Soma – memory and proofs for AI agents, measured not asserted Soma released an open protocol, reference implementation and conformance suite that let AI agents exchange signed envelopes carrying a goal, task, hard token budget, mandate, price in USDC and deadline, with Ed25519 signatures verifiable offline. The project ships a Python package with an HTTP transport (stdlib only), an MCP adapter exposing soma_send, soma_inbox, soma_claim, soma_complete, soma_route, soma_verify and soma_stats, three memory tiers (hot queue, warm facts in SQLite with FTS5, cold artifacts by hash), usage metering across tokens, CPU, bytes, writes and external calls, and an x402-compatible payment contract. Soma positions the conformance suite as the core deliverable, runnable against any MCP endpoint via tools/check_conformance.py, so independent implementations can prove they enforce hard budgets, rule-named refusals and TTL expiry. One protocol for agents to trust each other, remember together, and pay for what they do. Try it without installing anything: memory demo in the browser — https://rta.lat/hub/demo/recall?q=pricing https://rta.lat/hub/demo/recall?q=pricing · storefront and pricing — https://rta.lat/hub https://rta.lat/hub · public MCP node, no token — https://rta.lat/soma/mcp https://rta.lat/soma/mcp A message between agents is an envelope , not a chat line. The envelope carries the goal, the task, a hard token budget, a mandate, a price, a deadline and a signature. Memory, transport, money and history are just carriers of that envelope. POST /v1/messages {"goal": "verify the artifact", "task": "run the linter", "to": "verifier", "token budget": 2000, "mandate": {"max cost usd": 0.5}, "price usdc": 0.005} - Budget travels with the message. The receiver knows the limit before it starts. - Refusals come with a reason. Every decline names the rule that fired. - Degradation is declared. If context did not fit, the report says what was dropped. - Signatures verify offline. Ed25519, public key included — no service, no secret. Try it in the browser: https://rta.lat/hub/verify https://rta.lat/hub/verify tamper a field and watch it fail . - Cost is measured, not listed. Tokens, CPU, bytes, writes, external calls. pip install -e ". dev " soma keygen ключ подписи Ed25519 soma serve хаб на http://127.0.0.1:8765 soma send --to research --goal "find the market" --task "scan 3 sources" --budget 2000 soma inbox --agent research Or in Python: python from soma import Envelope, Hub hub = Hub env = Envelope goal="verify the artifact", task="run the linter", to="verifier", token budget=2000 hub.send env подписан и поставлен в очередь hub.inbox "verifier" что ждёт агента hub.claim env.id, "verifier" забрать атомарно hub.complete env.id, {"text": "ok"} Agents already work. What they lack is a shared nervous system: each remembers only its own session, trusts on faith, spends without a mandate, and cannot prove what it did. Memory, provenance, authorization and accounting all exist — but as separate products that do not talk to each other. Soma is the glue. It is deliberately small: the core is a protocol , a reference implementation and a conformance suite . Not a platform, not a framework, not a vendor. | Piece | What it is | |---|---| | src/soma/envelope.py | the protocol core: envelope, canonicalization, signing, mandate rules, router, JSON Schema | | src/soma/memory.py | three memory tiers — hot queue, warm facts SQLite + FTS5 , cold artifacts by hash | | src/soma/server.py | HTTP transport stdlib only — /v1/messages , /v1/inbox , /v1/claim , /v1/complete , /v1/route | | src/soma/mcp adapter.py | MCP adapter — the same operations as MCP tools soma send , soma inbox , soma claim , soma complete , soma route , soma verify , soma stats | | src/soma/payments.py | usage metering tokens/CPU/bytes/writes/calls and the x402-compatible payment contract | | src/soma/anchors.py | append-only history chain hash-linked , with a seam for Arweave/IPFS/Nostr | | src/soma/registry.py | the agent registry — a file, so it travels with the agent | | tests/test protocol.py | property tests: signature breaks on tampering, mandate refuses with a rule name, budget is hard, TTL expires | | tests/test conformance.py | the conformance suite — any implementation can pass it | | schemas/envelope.schema.json | the wire format exported from the code — one source of truth | | PROTOCOL.md | the specification | The conformance suite is the point of this project. Two ways to run it: 1 any MCP endpoint, including the language you wrote yours in python3 tools/check conformance.py https://rta.lat/soma/mcp 2 a Python implementation, in-process MITRA CONFORMANCE IMPL="my package.hub:MyHubFactory" pytest tests/test conformance.py -v A public demo node runs at https://rta.lat/soma/mcp https://rta.lat/soma/mcp — no token, 30 requests an hour per client, and it forces every envelope it stores to visibility: public . Nothing private lives there. Step-by-step walkthrough: docs/IMPLEMENT.md https://github.com/mrpkk/soma-protocol/blob/main/docs/IMPLEMENT.md . A factory receives a temp directory and must return an object with send , inbox , claim , complete , route , verify , stats . Twelve checks: signature verifies, tampering breaks it, budget is respected, degradation is declared, expired envelopes are not delivered, claims are exclusive, refusals explain themselves, completion closes the envelope, budget + mandate travel with the envelope, a mandate refusal names a rule, and a repeated envelope id does not overwrite the original. Soma does not replace any of these — it carries envelopes between them: - MCP — an adapter exposes the same operations as MCP tools. - A2A — agents.json in this repo is an A2A Agent Card; envelopes map onto A2A tasks. - x402 — the payment header contract is defined in src/soma/payments.py . - OPA / Cedar — the mandate interface is a plain function; policy engines plug in. - Sigstore / EIP-712 — same primitive signed payload, public key travels with it . - Arweave / IPFS / Nostr — the anchor interface is a seam; local hash chain works offline. This is the whole point of the split, so it is written down plainly. | Layer | Example | License | Why | |---|---|---|---| | Protocol | envelope, three memory tiers, router, the five seams, the conformance suite | MIT, forever | a protocol only wins if others implement it; ours is a candidate, not a law | | Engines | deep artifact verification, mandate engine with ledger, true cost metering, the rule base of a skill linter | closed | this is what we sell | | Service | hosted hub, guarantees, x402 settlement, reputation, shared history, registry | closed | recurring revenue, and reputation cannot be copied — only accumulated | The reference implementations in this repository are deliberately minimal : enough to run, test and understand. They are not the engines. Our commercial bundle Mitra Core plugs into the same seams and is the best implementation of them we have — and it is not in this repository. If you are reading this to decide whether to build on Soma: yes, build on it. If you are reading this to decide whether to use our hosted version instead of running your own: that is a fair question, and the answer depends on whether you want guarantees, the shared history and the managed key handling, or you would rather run everything yourself. The five seams are protocols soma/interfaces.py : Signer , MandateEvaluator , MemoryTier , Meter , Anchor . A plugin is any object that satisfies them. python my engine.py from soma.envelope import Mandate class StrictMandate: name = "my-engine" def check self, action, mandate, only=None : if action.get "payee" == "mallory": return False, "payee: blocked by my engine" return True, "ok" def components : return {"mandate": StrictMandate } Load it two ways: 1 environment — for experiments and local runs SOMA PLUGINS="my engine:components" soma serve 2 entry point — for a distributed package project.entry-points."soma.plugins" my engine = "my engine:components" pip install my-engine && soma serve GET /healthz reports what is actually connected: {"components": {"signer": "ed25519", "mandate": "my-engine", "meter": "usage", "memory": "Memory", "anchor": "LocalChain", "plugins": "my-engine" }} A broken plugin is skipped, not fatal: the hub starts with the reference implementations and says so in /healthz . The registry is a file. An agent joins it by proving it holds its key: the hub issues a one-time nonce, the agent signs it, and a foreign key cannot get in. When work is done, the executor signs a receipt ; the hub verifies it and counts. Actions refused by a mandate are counted as breaches. Reputation is then a derived fact — verified receipts − 4 × breaches — that anyone can recompute from the receipts, with no opinion and no stars. Nodes can share work and history. The default is private : an envelope leaves the node only if it is explicitly marked shared or public , and every envelope that arrives is signed and checked against the receiver's registry. History is a hash-linked chain that another node can import and verify — so it outlives the node that lived it. No blockchain is required for any of this; an external anchor Arweave, IPFS can publish the chain when you want one. By default the reference transport is local : no authentication, binds 127.0.0.1 — a component to put behind your own gateway. For a public deployment there is a managed profile: SOMA MANAGED=1 SOMA TOKEN=