Specification / Lineage
Lineage Model
Owned derivation paths bind descendants through HKDF-SHA256 and signed lineage proofs. A directly approved self root has no parent chain. Verification checks each required relationship; your application separately decides what actions to authorize.
From the atomic to the cosmic
Eight levels of the lineage model
A single Ed25519 public key. 32 bytes of entropy held by one human. This is where all trust begins.
The point resolves into a keypair. Private never leaves the holder. Public becomes the identifier.
Parent key + salt + context yields a child key. The parent signs AgentLineageProof2025 to bind them.
Two keys connected by a cryptographic derivation. Offline-verifiable. Tamper-evident. Irrevocable by design.
The human root anchors an organization, the organization derives agents, agents derive instances. Each link carries its own signed lineage proof.
The agent spawns siblings. Independent branches. Revoking one leaves the others untouched. Revoke a parent and the subtree cascades.
At the base, M-of-N humans govern the root key. The tree above cannot distinguish single-signer from threshold governance.
This owner-lineage model links derived entities to an accountable root. Current SDK verification separately supports explicitly trusted independent agent roots.
Key Derivation Process
How keys are born
The exact HKDF construction from §10.3 of the specification: parent private key in, deterministic child identity out.
The parent's 32-byte Ed25519 private key becomes the input key material (IKM).
The 32-byte parent public key is the HKDF salt, binding the derivation to the parent identity.
HMAC-SHA256 condenses the IKM and salt into a pseudorandom key (PRK).
The PRK expands with info = the UTF-8 derivation path (e.g. /agent-coordinator) into 32 output bytes.
The 32 bytes seed the child signing key, clamped per RFC 8032. The verifying key follows from it.
Multibase-encode (base58btc, z prefix) the child public key as the DID identifier.
The parent signs AgentLineageProof2025 over the canonical payload, binding childDid to parentDid.
Verification Rules
What makes a chain valid
Only typed lineage verify APIs authorize privilege. Structural shape checks are internal and never grant access.
Every link in the lineage chain must resolve and verify. If a resolution times out, the lineage is reported unverifiable — never silently valid.
Parent keys come from validated parent documents; child keys must match the child verification method. Proof-selected keys alone never authorize.
The chain must terminate at an hmr, mhr, or enr present in the verifier's trust anchors. When it ends at an ENR, verifiers also check its governing MHR.
did:oas · typed authorizing verify · tamper-evident