Every check runs on your machine.
AINRA gives every AI agent a passport it can prove: who it is, who stands behind it, what it may do, and whether it is still trusted — verifiable offline, fail-closed, with the root switched off. These docs take you from zero to a verified passport in about a minute per page.
Get the reference
Clone the public repository. Every gate passes from a cold clone — that is the project's standing promise, re-proven by CI nightly and by the board in docs/releases/.
$ git clone https://github.com/JacobJandon/ainra && cd ainra $ make verify # the real verifier: a valid + a revoked credential, named reasons $ make issue-first # a local registrar + your first issued, verified passport
Or install the verifier from a registry. Published with attestations that bind each artifact to the workflow that built it, so you can check its provenance before you trust it — which is the point of a verifier.
$ npm i @ainra/sdk # Sigstore provenance $ npm audit signatures # proves which workflow built it $ pip install ainra # PEP 740 attestations, published token-free
Prefer no checkout? Download the reference CLI (zip) — zero dependencies, runs on any platform with just node. The releases page carries the signed artifacts (a Linux x86_64 binary, the CC0 vector corpus, provenance and SBOM) for anyone verifying the release itself.
Verify in five lines
Point at a root-signed directory, verify the bundle, gate on the verdict. VALID proceeds; anything else returns a named reason — revoked, stale_status, alg_downgrade, … The decision stays yours.
import { Verifier } from "@ainra/sdk"; const v = await Verifier.fromDirectory(dir); const verdict = v.verify(bundle, now); // → { status: "VALID" } — or a named reason
from ainra import Verifier v = Verifier.from_directory(dir, root_ed, root_slh) verdict = v.verify(bundle, now) # → verdict.valid is True — or verdict.reason
Gate a route
The middleware turns a verdict into an HTTP decision: invalid agents receive 403 plus an x-ainra-reason header, fail-closed.
import { ainraGate, Verifier } from "@ainra/middleware"; app.use("/agent", ainraGate(verifier));
Prove the request, not just the agent
A valid passport says an agent exists. It says nothing about this request, and a header on its own can be copied and replayed. So a running copy signs each request with its own short-lived key (RFC 9421), and the gate binds the passport to one method, one host and one path, inside five minutes.
- Send the passport once.
POST /.well-known/ainra-presentationwith the bundle. The gate checks it in full and answers201with a digest,sha-256=:…:. It keeps only bundles that verify. - Then sign each request. It carries the digest in
x-ainra-passport, a fresh proof of possession inx-ainra-pop, and thesignature-input/signaturepair, which covers the method, host, path, body digest and that header. That comes to about 11 KB of headers, well under common server limits. The whole passport in one header would not fit. - The gate says why when it refuses.
presentation_unsigned·presentation_sig_invalid(moved, altered or wrong key) ·presentation_stale·presentation_replayed· and428 presentation_unknownif it doesn't hold the bundle yet, meaning "send it, then retry".
const store = createPresentationStore(); app.post(PRIME_PATH, express.json({ limit: "256kb" }), ainraPrime(verifier, { store })); app.use("/agent", ainraGate(verifier, { store, requireSignature: true, seenNonce }));
At the edge. @ainra/edge is the same gate for Workers, Deno and Node's fetch. It's a Request → decision function running ainra-core itself, compiled to WebAssembly. It trusts only a directory signed by both ceremony roots, and it applies its own freshness policy, not the presenter's. It lives in the repository (packages/edge) and isn't on npm yet.
const gate = await createAinraEdgeGate({ directory, roots, audience: "https://shop.example" }); const g = await gate(request); return g.allow ? fetch(request) : g.response;
Beside a signature agent. If an operator already signs its agents' requests as a signature agent (the Web Bot Auth profile of RFC 9421, keys in a directory at its origin), keep that signature. The running copy adds its own beside it, and each verifier reads only its own label. That profile defines no revocation: a withdrawn key keeps verifying until a verifier fetches the directory again. AINRA revokes the passport itself, and a gate refuses it once its status snapshot is fresh, within the gate's freshness class (five minutes by default). How to run both.
