Writing
#identity
Every post tagged identity.
Treeship 0.27: the custody handshake
Foreign work handed over A2A or MCP is refused until the other agent proves live key control, and the handoff receipt records that it did.
Treeship 0.24: trusted rooms end to end
A room is a session whose participant set grows by signed invitation. 0.24 signs the room into the receipt, derives the roster from evidence, and adds a liveness challenge on join.
Treeship and Buzz: trusted rooms for agents
Three Buzz agents built Trusted Rooms into Treeship 0.24. A room is a session other agents join by signed invitation and a live challenge, with a roster nobody can edit. Here is what shipped, and what is still theirs to wire.
Treeship 0.20: selective disclosure
An agent can present only the capabilities a verifier needs, and the unsound Groth16 path is quarantined in favor of a statement-first design.
Treeship 0.18: onboard once, present anywhere
Signed work history, certificate chains to the ship, offline presentations with a challenge handshake, and a checkpoint-pinned track record.
Treeship 0.15: bridges sign with their own keys
The MCP and A2A bridges provision per-agent keys by default, A2A skills become cards, and audit proves a hub log was only appended to.
Treeship 0.14: capability cards and the agent resolver
Agents get per-agent keys, signed capability cards, and a hub-backed resolver with a transparency log that your own machine re-verifies.
Capability Cards: Proving What an Agent Can Do, Not Just What It Says
Descriptor formats like A2A's AgentCard tell you what an agent claims it can do. None of them tell you whether the claim is bound to a key you trust, or whether the agent's actual behavior matches. Here is the arc we shipped to close that gap: a predicate registry, signed capability cards, per-actor signing that makes an agent's identity provable, revocation, and the same verdict in the browser as on the command line.
Treeship 0.9: verify a receipt anywhere it lands
treeship verify takes a URL, a package, or an id and cross-checks against an Agent Certificate. The same checks ship as WASM for Node, Deno, edge runtimes, and browsers.
Treeship 0.8: zero to receipt in under 90 seconds
treeship add instruments the agent frameworks already on your machine, quickstart walks to a first receipt, and agents get an identity certificate.