[Integration] Open Agent Trust Registry: lightweight runtime attestation for wallet operations

未关闭
  • 哪里不对？
#1,039 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
25/100
Issue 类型
功能
描述清晰度
需要澄清
活跃度
冷清
技术栈
typescript
领域
authentication, authorization, security

调研方向

该 issue 没有指明任何 AgentKit 文件或测试。先查看 README 的法律部分以及 #1015 和 #972 中的相关讨论，然后确定维护者是否希望进行 OATR 集成，以及哪项验证操作属于范围之内。完成的要求是达成一致的集成设计；该 issue 没有定义实现目标。

由索引模型根据 Issue 内容生成。

描述

I noticed the conversation around agent identity in #1015 (Observer Protocol) and #972 (MolTrust). Both are solid approaches but require on-chain infrastructure (ERC-8004 contracts, blockchain queries per verification).

For teams that want agent authorization verification without on-chain overhead, I've built the Open Agent Trust Registry (OATR), a lightweight alternative:

  • Ed25519 JWT attestations signed by the agent's runtime (agent-attestation+jwt media type)
  • Offline verification: download the registry manifest once, verify locally, no blockchain calls
  • Runtime-scoped authorization: attestations include scope and constraints fields specifying what the agent is allowed to do
  • MIT licensed, no tokens, no vendor lock-in

How it would work with AgentKit:

import { OpenAgentTrustRegistry } from '@open-agent-trust/registry';

// Load registry once (auto-refreshes every 15 minutes)
const registry = await OpenAgentTrustRegistry.load('https://your-mirror.com');

// Before executing a wallet operation:
const attestation = agent.getAttestation(); // JWT from the agent's runtime
const result = await registry.verifyToken(attestation, 'https://your-service.com');

if (result.valid && result.claims?.scope.includes('wallet:transfer')) {
  // result.issuer — verified runtime that issued this agent
  // result.claims.constraints — additional authorization bounds
  await wallet.transfer({ to, amount });
} else {
  throw new Error(`Agent not authorized: ${result.reason || 'scope_missing'}`);
}

The registry currently has 7 registered issuers with automated CI-verified registration (domain verification + cryptographic proof-of-key-ownership). The manifest is Ed25519-signed, so even if you use a third-party mirror, tampered copies are rejected by the SDK.

Why this matters for AgentKit specifically: The README's legal section notes that agent actions "are NOT acts of Coinbase." Runtime attestation gives developers a tool to verify agent authorization before those actions happen, reducing the liability gap. The attestation's user_pseudonym field provides a pairwise pseudonymous identifier, so authorization is traceable without exposing the user's real identity.

This is complementary to Observer Protocol (#1015). OATR handles "is this agent authorized by its runtime?" while Observer handles on-chain reputation. A defense-in-depth approach would use both.

Happy to submit a PR for an OATR verification action if there's interest.

主要语言
TypeScript
星标
1.4k
派生
900
30 天内没有已合并 PR

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

coinbase/agentkit 的其他 Issue

查看 coinbase/agentkit 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。