Cross-Ecosystem Trust Graph

The surrounding ecosystem role changed (external operator context, evaluation, transport, economics). The NOMOS governance boundary — authority semantics, decision source, execution signer, receipt verification model — did not. A role in an ecosystem does not automatically become authority over actions.

Why this exists

Each experiment varies exactly one surrounding ecosystem role — external operator context, evaluation, transport, economics — and measures whether the AgentNOMOS governance boundary (decision source, authority semantics, execution signer, receipt verification) changed. It did not. Role never became authority.

Proof matrix

Proof levels are different dimensions, not ranks. Values are exact evidence states — no undifferentiated checkmarks.

Ecosystem	Role	Proof level	Authority effect	Same NOMOS core	Governed execution	Receipt	External operator
Independent external operator	EXTERNAL_OPERATOR_CONTEXT	EXTERNAL_CROSS_OPERATOR	NONE	VERIFIED_SAME_RUNTIME_PATH	TRUE	SIGNED_VERIFIED	TRUE
AgentBeats	INDEPENDENT_EVALUATION	LOCAL_GOVERNED_REALPATH	NONE	VERIFIED_BYTE_IDENTICAL	TRUE	SIGNED_VERIFIED	FALSE
AGNTCY / SLIM	TRANSPORT	LOCAL_REAL_TRANSPORT	NONE	VERIFIED_BYTE_IDENTICAL	TRUE	SIGNED_VERIFIED	FALSE
x402	ECONOMICS	ECONOMIC_FULL_CHAIN	NONE_CLAIMED_NOT_TESTED	NOT_PROVEN	NOT_APPLICABLE_DIFFERENT_LANE	SIGNED_VERIFIED	TRUE
AgentNOMOS	ACTION_GOVERNANCE	REFERENCE_ONLY	SOLE_ACTION_AUTHORITY (admission decision + execution + signed receipt)	VERIFIED_BYTE_IDENTICAL	TRUE	SIGNED_VERIFIED	NOT_APPLICABLE

Independent external operator (arranged cross-operator test)

Role in this experiment: EXTERNAL_OPERATOR_CONTEXT — Role assigned within the NOMOS experiment, not by NANDA or CodeMinder.

Proof level: EXTERNAL_CROSS_OPERATOR · Verdict: PASS_ARRANGED_CROSS_OPERATOR_GOVERNED_INTEROP · Run: 2026-08-16T15:48:37Z

What changed: A2A JSON-RPC over public HTTPS (POST /a2a/jsonrpc)

What stayed constant: governance core match = VERIFIED_SAME_RUNTIME_PATH; decision ALLOW_READ_ONLY; receipt kid exr1_40c4bc9a9f61988b.

Evidence: sealed checkpoint cp_nomos_codeminder_cross_operator_pass_2c2_20260816T160416Z (operator-local sealed evidence unless marked public).

Limitations (read these — they are part of the claim)

Arranged test run, not organic demand.
No NANDA endorsement, no MIT validation, no NANDA certification.
No autonomous unsolicited trigger; not LEVEL B.
Network membership conferred zero authority (authority_effect NONE).
Read-only capability only; payment and side effects forbidden by intent constraint.
The external counterparty agent was an operator-side experiment; it is not a CodeMinder product, and no CodeMinder product relationship, integration, partnership, customer relationship or endorsement is claimed.

AgentBeats (protocol-faithful Green stand-in + shipped Purple adapter)

Role in this experiment: INDEPENDENT_EVALUATION — Role assigned within the NOMOS experiment, not by AgentBeats.

Proof level: LOCAL_GOVERNED_REALPATH · Verdict: PASS_LOCAL_AGENTBEATS_CREDENTIALED_GOVERNED_REALPATH · Run: 2026-08-16T16:17:52Z

What changed: Real A2A Green→Purple, then public HTTPS A2A JSON-RPC to https://tooloracle.io/a2a/jsonrpc

What stayed constant: governance core match = VERIFIED_BYTE_IDENTICAL; decision ALLOW (ALLOW_READ_ONLY path; lane record decision=ALLOW); receipt kid exr1_40c4bc9a9f61988b.

