Receipt format and test results.

These measurements are from commodity laptop hardware. Performance on a different CPU or in a deployed gateway must be measured separately; these are primitive benchmarks, not end-to-end latency.

Scroll the table horizontally on small screens. Keyboard users can focus it and use the arrow keys.

Ed25519 signs in roughly 34 microseconds with one 64-byte allocation and verifies with none. ML-DSA-65 costs about six times as much to sign, though in these runs it verifies faster than Ed25519, and the hybrid mode runs both, so its cost is close to the sum. Timings are medians of ten runs recorded on 2026-05-24, and the memory columns come from the same runs. Until 2026-09-25 four memory figures here did not match those runs, which is why a hybrid row showed less memory than its ML-DSA-65 component.

Post-quantum keys and signatures are roughly 50 to 60 times larger than their classical counterparts. That size, not speed, is the practical cost of the migration, and it informs bundle storage and transport planning.

Hybrid sign-and-verify totals roughly 385 microseconds per governance decision. At a 100 ms cadence, that overhead sits at about 0.4% of the measurement window, so the cryptography is not the bottleneck at these cadences.

AGA is built from published primitives. The canonicalization, the Merkle tree and the composite encoding are AGA-defined and pinned by the conformance vectors; the composite is not the IETF LAMPS composite, which is still an Internet-Draft. The post-quantum primitive is checked against NIST known-answer vectors in the private reference runtime's test suite (evaluation access); in the public repository, the npm package's verifier and a Go verifier are shown to agree on all 28 v2 cases.

AGA uses established cryptographic constructions to record policy decisions about agent tool requests. The references below cover related approaches to signatures, transparency, timestamping and content provenance. Each comparison identifies what is verified, the trust assumptions and format compatibility.

• RFC 9162Experimental, December 2021

  Certificate Transparency Version 2.0

  Establishes. Append-only logs whose operator cannot hide an entry, proved to a client by Merkle inclusion and consistency proofs.

  Differs. The same proof shapes over a different tree. AGA's Merkle construction is vector-defined and uses no-prefix SHA-256, so it is not RFC 6962 or 9162 interoperable, and the conformance vectors on this page are what make the difference checkable rather than asserted.

• RFC 9943Standards Track, June 2026

  An Architecture for Trustworthy and Transparent Digital Supply Chains (SCITT)

  Establishes. Signed statements registered with a Transparency Service, which returns a receipt that a relying party can verify without contacting that service again.

  Differs. The closest published architecture to what a governance receipt is for, and the reason offline verification is a standards-track expectation rather than a differentiator. SCITT's receipts are COSE over a registered statement; AGA's are JSON over a decision rendered at a runtime boundary.

• RFC 3161Standards Track, August 2001

  Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)

  Establishes. Proof that a datum existed before a particular time, signed by a Time Stamping Authority over a hash of the datum rather than the datum itself.

  Differs. TSP uses a trusted timestamping authority. AGA records time supplied by its signing gateway; that is a claim by the issuer, not an attestation by an independent authority.

• RFC 8785Informational (Independent Submission), June 2020

  JSON Canonicalization Scheme (JCS)

  Establishes. One invariant byte sequence for a JSON value, so a signature computed by the producer verifies at the consumer regardless of formatting.

  Differs. AGA's canonicalization is JCS-lineage rather than JCS-conformant, so a JCS implementation may not agree with it. The published vectors define the bytes; that is the authority, not the RFC.

• in-toto Attestation Frameworkv1.2, read 2026-09-20

  Statement, predicate, envelope, bundle

  Establishes. Authenticated metadata bound to named software artifacts, in a layered format built for automated policy engines to consume.

  Differs. The subject is a build artifact; here it is a decision taken at runtime. The layering is close enough that an AGA receipt could be carried as a predicate, and that has not been implemented.

• C2PA 2.4Specifications 2.4, the current version, read 2026-09-25

  Content provenance, from the Coalition for Content Provenance and Authenticity

  Establishes. Provenance for media: a signed manifest of assertions travelling with the asset it describes, so a viewer can check where a file came from.

  Differs. Same shape of answer for a different subject. C2PA binds history to a piece of media; an aga-proxy receipt binds a decision to the hash of the policy it was checked against.

Statuses and dates were read from each primary page on 2026-09-20 (the C2PA row on 2026-09-25). An RFC’s status can change and two of these version independently of any RFC process, so recompute before quoting rather than citing this page.

The governance receipt schema, canonicalization rules, signing and chain-linking construction, the evidence-bundle format, and the steps a conformant verifier runs. This is the format the benchmarks above measure.

A snapshot of the receipt specification's conformance files is published here as one pinned file, built on 2026-07-31: the canonical vectors, both JSON Schemas, the construction document, the JavaScript reference verifier, its conformance harness, a README for implementers and the license (9 files, listed below).

The LICENSE was replaced on 2026-09-25 with the Apache-2.0 text, because the 2026-07-31 copy's appendix carried a stray sentence and three words of its terms differed from the Apache text; every other file is unchanged. Compared file by file with the aga-receipt-spec folder of the source repository at v3.6.0 (unchanged at v3.6.2), the two vector files and the harness are byte-identical. The reference verifier, both schemas and the construction document are earlier versions: the repository's construction document adds a normative section on public-key and signature acceptance (§1.1) that the zip's copy states in one line, and its schemas add a note that they are illustrative.

The harness runs 14 tests over 3 evidence bundles of 1, 3, 5 receipts. The zip's verifier also handles two inputs differently from the repository's verifier. It treats a --pubkey that is not 64 lowercase hex as no pin (it reports integrity only, with pinned false, and exits 0), where the repository's verifier and aga-verify refuse it with exit 2. And it reports FAILED for a bundle labelled with the hybrid profile, as aga-verify does, where the repository's verifier reports UNSUPPORTED_PROFILE. Pass the pin exactly as published, or check it with aga-verify. The file was re-pinned on 2026-09-25 for the LICENSE only; its other files remain the 2026-07-31 snapshot until a reviewed release re-pins it against the repository's current versions. This download and its zero-dependency verifier cover the classical Ed25519 profile: the canonical primitive vectors and the evidence-bundle vectors. The 61 cross-stack verdict cases run from the source repository, not from this zip.

The README at that tag still carries a PyPI advisory recomputed on 2026-09-18, which says the fix for aga-governance raising on deeply nested input is not on PyPI. That advisory is superseded: 0.3.1 and later carry the fix, 0.3.0 is yanked, and 0.2.6, which has the same defect, is yanked too, so pin aga-governance>=0.3.1.

The 28 post-quantum composite cases are cross-verified in the reference implementation (the npm package and the Go oracle), which carries the ML-DSA-65 dependency this zero-dependency verifier deliberately omits. The zip is pinned by a SHA-256 so you can confirm the file you hold is the exact one published. Recompute the hash after downloading and confirm it matches. If it differs, do not trust the file.

Run the corpus with node --test verify/conformance.test.mjs from the extracted directory: every genuine bundle must VERIFY and every negative mutation must FAIL. Verification runs without contacting the producer. The corpus is company-authored; audit the files yourself.