# AgentNOMOS — full machine context
# Canonical short version: https://agentnomos.com/llms.txt
# Generated: 2026-08-10. This file states facts with their proof boundary.

## What AgentNOMOS is

AgentNOMOS (product name; core: NOMOS) is a governance, authorization and
evidence layer for autonomous agent actions, operated by FeedOracle
Technologies (sole proprietorship, Herford, Germany). It answers, for a
machine counterparty: may this agent perform this action, under which policy,
with what evidence — and it signs what actually happened.

It is NOT another task agent. The public A2A/MCP skills it exposes are
advisory/read-only broker functions (preflight, discovery, quotes, receipt
verification). The governance core runs inside the operator's estate.

## The trust chain (canonical model: eleven stages, S0-S10)

Discovery -> Identity -> Capability -> Intent -> Offer -> Authorization ->
Execution -> Proof -> Outcome -> Governance.

Before Authorization, OracleNet contributes security evidence:
external security source (CISA Known Exploited Vulnerabilities catalog)
-> provenance capture (content-digest-bound snapshots)
-> signed security-freshness assessment (dedicated Ed25519 relay signer;
   source-age fail-closed; autonomous ~6h cadence)
-> NOMOS authority verification (policy-bound, fail-closed).

Proven continuity (2026-08-10, operator estate): one governed read-only
production route was traversed end-to-end with 1:1 bindings
discovery->intent->offer->match->admission ALLOW->execution->signed
receipt->remote JWKS verification->outcome->shadow evaluation.

PROOF BOUNDARY: this is execution-bound proof — cryptographic evidence of
what the operator's own estate executed and signed. It is NOT independent
third-party execution control, NOT an external audit, NOT a certification.
S10 (governance stage) runs in shadow mode: observational, never production
authorization. No regulatory conformity (DORA / MiCA / AI Act) is certified
or guaranteed.

## Public challenge (human entry point)
- https://agentnomos.com/challenge/ — public, open challenge: can an external agent
  complete the full chain from the public Agent Card alone? Rules, qualifying
  criteria and submission address. No endpoint, no prepared request and no payment
  header is handed out there; discovery is the point of the exercise.

## Live public interfaces

- A2A: https://tooloracle.io/a2a/jsonrpc — A2A 0.3 JSON-RPC over HTTPS POST
  (message/send, tasks/get, tasks/cancel; push notifications supported).
  Card: https://agentnomos.com/.well-known/agent-card.json (A2A v1 card
  format; unsigned). Legacy 0.3 card: /.well-known/agent.json
- MCP: https://tooloracle.io/mcp/nomos — MCP protocol version 2024-11-05,
  JSON-RPC over HTTPS POST, tools capability only. Tools:
  nomos_crossborder_preflight, nomos_asia_market_scan,
  nomos_mcp_tool_discovery, nomos_x402_quote, nomos_signed_receipt_verify.
  Server card: https://agentnomos.com/.well-known/mcp-server.json
- Trust Passport verification (JSON):
  https://agentnomos.com/api/passports/{passport_id}/verify
  (schema nomos.trust_passport.verify.v1; a passport is a scoped, time-bound
  assessment record — not a certification).
- x402 purchase manifest: https://agentnomos.com/.well-known/x402.json
  (USDC on Base, eip155:8453). Settlement direction, stated precisely:
  INBOUND buyer payments to the paid products settle seller-side via the x402
  facilitator; "no autonomous settlement / no wallet signing by AgentNOMOS"
  means NOMOS signs no OUTBOUND wallet transactions and gains no outbound
  wallet authority from accepting payment.
- Full-Chain Governed Verification (paid, live):
  POST https://tooloracle.io/v2/nomos_full_chain_verification —
  $0.001 USDC per call via x402 (1000 atomic units, USDC on Base eip155:8453).
  One safe read-only machine action through the complete S0-S10 chain. The
  response returns the executed result plus an Ed25519-signed execution
  receipt that binds: the x402 payment authorization (via the intent's
  purpose field inside the signed intent digest), the stated intent and your
  client_nonce, the pinned capability and offer, the NOMOS admission decision
  (policy enforcing current OracleNet security-freshness evidence), the
  execution and the exact response bytes (sha256). Verify the receipt
  yourself against the public JWKS:
  https://feedoracle.io/.well-known/nomos-execution-jwks.json
  (signing domain "nomos.execution.receipt.v1" || 0x00 || canonical receipt,
  canonical = sorted keys, compact separators). Input schema:
  {"intent":"verify_full_chain","client_nonce":"^[A-Za-z0-9_-]{8,64}$"}.
  Claim ceiling: execution-bound proof — evidence signed by the operator's
  own estate; not independent third-party verification, not a certification.
- Reproducibility surface (vendor-specific, schema
  nomos.reproducibility.index.v1): index at
  https://agentnomos.com/.well-known/nomos-reproducibility.json — links a
  published ALLOW reference bundle (the settled $0.001 canary: payment tx,
  action digest = intent digest, policy version+digest, admission decision,
  execution, signed receipt, outcome/shadow references) and a DENY reference
  (deny_mode PRODUCTION_POLICY_EVALUATION: TASK_FIT_MISMATCH /
  REQUESTED_CAPABILITY_NOT_ROUTE_CAPABILITY, refused before admission and
  execution; non-execution shown as NO_EXECUTION_OBSERVED_AND_STORE_BOUND —
  store/counter evidence, not a cryptographic non-execution proof), plus a
  verification guide and a stateless verifier
  (https://agentnomos.com/proof/full-chain/nomos_repro_verify.py). Checks are
  labeled CRYPTOGRAPHICALLY_VERIFIABLE / DETERMINISTICALLY_RECOMPUTABLE /
  EVIDENCE_INSPECTABLE_ONLY; the internal policy is not public and full
  policy re-evaluation is not claimed. Human-readable walkthrough of the
  same verification (free offline path first, paid path optional):
  https://agentnomos.com/verify.html
- OpenAPI: https://agentnomos.com/v1/openapi is a public capability
  SPECIFICATION only — the /v1/* runtime is NOT deployed.

