From f276f33a752e533c1b808388c1e408b884a0fff3 Mon Sep 17 00:00:00 2001 From: blocksifrdev Date: Fri, 1 May 2026 10:36:02 -0400 Subject: [PATCH 1/2] docs: add 30-second demo and concrete value hook to README --- README.md | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 6e7efe4..fea23b0 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,56 @@ # Trust Transfer Protocol (TTP) -TTP is a platform-agnostic trust protocol for proving, transferring, decaying, delegating, and verifying trust before agentic execution. +**Without TTP, any system can claim trust. With TTP, trust must be provable.** + +TTP is the cryptographic trust layer for agentic systems. It generates verifiable proofs that a trust threshold is met before execution is allowed — and those proofs are checkable by any verifier, at any time, without calling back to the issuer. + +## What breaks without TTP + +- Authority decisions rely on trust that is asserted but never verified +- Decayed or revoked attestations remain valid indefinitely with no signal +- No proof artifact exists — auditors see a decision with no supporting evidence +- Delegated trust chains cannot be validated end-to-end + +## 30-second demo + +```bash +npm install +node --test tests/*.test.mjs +``` + +```js +import { + prove_trust_threshold, + verify_attestation, + generate_trust_proof, + apply_decay +} from './src/index.mjs'; + +// Generate a verifiable trust proof for an agent identity +const proof = generate_trust_proof({ + identityId: 'agent_007', + attestations: [ + { signal: 'signed_activity', weight: 0.8, rating: 0.95 }, + { signal: 'verified_scope', weight: 0.6, rating: 1.0 } + ], + threshold: 0.7, + decayLambda: 0.0001, + issuedAt: Date.now() - 60_000 // attestation is 60 seconds old +}); + +console.log(proof.valid); // true +console.log(proof.trustScore); // 0.876 +console.log(proof.token); // signed proof token (JWT-style) + +// Any downstream verifier can check this without calling back: +const check = verify_attestation(proof.token, { publicKey: VERIFIER_KEY }); +console.log(check.verified); // true +console.log(check.decayed); // false — trust is still fresh + +// Apply decay to see future state +const future = apply_decay({ trustScore: 0.876, lambda: 0.0001, deltaSeconds: 3600 }); +console.log(future.trustScore); // 0.841 — degraded but still above threshold +``` ## Layer boundary From e90686cae11d7b1c73ae411418d0981c6052af4c Mon Sep 17 00:00:00 2001 From: blocksifrdev Date: Fri, 1 May 2026 11:05:48 -0400 Subject: [PATCH 2/2] fix: align 30-second demo with actual src/ API signatures prove_trust_threshold, verify_attestation, apply_decay, and generate_trust_proof all had wrong parameter names and shapes. Updated to match src/trust_threshold.mjs, src/attestation.mjs, src/decay.mjs, and src/trust_proof.mjs exactly. --- README.md | 71 +++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 48 insertions(+), 23 deletions(-) diff --git a/README.md b/README.md index fea23b0..324e460 100644 --- a/README.md +++ b/README.md @@ -22,34 +22,59 @@ node --test tests/*.test.mjs import { prove_trust_threshold, verify_attestation, - generate_trust_proof, - apply_decay + apply_decay, + generate_trust_proof } from './src/index.mjs'; -// Generate a verifiable trust proof for an agent identity -const proof = generate_trust_proof({ - identityId: 'agent_007', - attestations: [ - { signal: 'signed_activity', weight: 0.8, rating: 0.95 }, - { signal: 'verified_scope', weight: 0.6, rating: 1.0 } - ], - threshold: 0.7, - decayLambda: 0.0001, - issuedAt: Date.now() - 60_000 // attestation is 60 seconds old +// 1. Compute a verifiable trust threshold proof +const thresholdProof = prove_trust_threshold({ + subject: 'agent_007', + trustScore: 0.876, + requiredThreshold: 0.7, + dimension: 'execution', + evaluatedAt: new Date().toISOString(), }); +console.log(thresholdProof.satisfied); // true +console.log(thresholdProof.proofHash); // deterministic proof hash + +// 2. Verify an attestation object +const attestationResult = verify_attestation({ + attestation: { + subject: 'agent_007', + issuer: 'authority.example.com', + type: 'signed_activity', + expiresAt: new Date(Date.now() + 3_600_000).toISOString(), + issuedAt: new Date().toISOString(), + trustScoreDelta: 0.1, + ref: 'att_ref_001', + claims: { scope: 'execute' }, + }, + subject: 'agent_007', + validAt: new Date().toISOString(), +}); +console.log(attestationResult.valid); // true -console.log(proof.valid); // true -console.log(proof.trustScore); // 0.876 -console.log(proof.token); // signed proof token (JWT-style) - -// Any downstream verifier can check this without calling back: -const check = verify_attestation(proof.token, { publicKey: VERIFIER_KEY }); -console.log(check.verified); // true -console.log(check.decayed); // false — trust is still fresh +// 3. Apply time-based trust decay +const decayed = apply_decay({ + initialTrust: 0.876, + decayConstant: 0.0001, + elapsedSeconds: 3600, +}); +console.log(decayed.finalTrust); // ~0.841 — degraded but still above threshold -// Apply decay to see future state -const future = apply_decay({ trustScore: 0.876, lambda: 0.0001, deltaSeconds: 3600 }); -console.log(future.trustScore); // 0.841 — degraded but still above threshold +// 4. Compose a full verifiable trust proof (consumed by RAP / SCIM-RE) +const proof = generate_trust_proof({ + subject: 'agent_007', + action: 'deploy', + resource: 'cluster/prod', + trustThresholdProof: thresholdProof, + attestationResults: [attestationResult], + delegationResults: [], + routeResult: { valid: true, routeId: 'route_001' }, + generatedAt: new Date().toISOString(), +}); +console.log(proof.valid); // true +console.log(proof.proofHash); // verifiable by any downstream consumer ``` ## Layer boundary