One registry. Every agent.
295 actions across 23 L5 domains. One Zod 4 source-of-truth registry generates every transport — REST, MCP, ChatGPT Apps, Gemini, Perplexity, Claude Cowork, A2A, NLWeb, Claude SKILLs — byte-identically, on every contracts version bump. W3C DID Web agent identities, SPIFFE workload identity, AP2 Verifiable Credential mandates, MCP Apps confirmation iframes, C2PA 2.1 content provenance. The same security posture as the dashboard, against the same hash-chained audit log.
L1 to L6Six layers, one source.
Every Agined action is defined once in the contracts registry (L5) and the codegen pipeline (L4) emits every transport's wire format byte-identically. The Worker (L3) implements each action once; the gateway middleware (L2) enforces auth + idempotency + rate-limit + confirmation + mandate + audit across all transports. Customer surfaces (L1) — the dashboard, AI chats, partner agents — never re-derive contracts.
- 1L1 · Customer surfacesDashboard→Number One→partner agents→MCP / ChatGPT Apps / Gemini / Claude Cowork / A2A / NLWeb / SKILLs / REST
- 2L2 · Gateway middleware15 steps→CORS→site-gate→replay-defense→auth→workspace-ctx→idempotency→rate-limit→kill-switch→permission→mandate→confirmation→handler dispatch→audit→Tops→response
- 3L3 · Per-domain handlersOne handler per L5 action→pure modules→take RequestContext + parsed input→return result OR error
- 4L4 · Codegen pipelineWalks L5 once, emits OpenAPI 3.1→MCP→ChatGPT Apps→Gemini→Perplexity→Claude Cowork→A2A→AsyncAPI→NLWeb→SKILLs→AGENTS.md
- 5L5 · Action Registry (contracts)Zod 4→z.toJSONSchema()→295 actions × 23 domains→every transport derived from here→@agined/contracts
- 6L6 · Identity · audit · crypto primitivesW3C DID Web→SPIFFE→AP2 mandates→MCP Apps confirmation tokens→C2PA→OpenTimestamps→DPoP→intent claims→hash-chained audit log
Customer surfaces
Dashboard, Number One AI chat, embedded customer apps, partner agents reaching the gateway via OAuth or A2A or workload SVID.
Gateway middleware
15-step middleware chain: CORS → site-gate → replay-defense → auth → workspace-context → idempotency → rate-limit → kill-switch → permission → mandate → confirmation → handler dispatch → audit envelope → Tops feed → response shaping.
Per-domain handlers
One handler per L5 action. Pure modules: take RequestContext + parsed input, return result OR error. No global state.
Codegen pipeline
Walks the L5 registry once, emits OpenAPI 3.1 · MCP tool list · ChatGPT Apps manifest · Gemini Extension · Perplexity Connector · Claude Cowork capability · A2A capability card · AsyncAPI 3 · NLWeb · Claude SKILLs · AGENTS.md.
Action Registry (contracts)
Zod 4 schemas defined once with z.toJSONSchema(). 295 actions across 23 domains. Every transport's wire format derived from here.
Identity + audit + cryptography primitives
W3C DID Web · SPIFFE · AP2 mandates · MCP Apps confirmation tokens · C2PA · OpenTimestamps · DPoP (RFC 9449) · intent claims · hash-chained audit log.
23 L5 domains. Every action declared once.
Each action declares its safety level (read / mutation / destructive / billing_impacting), confirmation policy (none / ask / always / mandate), permission scopes, idempotency, audit kind, rate class, and transport surfaces. The L5 enum is the closed set; every codegen target walks it deterministically.
account
Login session, profile, passkeys, locale, notification preferences.
org
Organization-level CRUD, members, roles, SSO.
workspace
Workspace CRUD, members, settings, region binding.
billing
Subscription, packs, top-ups, invoices, cost centers.
keys
Personal access tokens + workspace API keys (av_* + atst_*).
webhooks
Outbound webhook endpoints + signing secrets + deliveries.
alerts
Alert rules + test fires + history.
exports
Compliance exports + signed receipt bundles.
retention
Retention policy + paid extension.
audit
Three-tier audit log (workspace, custody, Tops feed).
tops
Tops config cascade (org → workspace → actor).
referrals
Codes + redemption + spend ledger + charity donation.
number_one
Number One AI chat in 3 modes (Calculator / Analyst / Admin).
attestor
8 cryptographic-receipt primitives.
privacy
GDPR/CCPA DSR submission, status, receipts. Always-on.
support
Tickets + replies + satisfaction surveys.
discovery
Capabilities + version + schema + plan list.
agents
W3C DID Web identity + AP2 mandates + SPIFFE + federation roots.
starfleet
Actor roster runs + the run ledger.
fabric
Connector fabric: sources, connections, extracted records, sync.
actionflow
Flow runs, template instantiation, executions.
ledger-bundles
Signed snapshots + transparency-chain verification.
witness
Framework catalogue + the adapter-record stream.
