consumes an adapter's existing digest.
• verifyChain(chain): recompute the genesis and event chain and check sequence/timestamp/predecessor invariants.
• issueCertificate(chain, privateKey, metadata?): sign the verified sequence and permitted certificate metadata.
• verifyCertificate(certificate, signature, publicKey): verify the certificate signature.
• verifyBundle(path, authenticatedPublicKeyPem): apply the full v1 acceptance rule and return the verification receipt.

The current package version is 0.2.2; the wire-profile identifier is AEGIS-v1, with certificate version equal to 1.0. Earlier package 0.1.0 used a different unframed encoding. Its historical records remain in Git history; v1 conformance follows the specification and current acceptance rule.

Citation

@misc{li2026aegis,
  title = {AEGIS: A Portable Evidence Interface Between AI-Agent Logging Duties and Independent Audit},
  author = {Li, Alex Chengyu},
  year = {2026},
  doi = {10.5281/zenodo.18955102}
}

License

Apache-2.0. See LICENSE.