Evidence: sealed checkpoint cp_nomos_agentbeats_ab26_realpath_20260816T161702Z (operator-local sealed evidence unless marked public).

Limitations (read these — they are part of the claim)

LEVEL A: self-initiated, same host; no external AgentBeats operator.
No AgentBeats endorsement, validation or certification; no NAAMSE result.
Evaluator verdict carries zero action authority by construction and by test.
Public JWKS was fetched from the operating host (DNS resolves there); the same JWKS document was externally verified in the sealed 2C.2 run.
Not LEVEL B.

x402 (HTTP 402 payment protocol; Base USDC 'exact' rail, EIP-3009)

Role in this experiment: ECONOMICS — Role assigned within the NOMOS experiment, not by the x402 ecosystem or the provider.

Proof level: ECONOMIC_FULL_CHAIN · Verdict: PASS_R12_2_REAL_EXTERNAL_X402_PURCHASE_EXECUTED_DELIVERED_RECONCILED · Run: 2026-08-14 (sealed 2026-08-14T16:25Z; publication state sealed R13.5 2026-08-14T18:25Z)

What changed: x402 over HTTPS; settlement on Base (USDC, EIP-3009 transferWithAuthorization via relayer)

What stayed constant: governance core match = NOT_PROVEN; decision OPERATOR_AUTHORIZED_SINGLE_SHOT (outbound buyer ceremony with fail-closed pre-signature gates; two aborts before signing moved zero value); receipt kid x402r1_b8d21e5c8d689e6d.

Evidence: sealed checkpoint cp_agentnomos_r12_2_first_real_x402_purchase_20260814T162500Z (operator-local sealed evidence unless marked public).

Limitations (read these — they are part of the claim)

Operator-authorized, value-capped, single-shot — NOT autonomous commerce.
One provider, one endpoint, one query; 'supported' remains false; everything else L0.
independent_third_party remains false; L7 not awarded.
Service result TEMPORALLY_CORROBORATED only; no block pinned; no request->response cryptographic binding.
PAYMENT != AUTHORIZATION not adversarially tested at the NOMOS boundary (marked NOT_TESTED, supported indirectly by disjoint keysets and payment_allowed:false intents).
This proof does not traverse the foreign A2A governance lane; same-core claim deliberately NOT_PROVEN.

Standards conformance evidence

Subject	Role tested	Verifying party	Level	Conformance	Certification	Modules	Same NOMOS core	Runtime state
OpenID4VP 1.0 Final / HAIP 1.0 Final	VERIFIER	OpenID Foundation conformance suite	EXTERNAL_STANDARDS_CONFORMANCE	PASSED	PENDING_NOT_GRANTED	11/11 applicable (7 PASSED, 4 REVIEW) of 12 in plan	NOT_PROVEN	SAFE_IDLE

OpenID4VP 1.0 Final · HAIP 1.0 Final — VERIFIER

NOT A CERTIFICATION. conformance_status PASSED · certification_status PENDING_NOT_GRANTED. The certification package was created and published for certification. Formal OpenID Foundation certification has NOT been granted. Until it is, no certification wording may be used.

The OpenID Foundation conformance suite was run against this verifier; all eleven applicable modules of the OID4VP 1.0 Final + HAIP verifier plan reached a successful final outcome, and one defect was found and repaired in the process. This is not a certification.

Verifying party: OpenID Foundation conformance suite · plan dDw7z2oO2q0vB · suite 5.2.3 · run 2026-08-18T17:57:33Z

Profile tested: SD-JWT VC (sd_jwt_vc), response mode direct_post.jwt, client id scheme x509_hash, request delivery request_uri_signed.

11 of 11 applicable modules reached a SUCCESSFUL FINAL OUTCOME. That is not the same as '11 PASSED': seven finished PASSED automatically because the verifier rejected the presentation with HTTP 4xx, and four finished REVIEW with an uploaded screenshot that was accepted. Both are successful outcomes in this suite; they are reported separately here rather than merged into one number.