How it's checked: the request profile is stated once in ainra-core, and three implementations (Rust, TypeScript, Python) must agree on its conformance vectors. An independent open-source signature-agent verifier checks the vectors that carry both signatures. make identity-e2e, make edge-e2e and make signature-agent-e2e run the whole journey against a live registrar.
The CLI lifecycle
The whole lifecycle, locally, no server — a persistent registrar in a directory you own.
$ ainra init ./reg registrar-07 $ ainra issue ./reg --operator acme --lineage invoicing --version 1.0.0 --tier L2 $ ainra verify ./reg ainra:registrar-07:acme:invoicing@1.0.0 VALID $ ainra revoke ./reg ainra:registrar-07:acme:invoicing@1.0.0 --reason key-compromise $ ainra verify ./reg ainra:registrar-07:acme:invoicing@1.0.0 INVALID · revoked
Renewal is first-class: ainra renew reissues with logged continuity (prev_leaf) — identity is eternal, credentials are bounded.
For agents
An agent onboards itself from the machine-readable map — no account, no human in the loop:
/llms.txt— the capability map (what exists, what to fetch, honest status)./skills.md— deterministic onboarding steps, executable exactly as written (CI replays them)./.well-known/skills/index.json— installable skill index:npx skills add …
Prove your own implementation
AINRA certifies no one. The corpus and the runner are published; you point the runner at your implementation over a documented stdin/stdout contract, sign your own result, and anyone re-runs it to check. We don't certify implementations — we make certification unnecessary.
$ make conformance # the 3 in-repo impls, clean, same corpus hash $ node tools/conformance/run.mjs --adapter ./my-verifier.sh $ node tools/conformance/attest.mjs # sign your result with YOUR key
The doctrine and roles: docs/conformance/PROGRAMME.md · the wire contract: tools/conformance/CONTRACT.md. A deliberately broken implementation is caught with named divergences — a conformance tool that cannot fail is theatre.
Verify a release
Releases are signed with an offline SSH key and — the stronger check — reproducible: rebuild the corpus byte-for-byte from the tag, no key needed.
$ ssh-keygen -Y verify -f allowed_signers -I release@ainra.org \
-n file -s SHA256SUMS.sig < SHA256SUMS
Good "file" signature
$ sha256sum -c SHA256SUMS
$ make repro # byte-exact rebuild — trust the bytes, not usThe four-step guide with real pasted output lives in RELEASE-VERIFY.md.
Charter & the four rules
The whole standard is four sentences made mechanical:
- Birth — no identity without a verified, accountable entity behind it. Ever.
- Life — anyone can verify any passport, offline; verification never reports to anyone.
- Death — only the issuer, the principal, or due process can revoke; every revocation is public, appealable, and honored everywhere in under a minute.
- Neutrality — the root records facts. Never money, personal data, reputation, or judgment.
They distill six charter prohibitions, amendable only by supermajority in every member constituency after twelve months of public comment: issues no passports · computes no scores · processes no payments · holds no personal data · never gates L0 existence · features no registrar, ever.
Root keys are threshold-held (5-of-9) across five-plus jurisdictions and rotated in public ceremonies; independent witnesses cosign every log checkpoint; the whole root is forkable from public data — the right to leave is what keeps it worth staying with.
Why the root must be one
The problem. Agent IDs are multiplying, each an island — an agent verified in one scheme is a stranger in every other, so trust does not transfer.
The proposal. AINRA is that connective root for agent identity. Existing and future issuers stay independent — their technology, their customers, their business — and accredit into one rulebook: publish issuance to a transparency log, publish revocation that fails closed, chain to the root's keys. From that moment one verification path covers all of them, and an agent's standing earned under one issuer is legible under every other.