Reach Agined from anywhere.
Every action declares a default reach across REST + MCP + the four chat-surface manifests + A2A + NLWeb + Claude SKILL. Surface lists are per-action in the registry — a high-risk action (e.g. billing.subscription.cancel) ships REST-only by default and the customer opts into wider reach via the workspace settings.
REST
POST /api/v1/<action-id>. OAuth 2.1 + DPoP-bound or PAT or workspace API key.
MCP
Streamable HTTP + SSE at mcp.a2pi.app/mcp. 291 tools.
MCP Apps
Single-use confirmation tokens for mandate-gated actions. The modal surface is not live yet.
ChatGPT Apps
OpenAI Apps SDK manifest at /.well-known/ai-plugin.json. OAuth + PKCE + DPoP-supported.
Gemini Extensions
Function declarations at /.well-known/gemini-extension.json.
Perplexity
Connector v1 tool list at /.well-known/perplexity-connector.json.
Claude Cowork
Capability card at /.well-known/claude-cowork.json with seeded prompts.
A2A (Agent-to-Agent)
did:web:agined.com:agents:gateway. Per-tenant endpoint; mandate-required for billing-impacting calls.
NLWeb
Natural-language-discoverable intents at /.well-known/nlweb.json.
Claude SKILLs
One SKILL.md per L5 domain published under /.well-known/claude-skills/.
Built on published specifications.
We never invent crypto. Every primitive here is W3C, IETF, SPIFFE, AP2, MCP, C2PA. The contracts repo cites every spec by section + RFC + version so partner integrations don't need to re-negotiate the wire format. The wiring docs map each spec to a deployment-ready Worker implementation.
W3C DID Web Method
Every agent on the platform has its own decentralized identity.
- did:web:agined.com:agents:<id> for every enrolled agent.
- Ed25519 (default) or ES256 signing keys. Customer-rotatable + customer-revocable.
- Per-DID rotation history forms a hash chain. JCS-canonicalised (RFC 8785).
- Universal resolver accepts did:web, did:key, did:peer for partner federations.
W3C DID Core 1.0 · DID Web Method 0.2 · JWK RFC 7517+7638
Documentation →SPIFFE Workload Identity
Workloads attest themselves to the gateway — not just users.
- spiffe.agined.com trust domain + X.509-SVID + JWT-SVID exchange.
- DPoP-bound short-lived (5-minute) Agined sessions issued on workload-attest.
- Workspace-scoped federation against partner trust domains.
- Trust-bundle SHA-256 pinning + drift detection.
SPIFFE 1.0 · X.509-SVID · JWT-SVID · Trust Domain + Bundle + Federation
Documentation →AP2 Verifiable Credential Mandates
Standing authorisation for agent-led billing — with cryptographic enforcement.
- W3C VC Data Model 2.0 + SD-JWT VC (IETF). Selective-disclosure presentations.
- Spend + invocation + per-hour + per-action limits enforced at every gateway call.
- Conditions: IP CIDR allow-list, required DPoP key thumbprint, step-up factor.
- BitstringStatusListCredential at /.well-known/mandates/status-list.json; 5-min refresh.
W3C VC Data Model 2.0 · SD-JWT VC · Data Integrity 1.0 · AP2 baseline
Documentation →MCP Apps confirmation tokens
Single-use, audience-restricted, bound to one action.
- A UI session token is minted per confirmation: `aud: ["https://ui.agined.com"]`, one action, one use.
- The proxy lane checks three bindings before forwarding — the confirmation origin, the `mcp-apps@1` protocol version, and the host-issued nonce echoed back.
- Consume-once is an atomic ledger write, so a replayed token is refused rather than re-executed.
- The rich modal surface itself is not live: the iframe bundle is unwritten and the ui.agined.com zone is not provisioned.
MCP Specification 2026-07-28 · `mcp-apps@1` (Agined’s own bridge protocol, not the io.modelcontextprotocol/ui extension)
Documentation →C2PA 2.1 Content Credentials
Agined receipts paired with ecosystem-standard provenance manifests.
- Every attestor.attest.content receipt pairs with a C2PA 2.1 manifest.
- COSE_Sign1 over RFC-8949-canonical CBOR (EdDSA default, ES256 for FIPS deploys).