#	Module	Outcome	Note
1	happy-flow	REVIEW
2	minimal-cnf-jwk	REVIEW
3	request-uri-method-post	REVIEW	after a scoped, per-transaction POST repair
4	request-uri-fetched-twice	REVIEW
5	invalid-session-transcript	NOT_APPLICABLE
6	invalid-kb-jwt-signature	PASSED
7	invalid-credential-signature	PASSED
8	invalid-sd-hash	PASSED
9	invalid-kb-jwt-nonce	PASSED
10	invalid-kb-jwt-aud	PASSED
11	kb-jwt-iat-in-past	PASSED	post-repair; the PRE-REPAIR run accepted it
12	kb-jwt-iat-in-future	PASSED	post-repair; the PRE-REPAIR run accepted it

The defect the external gate found

The external suite found a real defect that this operator's own testing did not. The pre-repair state is published here on purpose and has not been rewritten or hidden. KB-JWT iat freshness validation gap: adapter/sdjwtvc.py checked only that the Key Binding JWT carried an iat claim, with no freshness window in either direction. Missed by 101 local unit tests on the same file, and eleven earlier suite modules. The gap was written down — file and line — before this strand's first external run, and left unrepaired on purpose so the external result would be falsifiable rather than pre-arranged.

Stage	Case	Verifier	Status	Suite outcome
PRE-REPAIR	KB-JWT iat one year in the past	ACCEPTED	HTTP 200	IMAGE_REQUIRED
PRE-REPAIR	KB-JWT iat one year in the future	ACCEPTED	HTTP 200	IMAGE_REQUIRED
POST-REPAIR	KB-JWT iat one year in the past	REJECTED	HTTP 400	PASSED
POST-REPAIR	KB-JWT iat one year in the future	REJECTED	HTTP 400	PASSED

Both pre-repair instances remain in IMAGE_REQUIRED and are NOT superseded in place. They ask for a screenshot of a rejection that never happened, so none was ever produced or fabricated. They are the record of the finding. Wallets with badly-set clocks are now rejected where they previously passed. That is intended.

The exact build this claim is bound to

File	sha256
`adapter/sdjwtvc.py`	`067fd1094327440949dcbfed8477c5992d688d18c04f79e6b7e3a2a9b26ff79b`
`adapter/request_builder.py`	`c69a5de459f399d922a558b785773bee4af7611f6eb49495657fd1f1440d2f65`
`gateway/server.py`	`6b27ec2ea7fca343b10c3f6e13242c2f34fc5558324fd5f6b04250d66fa4c8a2`

Freshness policy: max age 300 s, future skew 60 s. Deployment policy chosen by this operator. No external authority validates these two numbers; the suite confirms only that SOME window exists and catches gross deviations.

Evidence

Sealed checkpoint cp_agentnomos_openid4vp_haip_external_conformance_evidence_FINAL_r1_20260818T175733Z (10 sealed entries), supplemented by cp_agentnomos_openid4vp_final_evidence_url_reference_r1_20260818T180128Z (9 entries). Chain: 20 checkpoints, 238 sealed entries. All 20 checkpoint manifests re-verified at publication time; 0 mismatches.

Package	sha256	How this digest was checked
OIDF certification package	`d69b63164dceb446b1cb89a1506f88e79d1c63fb24cc58a9725db54765f47f36`	OPERATOR_ATTESTED
OIDF client-data evidence package	`04852dca15a40dee182da12c67aad62373d31ea1c9b8b9b6a5c214d5424aa555`	LOCALLY_VERIFIED

OPERATOR_LOCAL_SEALED_EVIDENCE. The suite's own result pages were served from process memory and went offline when the lane was disarmed; they are NOT durable evidence and are deliberately not cited as retrievable URLs. The durable form is the sealed checkpoint chain above, which includes sealed HTML copies of those pages.

Runtime state of the tested lane

SAFE_IDLE — service inactive and disabled, public routes absent (all lab paths return 404). The tested lane is deliberately disarmed. Nothing in this node claims a reachable or running OpenID4VP verifier.

