{"slug": "show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation", "title": "Show HN: Reproduce a cross-company AI agent handoff, including its revocation", "summary": "A new open-source harness from Ratify Protocol reproduces a cross-company AI agent handoff and its revocation, running offline with `npm run engagement` and verifying all claims. The harness uses Agent Relay's adapter and confinement, and all dependencies pin the v1.0.0-alpha.17 release of the Ratify Protocol SDKs. The evidence trail is synthetic and does not reflect the live sessions of 18 and 19 August 2026, which are published separately.", "body_md": "**Status:** the offline half runs end to end (`npm run engagement`\n\n, exit 0). This is the Ratify-Protocol-side reproduction harness and adversarial annex for the Phase 2 flagship. It orchestrates and publishes an engagement that runs on [Agent Relay](https://agentrelay.com)'s adapter + confinement; it does not reimplement them. The fully-enforced path-traversal and two-principal-isolation cases are enforced by Agent Relay's OS-level confinement adapter in the real engagement, not by this offline harness; they SKIP here.\n\n[Ratify](https://ratifyprotocol.com) is infrastructure here: it supplies the portable delegated-authority proof. Agent Relay coordinates the work and enforces the filesystem boundary.\n\n- The one-command reproduction of the engagement (\n`npm run engagement`\n\n), offline, exits non-zero if any published claim fails to re-verify. - The published evidence trail for that offline run: the delegation chain, every\n`ProofBundle`\n\n, the`VerificationReceipt`\n\nchain, and a verifier-signed head checkpoint committed under`evidence/`\n\n.\n\nEverything under `evidence/`\n\nis a **synthetic model** of the engagement, built so that someone with neither deployment can run it. Its identifiers are fixtures: `demo-cert-root`\n\n, a demo channel id, fixed timestamps. Nothing in here is a certificate that was issued during the live sessions of 18 and 19 August 2026.\n\nThat is deliberate. This repository answers \"does the mechanism behave as described\", offline and on any machine. It does not, on its own, evidence that a particular thing happened on a particular day.\n\nTwo consequences worth stating plainly:\n\n**The head checkpoint exists here and did not exist in the live run.** The offline model produces one, and`npm run checkpoint-test`\n\nexercises truncation detection against it. The live engagement produced no signed head. Do not read the checkpoint in`evidence/`\n\nas an artifact of those sessions.**The live run's certificates, receipts, deployment decisions and logs are published separately**, and are what to check if the question is what happened on those days rather than how the mechanism behaves.- The adversarial annex (\n`adversarial/`\n\n): runnable failing tests a skeptic can run.\n\n- Not the target repo. The delegation is bound to\n`/docs`\n\nof a separate public repo,`identities-ai/ratify-agent-relay-engagement`\n\n. - Not the adapter or confinement layer. Those are Agent Relay's (\n`@relayfile/local-mount`\n\n,`@relaycast/engine`\n\n, and their OS-enforced confinement adapter).\n\n```\nnpm ci\nnpm run engagement    # replays the engagement scenes (delegation, handoff, the federation beat, the work +\n                      # receipts, the kill switch), re-verifies every committed bundle + receipt offline,\n                      # runs the adversarial annex, prints: \"engagement: N/N verified, M/M refused\".\n                      # Never modifies evidence/, so a verification run leaves the clone clean.\nnpm run evidence      # same run, but regenerates evidence/ first (--write-evidence). Signature bytes\n                      # differ on every regeneration (hedged ML-DSA); commit the result deliberately.\nnpm run typecheck     # tsc --noEmit\n```\n\nOffline by default. No call to either company. A reader reproduces every claim with the open SDKs.\nAll dependencies pin the published `v1.0.0-alpha.17`\n\nrelease: npm `@identities-ai/ratify-protocol`\n\n, the Go module tag, crates.io `ratify-protocol`\n\n, and PyPI `ratify-protocol==1.0.0a17`\n\n.\n\nDeterminism: keys, IDs, scopes, constraints, challenges, timestamps and decisions are deterministic (fixed demo seeds + a fixed time base). The ML-DSA-65 half of each hybrid signature is *hedged* by the pinned `@noble/post-quantum`\n\n, so raw signature bytes differ between generations while every signature still verifies. See `VERIFY.md`\n\n.\n\nThe evidence trail is SDK-agnostic. Each published bundle/receipt can be re-verified with Go, TypeScript, Python, Rust, or C, and the first four run as committed against the published SDK releases. The C lane builds from a source checkout of the SDK. See `VERIFY.md`\n\nfor every command.\n\n**Runs now (offline, on** the full engagement harness, the evidence-trail format + replay, and adversarial cases for scope escalation, replay, expired, revoked, wrong-operation binding, and the federation same-id-wrong-authority refusal, each with a genuine negative control (resource_path, receipts, operation-context, and the deployment serve-authority policy are all in place). The federation case models the two-deployment scene: a grant naming the same channel id under a deployment authority the verifier does not serve is refused by deployment policy (reason`main`\n\n):`unserved_authority`\n\n), while the delegation itself stays cryptographically valid. Authority-to-act and resource-namespace are orthogonal; a verifier serves exactly its own deployment authority and refuses resources under any other.**Enforced by Agent Relay's runtime, not this offline harness:** the fully-enforced path-traversal and two-principal isolation cases run against Agent Relay's OS-level confinement adapter in the real engagement; they SKIP loudly here, never silently pass.\n\n`src/engagement.ts`\n\n: the engagement harness (delegation, handoff, federation, work + receipts, kill switch).`src/harness.ts`\n\n: shared offline/deterministic primitives (demo keys, chain builder, contexts, revocation provider).`adversarial/annex.ts`\n\n: the runnable failing tests + negative controls + case list.`scripts/verify-one.ts`\n\n: re-verify a single published claim from the committed bytes.`evidence/`\n\n: bundles, receipts, delegation chain, and`manifest.json`\n\n.`verify/`\n\n: the Go, Python, Rust, and C verifier lanes (see`VERIFY.md`\n\n).`docs-target/`\n\n: a mirror of the`/docs`\n\ncontent the agent works in (for local rehearsal before the engagement runs).\n\nThe engagement article links here when it publishes.", "url": "https://wpnews.pro/news/show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation", "canonical_source": "https://github.com/identities-ai/ratify-agent-relay-harness", "published_at": "2026-08-25 14:54:55+00:00", "updated_at": "2026-08-25 15:16:13.159643+00:00", "lang": "en", "topics": ["ai-agents", "ai-infrastructure", "ai-safety"], "entities": ["Ratify Protocol", "Agent Relay", "identities-ai/ratify-agent-relay-engagement", "@identities-ai/ratify-protocol", "@noble/post-quantum", "ML-DSA"], "alternates": {"html": "https://wpnews.pro/news/show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation", "markdown": "https://wpnews.pro/news/show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation.md", "text": "https://wpnews.pro/news/show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation.txt", "jsonld": "https://wpnews.pro/news/show-hn-reproduce-a-cross-company-ai-agent-handoff-including-its-revocation.jsonld"}}