AINRA — the neutral root of AI-agent identity

Live site: https://ainra.org/ · Source & releases: https://github.com/JacobJandon/ainra · Roadmap · Governance

Prove your agent. Check theirs. Both halves run locally — an agent presents signed facts, whoever receives them verifies on their own machine, and nothing reaches us in either direction.

AINRA does exactly four jobs — accredit · anchor · revoke · log — and nothing else. It answers the three questions every counterparty asks about an AI agent — who is behind it, what may it do, is it still trusted right now — with facts, never scores, never a price, never the decision itself. Doctrine: login is ours; the decision is the verifier's. Everything is built so a stranger can verify offline, in ~5 lines, with the root dark, trusting the source — not us.

No install at all? Two routes, differing in which verifier answers. examples/verify-in-browser/ is four static files running the JavaScript verifier — open it, change one byte of a signature, watch it refuse. the live site's Try it panel (make site SERVE=1 locally) runs ainra-core itself, the Rust verify path compiled to WebAssembly (make wasm), so the browser is checking with the same code the CLI does — and make wasm-diff pushes the whole corpus through that exact artifact in a headless browser, requiring agreement on verdict and named reason. Nothing is uploaded and no request leaves the page at verification time, either way.

Install the verifier — published with provenance you can check before you trust it:

npm i @ainra/sdk        # or: pip install ainra
npm audit signatures    # Sigstore provenance: proves which workflow built it

Or run it from this repo, no install:

make verify        # verify a valid + a revoked credential with the real verifier, offline. No account, no server, no config.
make issue-first   # boot a local registrar, issue your first passport, verify it — and keep the registrar for reuse.

Measured on a warm toolchain: make verify ≈ 1.7 s, make issue-first ≈ 2.2 s (both far under the 60 s / 5 min targets). From there: the cookbook · the MCP server (AINRA as native agent tools) · the registrar console (make registrar-console) · the examples · and skills.md — an agent onboards itself end to end from that one file. Every command prints honest labels (LOCAL TESTBED / STAGING · TEST-ROOT) and names the next step on failure.

This repository is the production-track reference implementation.

Everything a machine needs is in skills.md — an agent onboards itself end to end from that one file.

What remains to ship the prototype is not code — it is three real-world events (a recorded ceremony, ≥3 independent external verifiers, a 14-day/3-region revocation soak). The machinery to run those without us in the room is built and smoke-proven, and the genesis board shows exactly how far along we are, unfaked:

make genesis-status   # the honest §29 DoD board — a row is ✅ ONLY when a signature-checked artifact backs it

Today that board reads 7/12 — the 7 laptop-provable rows are green; the 5 external rows are ⏳ pending real people running the events (see outreach/, docs/DOD.md, GENESIS-CHECKLIST.md).

Nothing here is asserted; if it says green, a make target proves it. Logs sealed by the real root: 0 — the Genesis ceremony has not happened yet, and we say so.

make preflight        # from a cold clone: build+test, differential, genesis-local, all kit smokes, S7, license, repro

Expected — a stranger sees this board go all-green in one command:

AINRA preflight — clone-and-it-works board          (26 rows; a representative slice)
  [PASS] build + tests          release test suite
  [PASS] differential           4 impls agree over vectors
  [PASS] genesis-local          whole stack boots on 1 host
  [PASS] verifier kit           execution-bound attestation
  [PASS] ceremony dry-run       witness-reproducible
  [PASS] soak instrument        measured p95, signed report
  [PASS] witness quorum         fork refused over HTTP
  [PASS] compliance probe       honest passes, 4 dishonest caught
  [PASS] reason contract        docs name every reason impls return
  [PASS] browser verifier       the corpus agrees in-browser
  [PASS] status honesty         README == STATUS claim
  [PASS] doc freeze             normative docs unchanged
  [PASS] reproducibility        artifacts rebuild byte-exact
  ALL GREEN — a stranger can clone this repo and every gate passes.

make audit runs the publish gate (S7 + license headers + gitleaks over full history). make ci mirrors CI, which runs every gate on push (see .github/workflows/ci.yml).

Release-test trap: make test uses --release on purpose. A debug build stack-overflows one crypto-heavy test (large unoptimized ML-DSA/SLH-DSA stack frames) — not a bug; use make test / make preflight.

make drill            # witness QUORUM catches an injected fork (5 witnesses, k=3, refused 5/5)
make drill-networked  # the same quorum over HTTP — independently-operated witnesses (kits/witness)
make ceremony-dry-run # rehearse the 5-of-9 ceremony choreography; a witness recomputes the transcript hash
make soak-smoke       # measure revocation propagation (p50/95/99) into a signed, tamper-evident report
make repro            # rebuild every published artifact byte-for-byte from source (838 files)
make verify-mirror MIRROR=<dir>   # any third party byte-verifies a mirror, root dark
make probe-drill      # measure a registrar from OUTSIDE holding nothing it issued — and catch five dishonest ones
make miri             # undefined behaviour in the byte-handling code (needs nightly + miri)

Each kit is completable by an unattended stranger and self-verifying. Start with the kit's QUICKSTART/DEPLOY/RUNBOOK.