- RFC 3161 timestamp-authority countersignature (opt-in; configure your own TSA).
- AI-generated content disclosure can be auto-injected into the manifest.
C2PA 2.1 · COSE_Sign1 (RFC 8152 + RFC 9052) · RFC 8949 CBOR · RFC 3161 TSP
Documentation →Four ways in. All workspace-scoped.
Every credential is workspace-scoped, revocable, and recorded to the audit log on every issuance + every use. No cross-workspace blast radius; no shared API keys; every request enforces the workspace context convention (X-Workspace-Id header or ?ws= URL parameter — pinned in tenancy and isolation).
av_pat_*
Self-serve per-developer tokens. 25 scopes from read-only audit to write-mandate. Optional IP CIDR binding. Cleartext shown once at issuance. Revocable instantly from /app/account/tokens.
OAuth + DPoP
RFC 9449 DPoP-bound access tokens. Audience-restricted per RFC 8707. Dynamic Client Registration (RFC 7591). Customer sees + revokes every grant from /app/account/connections.
DID Web + JWT-VC
W3C DID Web Method per agent (did:web:agined.com:agents:<id>). Customer-rotatable keys, hash-anchored every rotation. Delegation-chain JWT array on multi-agent workflows.
Ingest tokens
Single workspace · single scope. Plugins, webhook ingest and every adapter use these. Rotation + revocation from the workspace settings; never cross-workspace.
AP2 Verifiable Credential mandates additionally required on billing-impacting actions. The customer issues the mandate; the agent presents it; the gateway verifies it against the BitstringStatusList. No mandate, no charge.
Sensitive actions (large export, key bulk-revoke, mandate issuance over budget) require a single-use confirmation token, audience-restricted to ui.agined.com and bound to that one action, before the action lands. The modal surface that will present it is not live yet.
One action. Every safeguard, no extra code.
Here's the canonical "agent makes a billing-impacting call with an AP2 mandate" flow. The same shape works from REST, MCP, ChatGPT Apps, A2A — only the transport changes. The gateway middleware enforces auth + workspace context + idempotency + rate-limit + kill-switch + permission + mandate + confirmation, and writes the audit envelope.
curl -X POST https://api.agined.com/api/v1/agents/mandate/issue \
-H "Authorization: Bearer av_pat_…" \
-H "DPoP: <RFC-9449 proof>" \
-H "Agined-Workspace-Id: ws_demo_default" \
-H "X-Idempotency-Key: $(uuidgen)" \
-H "X-Agined-Confirmation: conf_…" \
-d '{
"label": "Stripe refund bot — Q3 budget",
"agentDid": "did:web:agined.com:agents:refund-bot",
"allowedActionIds": ["billing.refund.issue"],
"maxSafetyLevel": "billing_impacting",
"workspaceIds": ["ws_demo_default"],
"maxSpendUsdFractional": 50000,
"maxInvocations": 200,
"validForDays": 30
}'import httpx, uuid
response = httpx.post(
"https://api.agined.com/api/v1/agents/mandate/issue",
headers={
"Authorization": "Bearer av_pat_…",
"DPoP": "<RFC-9449 proof>",
"Agined-Workspace-Id": "ws_demo_default",
"X-Idempotency-Key": str(uuid.uuid4()),
"X-Agined-Confirmation": "conf_…",
},
json={
"label": "Stripe refund bot — Q3 budget",
"agentDid": "did:web:agined.com:agents:refund-bot",
"allowedActionIds": ["billing.refund.issue"],
"maxSafetyLevel": "billing_impacting",
"workspaceIds": ["ws_demo_default"],
"maxSpendUsdFractional": 50000,
"maxInvocations": 200,
"validForDays": 30,
},
)
mandate = response.json()import { randomUUID } from "node:crypto";
const response = await fetch(
"https://api.agined.com/api/v1/agents/mandate/issue",
{
method: "POST",
headers: {
"Authorization": "Bearer av_pat_…",
"DPoP": "<RFC-9449 proof>",
"Agined-Workspace-Id": "ws_demo_default",
