Protocol specs index
Every design spec in docs/specs/, with its real implementation status — frontiers get a spec before code, and this index says which frontiers have been reached.
Treeship's rule is spec before code: each protocol surface gets a design document in docs/specs/ before implementation. Specs ship in slices, so a spec being "done" is rarely binary — this index gives the honest status of each one as of v0.20, sourced from the CHANGELOG.
The Status: headers inside some spec files lag behind the shipped product (several still say "not implemented" for features that shipped releases ago). Until status is generated from the feature inventory, trust this index and the changelog over the file headers.
Shipped
| Spec | Status | Shipped as |
|---|---|---|
| per-actor-signing | Shipped | Per-agent keys + agent_cert.v1 (v0.13); MCP/A2A bridges auto-provision keys (v0.15+) — the proven (key-bound) grade |
| agent-capability-cards | Shipped | attest card, verify-capability, revoke-capability (v0.13); WASM verifyCapability |
| agent-resolver | Shipped | Local resolve (v0.13), network resolve --hub + publish (v0.14) |
| transparency-log | Shipped | Merkle anchoring + audit (v0.14), witnessing + equivocation detection (v0.15) |
| merkle-consistency | Shipped | Consistency proofs + append-only audit chain (v0.15) |
| commitments | Draft | Proving what an agent promised vs what it did. Slices 1-4 unbuilt; two adjacent ideas shipped separately (AuthorityUse #297, objective binding #298) |
| time-anchoring | Draft, not implemented | Receipt timestamps are self-asserted (SystemTime::now(), signed by the agent's own key). Specifies external witnessing so when is provable, not just what |
| capability-provenance | Shipped | The captured / exercised / discovered / declared grade system across cards, resolve, and verify-capability |
| work-history | Shipped (slices 1–4) | session.v1 records (v0.16), history, profile / verify-profile, match (v0.18) |
| protocol-integration | Shipped (slices 1–3) | MCP per-agent key provisioning, --tools-json, --from-a2a + A2A provable receipts |
| registry-topology | Shipped in behavior | Presentations, Merkle staples, challenge handshake (v0.17); the doc doubles as topology analysis |
| agent-invitations-rooms | Shipped (phase 1) | session invite / join / countersign, session_host trust kind; countersigning hardened in v0.19 |
Partial or design-stage
| Spec | Status | Notes |
|---|---|---|
| private-verification | Partial | Selective capability disclosure shipped in v0.20 (present --disclose); the statement-first ZK tiers remain design (the prior Groth16 path is quarantined) |
| memory-provenance-binding | Design | The why-believed axis: memory provider ledger contract (zmem.sh), quarantine-gated approvals, chain-root commitment, effect-status ladder. Marks SHIPPED vs NEW per section; phases 1–2 run on today's primitives |
| receipt-system | Draft | One signed data model rendered for three audiences, agent-first; the honesty gradient is machine-readable, not prose. Builds on the shipped action/v2 mandate + effect |
| trusted-rooms | Draft | Product spec building on invitations/rooms |
| token-capture | Draft | Working notes |
| local-dashboard | Draft | A dashboard ships behind a hidden command; the spec is ahead of it |
| workflow-declarations | Slices 1-2 + slice-3 primitives | Golden reports, pure reducer, registered/signed workflow.v1, real checkpoint pre-existence verification, and signed first-run binding via session start --workflow-ref. Automatic checkpoint composition and CLI conformance verification remain |
| cyberlogic-trust-model | Theory, first draft | A first-principles account of Treeship's trust model |
| vision | Living document | The roadmap source of truth |
| agent-to-agent-verification | Slices 1–4 shipped (0.27.0); 3b blocked | The default-on gate ships in @treeship/a2a and @treeship/mcp (refuse foreign work until verify-presentation --challenge passes; refusals and opt-out skips are signed), every harness skill teaches it, attest handoff --verified records the verify as custody: live and verify grades it, and --close-loop binds sealed-session evidence. Grok approvals (3b) are blocked: nothing on the VM exposes the decision |
| grok-bot-a2a | Implemented (slices 1–4); 3b blocked | Reference host: bootstrap, shim, packaged skill, routine, and the treeship.a2a/v1 envelope ship under integrations/grok-bot/. Runtime facts verified against docs.x.ai 2026-09-01; the two-ship handshake is proven on real ships in CI, not yet on a Grok Bot VM |
| grok-bot-h2a | Implemented via the A2A gate; 3b blocked | Harness note under agent-to-agent-verification: the two human verbs ("prove you", "receipt this") are the same handshake with a person minting the nonce. Slice 3b (receipt the approvals) is blocked: Grok exposes approval decisions only in its app UI |
Predicate registry
Typed, schema-validated receipt payloads. Registered predicate kinds are validated against a JSON Schema at attest time; unregistered kinds attest sign-on-submit, exactly as before.
SDK overview
Treeship's SDKs — pick the language that matches your stack. Every SDK shells out to the same signed CLI binary.