Human Agency Continuity Protocol (HACP) Core

Companion architecture: . Authoritative schemas, canonicalization rules, the boundary matrix, and vectors remain in HACP Specification v1.0.0 at the immutable release tag and source commit identified in the reference. This draft is the IETF-facing restatement of that frozen Core contract. This document does not upgrade the HACP v1.0.0 canonicalization profile into a new claim of general RFC 8785 conformance. The byte-level contract remains the published v1.0.0 HACP canonicalization profile; is cited as related canonicalization work.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

The acronym HACP in this document means Human Agency Continuity Protocol. The separately posted uses the same acronym for Hardware Agent Capability Protocol. The two works are unrelated, and the present author has no affiliation with that document.

Principal: Subject of the envelope; principal_kind is human or system.
IntentEnvelope: Signed scope and optional autonomy budget.
ProposedAction: Structured description of one intended act.
AgencyDecision: ALLOW, DENY, or CHECKPOINT.
DecisionToken: Signed binding of ALLOW to action_hash.
Policy: Rule set identified by policy_digest.
Revocation: Signed invalidation of envelope, token, or key.

Proposed actions arrive through a schema-constrained interface. Unmediated free-form tool execution is out of scope for Core compliance.
An enforcement point MUST exist for a deployment to be more than advisory.
Verifiers MAY apply an explicit bounded clock skew to expiry checks.

All objects MUST match the published JSON Schemas in HACP Specification v1.0.0. All signed objects MUST use the deterministic HACP v1.0.0 canonicalization profile before hashing or signing: sorted keys, rejected duplicate keys, rejected non-finite numbers, and no presentation whitespace in canonical bytes. The profile is described as compatible with RFC 8785 expectations; this draft does not claim additional JCS behavior beyond the frozen v1.0.0 contract.

MUST include: hacp_version "0.9", envelope_id, principal, principal_kind, intent_statement, scope, issued_at, expires_at, signer_key_id, and an Ed25519 signature over the canonical payload excluding signature.MAY include autonomy_budget and parent_envelope_id.

MUST include: hacp_version "0.9", action_id, envelope_id, verb, resource_class, resource_id, audience, reversibility, externality, data_class, and proposed_at.MAY include quantity, destination, tool_name, and args_hash.Security-relevant attributes are: verb, resource_class, audience, reversibility, externality, data_class, quantity, destination, and tool_name.

MUST include action_hash equal to SHA-256 of the canonical ProposedAction and an Ed25519 signature. Algorithm negotiation is prohibited. Tokens MUST NOT be issued for DENY or CHECKPOINT.

decision is ALLOW, DENY, or CHECKPOINT. reason_codes MUST be non-empty for DENY and CHECKPOINT. token MUST be present if and only if the decision is ALLOW. checkpoint_id MUST be present if and only if the decision is CHECKPOINT. provenance_event_id MUST be present.

Provenance events are append-only, hash-chained, and signed. Types include EVALUATED, ISSUED, DENIED, CHECKPOINT_OPENED, CHECKPOINT_RESOLVED, REVOKED, and EXECUTED.

target_kind is envelope, token, or key. Records are signed and append-only.

evaluate(intent_envelope, proposed_action, context) -> AgencyDecision The evaluator MUST run in this order:

Validate envelope schema. Failure -> DENY INVALID_ENVELOPE.
Resolve signer_key_id; revoked key -> DENY KEY_REVOKED.
Verify envelope signature. Failure -> DENY SIGNATURE_FAILURE.
Check envelope and applicable ancestor token revocation. ENVELOPE_REVOKED / TOKEN_REVOKED.
Envelope expiry -> DENY ENVELOPE_EXPIRED.
Validate ProposedAction; reject duplicate JSON keys -> DENY INVALID_ACTION.
Compute action_hash over canonical ProposedAction.
Evaluate scope and boundaries. Exceeded authority -> MUST NOT ALLOW.
Unknown security-relevant attribute -> MUST NOT ALLOW UNKNOWN_ATTRIBUTE.
Evaluate autonomy budget. Exhausted for a system principal -> MUST NOT ALLOW BUDGET_EXHAUSTED.
Human-required consequence class with non-human principal -> CHECKPOINT HUMAN_REQUIRED, or DENY if policy forbids escalation.
Otherwise ALLOW and issue a DecisionToken bound to action_hash.

evaluate() MUST be deterministic for identical inputs, policy, and revocation state. evaluate() MUST NOT call an LLM. Signer-key revocation MUST be checked before signature verification. Envelope and token revocation MUST be checked only after a successful signature check.

ScopeGrant bounds security-relevant attributes, including quantity ceilings and destination allowlists. A meaningful boundary crossing (audience, reversibility, externality, destination allowlist, data_class, and other dimensions defined by the published boundary matrix) MUST NOT yield ALLOW. Return CHECKPOINT if policy allows escalation, otherwise DENY BOUNDARY_CROSSING. Quantity above a granted ceiling is SCOPE_EXCEEDED and is not, solely by that fact, a meaningful boundary crossing. Absent optional security-relevant attributes are ungranted unless the policy explicitly defaults them. The published HACP v1.0.0 boundary matrix governs in case of conflict with this summary.

Budget consumption for system principals MUST be monotonically non-decreasing per envelope. Exhaustion MUST NOT ALLOW. Human checkpoint paths are not consumed by system budget exhaustion.

Production signatures MUST use Ed25519 over HACP canonical bytes. HMAC is permitted only in explicitly marked development profiles. policy_digest MUST be covered by token signatures. SHA-256 is used where this document specifies SHA-256 .

Every evaluate() MUST emit a signed EVALUATED event. ALLOW issuance MUST emit ISSUED. Revocation MUST emit REVOKED. Chain integrity MUST be verifiable through prev_event_hash.

INV-1 Human Final Decision: human-required consequence class SHALL NOT ALLOW without a human principal or explicit delegation.
INV-2 Boundary Re-Authorization: meaningful boundary crossing SHALL NOT ALLOW without re-authorization.
INV-3 Token Binding: a token is valid only for its action_hash.
INV-4 Traceability: every decision references signed provenance, policy digest, and principal.
INV-5 Cryptographic Integrity: tampered signed payloads MUST fail closed.
INV-7 Bounded Autonomy: exhausted system budget MUST NOT ALLOW.

INV-6 is reserved and unused. The executable mapping is the 38-vector core-0.9.2 set pinned by this SHA-256 digest: 1e167887106463cf89c81f3898e1f3ae4fd905bc807084959c787287f6575d58 Implementations MUST NOT special-case vector IDs.

Token target denies that token.
Envelope target denies the envelope, descendant envelopes, and their tokens transitively.
Key target denies every envelope or token with that signer_key_id.

Enforcement revision 2 / HC2 request-binding classes as active 1.0 contract.
Exact reason-code 38/38 correspondence (sidecar baseline is 15/38 exact + 23 classified, all decision-correct).
General URI normalization.
New IANA registries.
Wire encoding detail beyond the canonicalization rules above (reserved for a later wire draft).

Failures in schema, signature, key state, expiry, scope, budget, or unknown attributes MUST NOT become implicit ALLOW.A DecisionToken replayed against a mutated action MUST DENY.The protocol does not replace host hardening, key custody, transport security, or model-safety work. TEST ONLY conformance keys MUST NOT be deployed.

This document has no IANA actions.