"X-Idempotency-Key": randomUUID(),
"X-Agined-Confirmation": "conf_…",
"Content-Type": "application/json",
},
body: JSON.stringify({
label: "Stripe refund bot — Q3 budget",
agentDid: "did:web:agined.com:agents:refund-bot",
allowedActionIds: ["billing.refund.issue"],
maxSafetyLevel: "billing_impacting",
workspaceIds: ["ws_demo_default"],
maxSpendUsdFractional: 50000,
maxInvocations: 200,
validForDays: 30,
}),
},
);
const mandate = await response.json();req, _ := http.NewRequest("POST",
"https://api.agined.com/api/v1/agents/mandate/issue",
bytes.NewReader([]byte(`{
"label": "Stripe refund bot — Q3 budget",
"agentDid": "did:web:agined.com:agents:refund-bot",
"allowedActionIds": ["billing.refund.issue"],
"maxSafetyLevel": "billing_impacting",
"workspaceIds": ["ws_demo_default"],
"maxSpendUsdFractional": 50000,
"maxInvocations": 200,
"validForDays": 30
}`)))
req.Header.Set("Authorization", "Bearer av_pat_…")
req.Header.Set("DPoP", "<RFC-9449 proof>")
req.Header.Set("Agined-Workspace-Id", "ws_demo_default")
req.Header.Set("X-Idempotency-Key", uuid.NewString())
req.Header.Set("X-Agined-Confirmation", "conf_…")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()curl -X POST https://api.agined.com/api/v1/billing/refund/issue \
-H "Authorization: Bearer <agent-session-jwt>" \
-H "DPoP: <RFC-9449 proof>" \
-H "X-Mandate-Presentation: <base64url SD-JWT VC>" \
-H "X-Mandate-Audience: https://api.agined.com" \
-H "X-Mandate-Nonce: <gateway-issued>" \
-H "Agined-Workspace-Id: ws_demo_default" \
-H "X-Idempotency-Key: $(uuidgen)" \
-d '{
"chargeId": "ch_3Pj…",
"amountFractional": 14500,
"reason": "Customer requested partial refund"
}'import httpx, uuid
response = httpx.post(
"https://api.agined.com/api/v1/billing/refund/issue",
headers={
"Authorization": "Bearer <agent-session-jwt>",
"DPoP": "<RFC-9449 proof>",
"X-Mandate-Presentation": "<base64url SD-JWT VC>",
"X-Mandate-Audience": "https://api.agined.com",
"X-Mandate-Nonce": "<gateway-issued>",
"Agined-Workspace-Id": "ws_demo_default",
"X-Idempotency-Key": str(uuid.uuid4()),
},
json={
"chargeId": "ch_3Pj…",
"amountFractional": 14500,
"reason": "Customer requested partial refund",
},
)import { randomUUID } from "node:crypto";
const response = await fetch(
"https://api.agined.com/api/v1/billing/refund/issue",
{
method: "POST",
headers: {
"Authorization": "Bearer <agent-session-jwt>",
"DPoP": "<RFC-9449 proof>",
"X-Mandate-Presentation": "<base64url SD-JWT VC>",
"X-Mandate-Audience": "https://api.agined.com",
"X-Mandate-Nonce": "<gateway-issued>",
"Agined-Workspace-Id": "ws_demo_default",
"X-Idempotency-Key": randomUUID(),
"Content-Type": "application/json",
},
body: JSON.stringify({
chargeId: "ch_3Pj…",
amountFractional: 14500,
reason: "Customer requested partial refund",
}),
},
);req, _ := http.NewRequest("POST",
"https://api.agined.com/api/v1/billing/refund/issue",
bytes.NewReader([]byte(`{
"chargeId": "ch_3Pj…",
"amountFractional": 14500,
"reason": "Customer requested partial refund"
}`)))
req.Header.Set("Authorization", "Bearer <agent-session-jwt>")
req.Header.Set("DPoP", "<RFC-9449 proof>")
req.Header.Set("X-Mandate-Presentation", "<base64url SD-JWT VC>")
req.Header.Set("X-Mandate-Audience", "https://api.agined.com")
req.Header.Set("X-Mandate-Nonce", "<gateway-issued>")
req.Header.Set("Agined-Workspace-Id", "ws_demo_default")
req.Header.Set("X-Idempotency-Key", uuid.NewString())
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()// MCP client calls the gateway through mcp.a2pi.app/mcp
// Tool name mirrors the action id; the host attaches the mandate
// presentation as the "x-agined-mandate" annotation.
