Verify, offline and without a wallet, that a live paid agent transaction was bound from represented intent to a signed execution receipt and outcome.
AgentNOMOS (by FeedOracle Technologies) operates a governed machine-to-machine Trust Chain. This repository contains the public reference evidence from one real production ALLOW (a $0.001 USDC purchase, settled on Base Mainnet) and one real production DENY (HTTP 403 refusal), plus a stateless verifier that re-checks both from public data only.
A payment receipt proves money moved. What proves that the agent executed the action it was actually authorized to perform? That binding — intent → capability → offer → security evidence → authorization → execution → signed receipt → outcome — is what you can check here.
python3 tests/run_vectors.py
Expected output (verbatim; deterministic across runs):
PASS positive.core.exit0 — exit=0
PASS positive.core.21of21
PASS positive.wrapper.exit0 — exit=0
PASS positive.wrapper.gate_pass
PASS tampered-signature.exit1 — exit=1
PASS tampered-signature.ed25519_fails — expected allow.ed25519_signature_valid to FAIL
PASS tampered-intent.exit1 — exit=1
PASS tampered-intent.digest_fails
PASS tampered-capability.exit1 — exit=1
PASS tampered-capability.digest_fails
PASS unsupported-schema.wrapper.exit1 — exit=1
PASS unsupported-schema.wrapper.reason
NOTE core-verifier-v1 on unsupported-schema vector: exit=0 (v1 does not gate the top-level schema field; wrapper does — proposed as upstream v1.1 change)
0 expectation failures — ALL EXPECTATIONS MET
Or run the core verifier directly against the positive vectors:
python3 verifier/nomos_repro_verify.py \
--allow test-vectors/positive/allow-reference.json \
--deny test-vectors/positive/deny-reference.json \
--jwks test-vectors/positive/jwks.json
Expected: 21 checks: 21 PASS, 0 FAIL, 0 NOT_RUN, exit code 0.
Requirements: Python 3 stdlib. The optional cryptography package is used only
for the Ed25519 signature check; without it that one check reports NOT_RUN and
the exit code is 2 instead of 0.
Everything above is offline: local files, no network, no wallet, no signing, no call to any production system. The verifier can also fetch the same documents from their canonical public URLs (run it with no arguments) — that is a read-only GET of already-public files.
If you want to exercise the live route rather than the reference evidence:
- Capability:
nomos_full_chain_verification - Invocation:
POST https://tooloracle.io/v2/nomos_full_chain_verification(x402; an unpaid POST returns an HTTP 402 payment challenge) - Price: $0.001 USDC · Network: Base Mainnet (
eip155:8453) - Underlying safe action: one governed, read-only registry-statistics read
- Settlement semantics: inbound settlement supported; NOMOS holds no autonomous outbound-wallet authority
Details: docs/live-capability.md. This is optional
and costs real (if tiny) money; nothing in this repository requires it.
| Proves (checkable here) | Does NOT prove (and is not claimed) |
|---|---|
| The intent digest recomputes from the published intent document | That the represented intent matched the human's underlying meaning |
| The Ed25519 receipt signature verifies against the public JWKS | That any party other than the operator has independently verified the chain |
| The receipt binds action digest, policy version+digest, security-evidence digest, execution id, response hash and decision | That the internal policy is externally re-executable (the policy configuration is not public — stated openly) |
| The settlement transaction is inspectable on any public Base explorer | That payment implies correct authorization or correct execution (that is exactly the gap the binding addresses) |
| The DENY was refused before execution with every execution counter at zero delta (operator-attested store evidence, consistency-checked) | That store counters are independently re-derivable by outsiders |
| The published ALLOW/DENY used the same policy version | Autonomous outbound spending of any kind |
The claim ceiling for everything in this repository is execution-bound proof. The exact boundary:
NOMOS proves continuity from the represented intent onward. It does not prove that the represented intent was the correct interpretation of the human's underlying meaning.
The reference purchase was the operator's own authorized canary
(payer class KNOWN_CANARY in the vector, see
test-vectors/NOTE.md) — it demonstrates the machinery,
not customer adoption, and is not presented as an external buyer.
verifier/ published stateless verifier (verbatim) + fail-closed wrapper
test-vectors/ positive vectors (published reference evidence + public JWKS)
and derived tampered vectors with a digest ledger
tests/ offline harness asserting exact pass/fail behavior
examples/ field-by-field walkthroughs of the ALLOW and the DENY
docs/ architecture, claim boundary, threat model, protocol mapping,
live capability, verification internals
templates/ independent-verification report template
We would like this evidence to be tested by people we do not control. Run the
vectors, attack the bindings, try the live route if you wish — and publish your
result whether it passes or fails. A structured report template is in
templates/independent-verification-report.md.
Until such an uncontrolled test exists we do not describe this work as
independently verified — and this README will be updated when one does, either
way.
- Reference evidence and verifier are published at
https://agentnomos.com/proof/full-chain/and indexed athttps://agentnomos.com/.well-known/nomos-reproducibility.json. - Public JWKS:
https://feedoracle.io/.well-known/nomos-execution-jwks.json. - The files under
test-vectors/positive/andverifier/nomos_repro_verify.pyare byte-identical copies of those published artifacts.
- Software and configuration: Apache License 2.0 — see
LICENSE. - Documentation and reference vectors: Creative Commons Attribution 4.0
International — see
LICENSE-CC-BY-4.0. - The exact file-level scope of each license is defined in
LICENSING.md.
Maintained by FeedOracle Technologies · SECURITY.md · CONTRIBUTING.md · Claim boundary