R+2 — Open Standard for Verifiable AI Agent Actions

R+2 is an open standard for provable records of what an AI agent did. Every action becomes a signed, hash-chained receipt that anyone can verify offline — no trust in the issuer required.

• Spec: spec/SPEC_R2_R3.md (normative, RFC-style)
• Conformance suite: conformance/ — 30 test vectors + a runner
• Reference verifier: verifier/ — portable JS (WebCrypto), runs anywhere

What a receipt is

A small JSON object: the agent's public key, the action (by reference — never raw private data), a timestamp, a pointer to the previous receipt's content-ID, a nonce, and an Ed25519 signature over the RFC 8785 (JCS) canonical form. Change one byte → the signature breaks. Reorder the chain → the pointers break. Receipts roll up into R+3 Merkle audit bundles for auditors.

Provenance only: R+2 records what happened, by reference. It never makes or asserts a decision, and it carries no raw PII by design.

Verify it yourself

npm install          # @noble/post-quantum (for the optional ML-DSA hybrid path)
node verifier/run.mjs

This runs the reference verifier against all 30 conformance vectors in two profiles:

• NODE (WebCrypto + ML-DSA): full pass, including the post-quantum vectors.
• EDGE (WebCrypto only, zero-dep): passes everything except the 2 PQ-positive vectors, which it fails closed (a verifier that can't check a signature must never say "valid").

You can also run the canonical conformance runner: node conformance/run.cjs.

The conformance bar (why this is a standard, not a doc)

30 vectors, most of them negatives — a verifier only conforms if it rejects every forgery: tampered payload, wrong key, broken/out-of-order/duplicate/empty chain, replayed nonce, unknown/reserved algorithm, bad post-quantum leg, hybrid mirror mismatch, duplicate JSON key, malformed number/base64, control characters, oversized payload, unknown top-level field. A lenient verifier that accepts a forged receipt is the one bug that matters — the suite is built to catch exactly that.

On-chain identity

Agent identity is anchored on Base mainnet (soulbound, source-verified): 0x0A0e824bcA178669C9453c5d72B7AE9120e1985d.

Status — honest

Operational prototype. Live reference services, real receipts, a verifier you can run. Not yet externally audited; the R+4 zero-knowledge layer is a reference implementation only, not production. We'll say "audited" and "production ZK" when those are true — not before.

Implementations

Reference: JavaScript/TypeScript, Python, and edge functions. Compiled-language verifiers (Rust, Go, Java, Swift, C#, WASM) are landing, each measured against these 30 vectors. To add one: implement the 5 steps in the spec and pass conformance/. PRs welcome.

License

Apache-2.0 (see LICENSE). See also CONTRIBUTING, SECURITY, and CODE_OF_CONDUCT.