{
"name": "billing.refund.issue",
"arguments": {
"chargeId": "ch_3Pj…",
"amountFractional": 14500,
"reason": "Customer requested partial refund"
},
"_meta": {
"x-agined-mandate": "<base64url SD-JWT VC>"
}
}from mcp.client import Client
client = await Client.connect("https://mcp.a2pi.app/mcp",
bearer="<agent-session-jwt>")
result = await client.call_tool(
"billing.refund.issue",
arguments={
"chargeId": "ch_3Pj…",
"amountFractional": 14500,
"reason": "Customer requested partial refund",
},
meta={"x-agined-mandate": "<base64url SD-JWT VC>"},
)import { Client } from "@modelcontextprotocol/sdk/client/index.js";
const client = new Client({ name: "agent", version: "1" });
await client.connect("https://mcp.a2pi.app/mcp", {
bearer: "<agent-session-jwt>",
});
const result = await client.callTool({
name: "billing.refund.issue",
arguments: {
chargeId: "ch_3Pj…",
amountFractional: 14500,
reason: "Customer requested partial refund",
},
_meta: { "x-agined-mandate": "<base64url SD-JWT VC>" },
});// Partner agent presents an A2A claim against
// did:web:agined.com:agents:gateway.
// Worker validates the mandate VC's issuer DID is trusted by
// our workspace, the cross-signature is valid, the action is
// in actionScope.allowedActionIds, and the spend is under
// limits.maxSpend.
{
"@context": ["https://a2a.org/v1"],
"from": "did:web:partner.example.com:agents:billing-bot-12",
"to": "did:web:agined.com:agents:gateway",
"actionId": "billing.refund.issue",
"params": { /* ... */ },
"mandate": "<base64url SD-JWT VC>"
}import httpx, json
claim = {
"@context": ["https://a2a.org/v1"],
"from": "did:web:partner.example.com:agents:billing-bot-12",
"to": "did:web:agined.com:agents:gateway",
"actionId": "billing.refund.issue",
"params": { "chargeId": "ch_3Pj…", "amountFractional": 14500 },
"mandate": "<base64url SD-JWT VC>",
}
signed = sign_a2a_claim(claim, partner_signing_key)
httpx.post(
"https://api.agined.com/api/a2a/dispatch",
json=signed,
headers={"Content-Type": "application/a2a+json"},
)47 well-known files. No login required.
Every transport surface publishes its manifest at the canonical IANA-registered or ecosystem-conventional well-known path. Agents (LLM hosts, partner integrations, security verifiers) discover the surface without an auth round-trip. Cache: public, max-age=300, must-revalidate. Every file carries X-Agined-Source: contracts-codegen for provenance.
OpenAPI 3.1 spec
/openapi.json
AGENTS.md catalogue
/AGENTS.md
MCP server card
/.well-known/mcp/server.json
MCP tool list
/.well-known/mcp/tools.json
A2A discovery (per-tenant cards)
/.well-known/agent-card.json
AGENTS.json (machine-readable)
/.well-known/agents.json
Org-level DID document
/.well-known/did.json
JWKS (signing keys)
/.well-known/jwks.json
SPIFFE trust bundle
/.well-known/spiffe-trust-bundle.json
AP2 mandate revocation
/.well-known/mandates/status-list.json
Trusted A2A roots
/.well-known/agents/trusted-roots.json
ChatGPT Apps manifest
/.well-known/ai-plugin.json
Gemini Extension manifest
/.well-known/gemini-extension.json
Perplexity Connector v1
/.well-known/perplexity-connector.json
Claude Cowork capability
/.well-known/claude-cowork.json
AsyncAPI 3.0 spec
/.well-known/asyncapi.json
NLWeb manifest
/.well-known/nlweb.json
OIDC discovery
/.well-known/openid-configuration
Approved fraud providers
/.well-known/fraud-providers.json
Sub-processor inventory
/.well-known/sub-processors.json
Customer-first access paths
/.well-known/data-access-providers.json
Every call. Hash-chained. Anchored.
Every agentic call lands in the same hash-chained audit log the customer dashboard surfaces — same SQLite append-only trigger, same Ed25519 detached signature, same OpenTimestamps daily anchor. Mandate-gated calls additionally log the mandate handle + estimated spend + verification outcome. Workload-attestation calls additionally log the SVID hash + trust-domain provenance.
Hash chain
Per-workspace SQLite trigger emits prev_hash → hash on every write. Append-only; mutation is detectable by re-walking the chain.
Ed25519 signature
Each entry signed with the workspace's active signing key. Verifiable offline against /.well-known/jwks.json.
OpenTimestamps
Daily anchor commits the day's chain tip to the Bitcoin blockchain. Independent of Agined's infrastructure.
Action-specific kinds
agent.identity.* · agent.mandate.* · agent.spiffe.* · key.rotated · key.revoked — 84 audit event types in the catalogue.
Every primitive. Sourced + pinned.
The contracts package cites every spec by version, the capability documentation maps each spec to the Worker that implements it, and the security documentation describes the control behind it. [Name the frameworks you map those controls to, and see /compliance for what a mapping is and is not.]