Specification / Lineage
Lineage Model
Every agent identity is cryptographically bound to its creator through HKDF-SHA256 key derivation. The chain is immutable, authorizing via typed verify APIs, and tamper-evident. Scroll to zoom from the atomic to the cosmic.
Derivation
HKDF-SHA256
Signing
Ed25519
Hashing
BLAKE3
A single Ed25519 public key. 32 bytes of entropy held by one human. This is where all trust begins.
The point resolves into a keypair. Private never leaves the holder. Public becomes the identifier.
Parent key + salt + context yields a child key. The parent signs AgentLineageProof2025 to bind them.
Two keys connected by a cryptographic derivation. Offline-verifiable. Tamper-evident. Irrevocable by design.
The human root anchors an organization, the organization derives agents, agents derive instances. Each link carries its own signed lineage proof.
The agent spawns siblings. Independent branches. Revoking one leaves the others untouched. Revoke a parent and the subtree cascades.
At the base, M-of-N humans govern the root key. The tree above cannot distinguish single-signer from threshold governance.
From atomic key to organizational scale. Every agent, tool, and model resolves through verifiable links to a human root.
From the atomic to the cosmic
Eight levels of the lineage model
A single Ed25519 public key. 32 bytes of entropy held by one human. This is where all trust begins.
The point resolves into a keypair. Private never leaves the holder. Public becomes the identifier.
Parent key + salt + context yields a child key. The parent signs AgentLineageProof2025 to bind them.
Two keys connected by a cryptographic derivation. Offline-verifiable. Tamper-evident. Irrevocable by design.
The human root anchors an organization, the organization derives agents, agents derive instances. Each link carries its own signed lineage proof.
The agent spawns siblings. Independent branches. Revoking one leaves the others untouched. Revoke a parent and the subtree cascades.
At the base, M-of-N humans govern the root key. The tree above cannot distinguish single-signer from threshold governance.
From atomic key to organizational scale. Every agent, tool, and model resolves through verifiable links to a human root.
Key Derivation Process
How keys are born
The exact HKDF construction from §10.3 of the specification: parent private key in, deterministic child identity out.
The parent's 32-byte Ed25519 private key becomes the input key material (IKM).
The 32-byte parent public key is the HKDF salt, binding the derivation to the parent identity.
HMAC-SHA256 condenses the IKM and salt into a pseudorandom key (PRK).
The PRK expands with info = the UTF-8 derivation path (e.g. /agent-coordinator) into 32 output bytes.
The 32 bytes seed the child signing key, clamped per RFC 8032. The verifying key follows from it.
Multibase-encode (base58btc, z prefix) the child public key as the DID identifier.
The parent signs AgentLineageProof2025 over the canonical payload, binding childDid to parentDid.
Verification Rules
What makes a chain valid
Only typed lineage verify APIs authorize privilege. Structural shape checks are internal and never grant access.
Every link in the lineage chain must resolve and verify. If a resolution times out, the lineage is reported unverifiable — never silently valid.
Parent keys come from validated parent documents; child keys must match the child verification method. Proof-selected keys alone never authorize.
The chain must terminate at an hmr, mhr, or enr present in the verifier's trust anchors. When it ends at an ENR, verifiers also check its governing MHR.
did:oas · typed authorizing verify · tamper-evident