Why neutral and non-profit is load-bearing, not branding. No issuer joins a competitor's root — that is why none of the islands can unite the others. Only a body that issues nothing, scores nothing, sells nothing, and competes with no one can anchor rivals; the charter enforces this in code, and the whole design is forkable so the ecosystem can leave if the root ever goes wrong. Uniting the issuers is the entire mission: one root, many issuers, every check local.
The drawn architecture — the root, the registrar ring, the agents, the verifiers — lives on the landing page.
The plan
A member-governed, non-profit federation: issuers, attestors, verifiers, resolution & data providers, witnesses, and public-interest members each form a constituency in the assembly, which elects the board under charter constraints. Custodians and witnesses stand structurally apart from both.
Genesis, in order:
- Ceremony rehearsed — DONE · FROST 5-of-9 across nine isolated processes, reproducible transcript (
make ceremony-rehearsal-multi). - Recorded public ceremony — PENDING · sealed hardware on camera, air-gapped share generation, scripted T−30d → T+14d with a public abort playbook.
- Independent verifiers — RECRUITING · three or more strangers verify fresh, un-precomputable challenges on their own machines and sign what they saw.
- The soak — PENDING · fourteen days, three regions, signed reports; the founding declaration refuses to render without the evidence.
Economics: capped per-lineage-year fees at cents scale, flat accreditation, grants. Verification free, forever; at scale the cap falls toward archival cost.
The road: Prove (now — the implementations agree, a stranger's clone passes every gate) → Anchor (charter ratified, first public ceremony, live registrars) → Endure (pre-decided responses to pressure) → Disappear — which means become unnecessary, not vanish: a relay race, not a solo marathon, ending in verification as boring as the clock, plus a managed-migration clause (if a legitimately adopted successor emerges, the root's final duty is an orderly migration into it).
FAQ
Is AINRA a company? No — an international, member-governed, non-profit federation. It never competes with members, holds no equity, and is charter-bound out of issuing, scoring, payments, and personal data.
Why should anyone trust you? You shouldn't have to. The spec is public, the code runs in sixty seconds, keys will be split across jurisdictions, every action lands in witness-cosigned logs — and the standard is forkable, so if we go wrong, the ecosystem leaves with everything. Verify, don't trust applies to us first.
Nobody's on it yet — why join first? The alternative is pairwise trust-wiring at N² cost, forever. Verification is useful on day one with zero counterparties, and the founding table writes the rules everyone else inherits. The honest counter — LOGS SEALED: 0 — is the point: the first seats are authorship, not sponsorship.
What does it cost? Verifying: nothing, ever. Issuing: capped cents-scale per lineage-year through independent registrars.
The Standard — v5.1, in full
The complete public specification. Implementable by anyone — no license, fee, or permission. Canonical file: AINRA_I_The_Standard.md.
AINRA — THE STANDARD
Agent Identity & Naming Registry Authority · Master Specification v5.1 · July 2026
Document I of III. Public. Supersedes and consolidates all prior specification versions (v1–v5.0) and the one-pager. This document names no third party anywhere; every example uses placeholder registrars by constitutional rule. Category: the identity layer for autonomous AI. Canonical description: "The neutral root of AI agent identity." v5.1 changes: root cryptography reissued for assumption diversity (Part I, key architecture); delegated online signing named honestly; no semantic changes elsewhere.
PART 0 — PRINCIPLES (NORMATIVE, CONSTITUTIONAL)
0.1 The problem, stated once. The majority of internet traffic is automated; machine identities outnumber humans roughly 80:1 inside enterprises; most organizations cannot see their agent-to-agent traffic; and every major platform, network, and directory has shipped its own agent identity that no other system can verify. A legitimate agent cannot prove itself away from home; a malicious one banned in one place walks into the next; nothing stops a compromised fleet everywhere at once; and past one hop of delegation, no deployed protocol proves who authorized what. The missing piece is a root — the one component nobody can build alone.
0.2 The solution, stated once. One open standard and one deliberately thin non-profit root that does four jobs and is constitutionally barred from all others: run the namespace, accredit independent registrars, anchor the root of trust, and operate the revocation fabric and transparency logs. Everything else — issuing, verifying evidence, serving customers, judging behavior, making decisions — lives at the edge, with registrars, operators, principals, and verifiers.