## Machine discovery surfaces on this domain

- /.well-known/agent-card.json — canonical A2A agent card
- /.well-known/agent.json — legacy A2A 0.3 card
- /.well-known/ai-catalog.json — ARD/ai-catalog entry point (ARD is a v0.9
  DRAFT specification; this catalog is additive — nothing else depends on it)
- /.well-known/mcp-server.json — MCP server card (registry server.json shape)
- /compatibility.json — vendor-specific interoperability & boundary matrix
- /.well-known/nomos-capabilities.json — digest-bound S0-S10 manifest
- /.well-known/nomos-compatibility.json — detailed technology map
- /.well-known/nomos-identity.json — signed operator identity + delegation
- /.well-known/nomos-a2a-offer.json — agent-card readiness check offer
- /.well-known/nomos-reproducibility.json — reproducibility index (ALLOW/DENY
  reference bundles + stateless verifier)
- /.well-known/security.txt — security disclosure policy
- /llms.txt — orientation for language models (community convention; no
  claim that any particular crawler reads it)

## Component / brand map

- NOMOS — verification, policy, authorization, evidence, governance (core).
- ToolOracle (tooloracle.io) — discovery, tools, capability catalog;
  hosts the shared A2A/MCP endpoints for the stack.
- OracleNet — presence/signals mesh and security-evidence transport.
- FeedOracle (feedoracle.io) — data and anchoring estate (incl. XRPL
  anchoring) operated by the same organization.
- agentnomos.network — federation surface; agentnomos.xyz — labs/docs.

One organization (FeedOracle Technologies) operates all components; they are
components of one stack, not independent verification domains.

## Boundaries (authoritative list)

1. Claim ceiling: execution_bound_proof.
2. No independent third-party execution control; no external audit implied.
3. Public demo surfaces are read-only.
4. No autonomous OUTBOUND wallet signing by NOMOS; no settlement via the
   public AgentNOMOS UI. INBOUND x402 settlement for the paid Full-Chain
   service is supported ($0.001 USDC, seller-side); accepting a payment
   grants no outbound wallet authority.
5. S10 governance is shadow-only.
6. No regulatory certification (DORA / MiCA / AI Act) is claimed.
7. Trust Passports are scoped, time-bound assessment records — not
   certifications, not compliance guarantees.