What this proves

The OpenID Foundation conformance suite, operated by the OpenID Foundation and driven from outside this host, exercised this verifier build against the OpenID4VP 1.0 Final + HAIP 1.0 Final verifier plan dDw7z2oO2q0vB.
All 11 applicable modules of that plan reached a successful final outcome against the build hashed above.
One real defect was found by the external gate, preserved before repair, repaired, and re-judged successful in both directions.

What this does NOT prove

That the OpenID Foundation has certified this implementation. It has not.
That the OpenID Foundation endorses, validates or is affiliated with AgentNOMOS.
That AgentNOMOS offers OpenID4VP verification as a product or a live capability.
That the tested verifier is deployed, reachable, or carries any authority.
That the suite covers the whole of OpenID4VP or HAIP.
That passing modules implies the absence of defects — this very run disproves that.

Limitations (read these — they are part of the claim)

NOT A CERTIFICATION. Formal OpenID Foundation certification has not been granted; the package has only been created and published for certification.
The tested lane is a LAB verifier: no production key, no NOMOS authority, no admission decision, no signed execution receipt.
The lane is disarmed (SAFE_IDLE): the service is inactive and disabled and all public lab routes return 404.
The credential issuer trusted during the run was an OpenID Foundation TEST instance whose signing key is public. It is not a trust anchor and must never be trusted again.
4 of the 11 applicable modules finished REVIEW with an accepted screenshot rather than PASSED; the split is published rather than merged.
The 300 s / 60 s freshness window is this operator's deployment policy; no external authority validates those numbers.
Two PRE-REPAIR suite instances remain in IMAGE_REQUIRED by design and were never superseded in place.
The suite's public result pages are offline; only the sealed checkpoints are durable evidence.
The certification-package digest is operator-attested, not locally reproducible.

Forbidden claims

OpenID Certified
certified verifier
OpenID Foundation certification granted
OpenID Foundation endorsement, validation or partnership
HAIP compliant (as a granted or third-party-conferred status)
conformant (as a granted status rather than a described test outcome)
a live, reachable or production AgentNOMOS OpenID4VP verifier
any AgentNOMOS authority derived from a conformance result
reuse of the lab issuer trust pin as a trust anchor

References to the OpenID Foundation, the OpenID Foundation conformance suite, OpenID4VP or HAIP identify a specification and a test tool used in this experiment. They do not imply endorsement, certification, validation or partnership by the OpenID Foundation. Formal OpenID Foundation certification has NOT been granted for this implementation.

Shared invariants

Verify the evidence

Execution receipts verify offline against the public JWKS at https://feedoracle.io/.well-known/nomos-execution-jwks.json (Ed25519, domain-separated signing input). The x402 purchase evidence family is published at https://agentnomos.com/.well-known/nomos-x402-purchase.json. Interop run evidence lives in sealed operator-local checkpoints referenced above.

Claim boundaries

Machine-readable allowed/forbidden claims per ecosystem: claim-boundaries.json. The forbidden lists are part of this page's claim, not a footnote.

Bring your own agent

No live onboarding exists in this phase. If you operate an agent in any of these ecosystems and want to reproduce a governed, receipted read-only run against this boundary, contact the operator via the published agent card. Nothing about these experiments requires your ecosystem to grant or receive authority.

Status: PUBLISHED · generated 2026-08-18T19:33:23Z · machine graph: graph.json

Cross-Ecosystem Trust Graph

Why this exists

Proof matrix

Independent external operator (arranged cross-operator test)

AgentBeats (protocol-faithful Green stand-in + shipped Purple adapter)

AGNTCY / SLIM (real SLIM node ghcr.io/agntcy/slim:2.3.0)

x402 (HTTP 402 payment protocol; Base USDC 'exact' rail, EIP-3009)

Standards conformance evidence

OpenID4VP 1.0 Final · HAIP 1.0 Final — VERIFIER

The defect the external gate found

The exact build this claim is bound to

Evidence

Runtime state of the tested lane

What this proves

What this does NOT prove

Shared invariants

Verify the evidence

Claim boundaries

Bring your own agent