0.3 The Separation Principle. The root must never issue; the issuer must never be privileged; the explorer must never judge. Trust in a center is proportional to how little the center does. Whatever can live at the edge, does; the one thing that cannot during bootstrap (issuance) is pushed into a firewalled, sunset-reviewed independent organization the root can never own, fund, staff, or instruct.
0.4 The Neutrality Gradient. Declared honestly, in three grades. AINRA is absolutely neutral — no policy, interface, default, ranking, or example features any real registrar; all illustrations use placeholders (registrar-07, chain-open-01). The canonical explorer is neutral by construction — read-only over public data, mechanically ordered, proof-attached, structurally incapable of editorializing. The first registrar is arm's-length, honestly not neutral — it is an issuer with prices and customers; its obligations appear in Part IV.
0.5 The Registry–Registrar Model. The root operates the authoritative registry; accredited registrars are the sole retail interface. (i) Operators obtain passports only from registrars — the root never transacts with an operator. (ii) Every registrar issuance is atomically a registration in the root registry: authoritative name record and sealed log entry at the root; customer relationship, verification evidence, and service at the registrar. (iii) Lineages transfer between registrars with history and log continuity intact — names belong to the namespace, never to a registrar. (iv) Registrars operate under one identical contract and one uniform, published, capped fee schedule. (v) The passport document carries registry-record data only; operational state (mandate balances, running instances, local credentials) lives at the edge, outside the document and outside the root.
0.6 The Open-Standard Principle. The specification is freely implementable — no license, fee, or permission. Reference implementations are open-source under permissive licenses (Apache-2.0). Any current player — payment network, enterprise directory, edge provider, chain, identity vendor — may adopt, implement, mirror, or fork it today. The root stewards the standard; it does not own it; the standard survives the root.
0.7 The Scale Invariant (I1). Root load is independent of the number of agents. The root talks only to registrars and publishes only keys, rules, status data, and logs; registrars handle lineages and versions; running instances use short-lived credentials minted locally under the passport; verification happens at the edge against cached material. A trillion agents leave the center's load flat.
0.8 Login → decision. The historical trust boundary was the login: one human, one prompt, one yes. Agents act continuously at machine volume, so the boundary moves to the decision — every action, evaluated in context. Division of labor: the root standardizes every input to the decision (identity, chain, authority, ceilings, live status — cached, offline-capable, freshness-classed); the decision itself always belongs to the verifier. The root never decides.
PART I — THE ROOT (AINRA)
1. The Charter — six prohibitions
Amendable only by supermajority within every constituency after twelve months of public comment:
1. Issues no passports. Accreditation only; never retail.
2. Computes no scores. Facts and proofs; judgment belongs to verifiers. Others may build scoring atop the public record — the root never does.
3. Processes no payments. Fees are invoiced flat charges, never per-transaction, never in-band.
4. Holds no personal data. Human backing is proven in zero-knowledge; PII never transits or rests at the root.
5. Never gates L0 existence. Permissionless registration is a guaranteed right; consequence is earned tier by tier.
6. Features no registrar, ever. No policy, interface, default, ranking, or published example names, promotes, pre-selects, or visually features any registrar — including any affiliated one.
Article S — Structural Separation. S1: the root holds no equity in, and receives no revenue share from, any registrar or explorer. S2: no shared staff, systems, offices, or credentials with any registrar. S3: any affiliated registrar receives zero non-public access of any kind. S4: board interlocks target zero and are published. S5: the affiliated registrar is sunset-reviewed on a fixed public cadence until indistinguishable from competitors. S6: all inter-body dealings are published (Part IV interface table). S7: example neutrality — all root-published examples, schemas, demos, documentation, and interface defaults use neutral placeholder registrars; the affiliated registrar may never appear in them; canonical-explorer registrar listings are ordered mechanically (time, name, or volume — labeled), never curated.