Collected evidence rolls up into one honest picture — make genesis-status. The materials for recruiting the people those three events need are in outreach/; the schedule for actually asking them — with two public kill-gates and every re-dating on the record — is campaign/ (make campaign-status).

The public front door lives in site/ — the landing (with the founding-table call to get involved), the Standard, verify and claim walkthroughs, foundations, and the honest status page. Plain HTML/CSS, no framework, no analytics (no CDN, no web fonts, no external scripts or images, zero telemetry — deliberate for a neutral root). Build + serve locally:

make site SERVE=1     # refreshes the derived downloads from canonical sources, serves at http://127.0.0.1:8088

Deploy: bash tools/export-site.sh (the owner's step) rebuilds site/ and pushes it to a separate static-site repository, which the host deploys to https://ainra.org/. Pushing this repository does not change the live site.

                      the STANDARD + CC0 conformance vectors (vectors/)  ── anyone builds against these
                                          │
  crates/ainra-core  ── the pure verify/issue library (N7: no I/O, no clock) ── the 10-step verify, 20 reasons
        │  hybrid Ed25519 + ML-DSA-65 (both-or-invalid) · RFC 6962 Merkle · Token Status List
        ▼
  crates/ainra-adapter ── the ONE place external bytes become core verify types, and the canonical verdict event.
        │  Pure, fail-closed. Every Rust consumer goes through it; `make one-decode-path` fails the build if a
        │  second parser appears anywhere else (L5).
        ├──▶ crates/ainra-wasm ── that same path compiled to WebAssembly for the browser. A thin binding: no
        │      parsing, no network, no clock. `make wasm-diff` = the full corpus, in a headless browser.
        ▼
  crates/ainra-ceremony (FROST 5-of-9 + SLH-DSA dual root, signing side, NEVER in verify)
  services/ainra-services (logd · statusd · witnessd + k-of-N quorum · registrar-box)
        │
        ▼
  packages/sdk-ts (@ainra/sdk — independent verify mirror #2 + the 5-line Verifier) · packages/middleware (the gate)
  apps/cli-node (P0 — differential impl #3)
        │
        ▼
  make genesis-local — the whole world on one laptop  ·  make repro / make verify-mirror — reproducible + mirrorable

The verify path is RFCs + FIPS + OSI-licensed deps only — no vendor, no bespoke crypto. Four independent implementations exist: ainra-core, the TypeScript SDK and the Python SDK give the same verdict and the same named reason on every one of the 1153 passport vectors (make diff), the Node CLI (P0) matches their canonical encoding byte for byte, and the same core compiled to WebAssembly agrees again in a browser.

Validity (ADR-017): the identity — the lineage and its AINRA Number — is permanent; the credential defaults to 366 days and renews invisibly (ACME-style at T−30 d, overlap issuance, a logged REISSUE whose prev_leaf makes renewals walkable through the log as one unbroken chain). Long credentials are safe here because revocation fails closed in under 60 seconds — short certificates are what you need when it doesn't. There is no grace period anywhere: expiry is expiry.

Nothing fake ever · no real company names (registrars registrar-NN, operators acme/globex/operator-NN; the S7 linter enforces it) · zero telemetry in shipped components (ainra-core makes no network calls; any traction metric is opt-in, count-only, in the kit layer only) · only audited crypto libraries · both signatures or invalid · logged-before-valid · fail closed everywhere.

• CONTRIBUTING.md — how to build, the gates your PR must pass, and the DCO sign-off (not a CLA).
• CODE_OF_CONDUCT.md — Contributor Covenant.
• SECURITY.md — how to report; our fail-closed posture; we adversarially review every milestone.
• Contact: info@ainra.org. For a security problem, use the private advisory in SECURITY.md instead.

Source code is dual-licensed Apache-2.0 OR MIT (LICENSE-APACHE, LICENSE-MIT). The conformance vectors and other CC0-marked data artifacts are public domain CC0 (LICENSE-CC0) — the shared test corpus is ownable by no one. Every third-party dependency + its license is inventoried in THIRD-PARTY.md: all OSI-permissive, no forced copyleft, verify path = RFC/FIPS + OSI only.