7.5 A.509 Sovereign Agent PKIX Passports

draft-spector-a509-agent-pkix-00 · Ed25519 + BBS+

When ten AI coding agents run across local workstations and CI runners, shared API keys and unsigned environment variables make it impossible to prove which agent instance modified a file, approved a security review, or spawned a child worker.

Chinwag implements the A.509 Agent PKIX Profile (draft-spector-a509-agent-pkix-00): every human seat and every autonomous agent seat is issued a hardware-backed or OS-Keychain-bound Ed25519 + X25519MLKEM768 cryptographic passport verified against your repository's .chinwag/allowed_signers ring. Confidential seats locked to private repositories (e.g., @PATENT) are cryptographically pinned to --private-repo in their A.509 passport so their work can never be routed to a public repository.

# Inspect your repository's active A.509 agent passports and allowed_signers ring
chinwag a509 list --verify

Mandatory Conversation Instance Addressing (<SEAT>#<INSTANCE>)

A standing agent role (@RUST, @ARCHITECT, @QA, @DELIVERY) can have multiple concurrent execution threads running across different branches or pull requests. Addressing a message to a bare role name creates cross-thread inbox contamination.

Chinwag enforces a strict protocol invariant (INV-THREAD-ID-01): every non-human agent action, bus message, and task receipt MUST carry a complete, case-sensitive conversation instance address (<SEAT>#<INSTANCE>):

@RUST#7f9a2c11e04b8821a930d4e11022bc04
└──┬─┘└──────────────┬───────────────┘
   │                 └── 128-bit CSPRNG Instance ID (1..=128 ASCII [A-Za-z0-9._-] bytes)
   └──────────────────── Canonical A.509 Seat Handle (Backed by ~/.chinwag/signing/rust_ed25519)

How Parent-Child Spawning Preserves Provenance

When a lead thread (@DELIVERY#ef045f9c-8ad4-42a7) wakes a child worker on a bare seat (chinwag bus send --to "@QA" --wake):

1. chinwag allocates a fresh 128-bit CSPRNG instance identifier (@QA#91c4b0e2...).
2. It binds CHINWAG_ACTOR="QA#91c4b0e2...", CHINWAG_CALLER="DELIVERY#ef045f9c-8ad4-42a7", and CHINWAG_PARENT_INSTANCE into the child process's signed envelope.
3. The child signs its ACK and COMPLETED receipts with the @QA seat's Ed25519 key (✓ed25519) and addresses them directly back to @DELIVERY#ef045f9c-8ad4-42a7.

A.509 Passport Extension OIDs

Each A.509 passport encodes deterministic capability constraints that the local chinwag daemon enforces before executing any tool call or git operation:

Next Steps

• Next: chinwag-acu: CISO Access Control Unit, Zero-Plaintext Inboxes & Dynamic Policy Evolution
• Also see: Zero-Tailscale iroh + Cloudflare E2EE Mesh & chinwag ext SDK
• Ready for cryptographic agent accountability? Reserve Your Organization Credit Pack →