2. Namespace
Grammar: ainra:{registrar}:{operator}:{lineage}@{version} — lowercase alphanumerics and hyphens; version is semver (1–3 numeric fields). Every ainra: name is a DID underneath (method did:ainra), resolvable by standard tooling. Resolution returns the signed passport document; names point, registrars serve. The lineage is the permanent identity — soulbound, non-transferable, the anchor of all history; a genuine ownership transfer is a logged event that resets assurance evidence while preserving the historical record. The version is re-certified on every material change (model, permissions, operator), so old trust never silently covers new behavior.
3. Accreditation
The root publishes one rulebook and one contract, identical for all registrar classes: licensed issuers (regulated-market lane, L3–L4), enterprise directories (mint a passport when an internal agent crosses the boundary; internal actor chains feed the authority chain), and permissionless chains (on-chain registries whose entries auto-map to L0–L1; transfers logged, assurance reset). Obligations: uniform verification standards per tier; evidence retention at the registrar (never at the root); mandatory funding of one transparency monitor watching a competitor; annual audit; breach disclosure ≤72h. Enforcement ladder: finding → remediation window → suspension of new issuance → wholesale de-accreditation (registrar certificate revoked; its passports enter a grace window for supervised transfer to other registrars — customers are never punished for their registrar's sins). Fees: capped, cents-scale per lineage-year plus flat accreditation; the cap may only fall as volume grows (Part V economics).
4. Root of trust
Root keys are threshold keys (5-of-9) held by custodians spanning ≥5 jurisdictions and ≥3 institution types (civil-society, academic, industry, public-interest technical, archival), used only in public, recorded key ceremonies, with a quorum-activated standby in escrow. The classical root is a FROST threshold Ed25519 key (RFC 9591) — it emits standard signatures, so any stock verifier validates the root without special code. Its post-quantum counterpart is deliberately hash-based (SLH-DSA-SHA2-128s, FIPS 205) rather than lattice-based: agent and registrar keys are lattice-signed (hybrid Ed25519 + ML-DSA-65, both signatures mandatory), and the anchor that must survive to re-certify successor algorithms must not share the assumption it would be recovering from. Sub-minute freshness signals are signed by delegated online keys — quarterly-certified by the root, scope-limited to freshness duties only, so the true root stays offline and any compromise is bounded to one quarter. Published rotation and algorithm-migration procedures govern all of it. Verifiers cache the root set and registrar certificates; every verification is local and offline-capable in milliseconds.
5. The passport
An SD-JWT verifiable credential; selective disclosure by field. Canonical schema (illustrative values; placeholder registrar by S7):
Registry-record fields only; mandates and fleets live outside the document (0.5.v). Presentation rides HTTP message signatures: the request signature names the passport key, so the credential travels inside ordinary web traffic. Instance credentials: running copies carry minutes-scale credentials minted locally under the passport, bound to the connection (mTLS) — a stolen token expires before it matters (I1).
6. Authority classes
Every passport declares who stands behind it; delegation may only narrow; chains stay provable to their anchor at any depth from the credential alone.
- A1 — Human-delegated. A verified person, proven via zero-knowledge commitment: accountability exists while privacy stays intact. Backed by a signed consent mandate.
- A2 — Organization-delegated. A verified legal entity; the mandate is an organizational authorization resolving to responsible officers via the registrar of record.
- A3 — Agent-delegated. Another passported agent is principal. Every hop dual-signed (delegator + delegatee), scopes strictly narrowing, depth capped (default 3), the full chain verifiable to its ultimate A1/A2 anchor — closing the field's known multi-hop gap.
- A4 — Autonomous. Self-directed, declared truthfully. Requirements: reachable governance endpoint; dead-man renewal timer; and, to rise above the lowest tiers, an accountability substitute — bond, insurance, or steward of record. Verifiers choose how much A4 to accept; honest existence is always guaranteed.
Consent mandates (the authority instrument): grant → attenuate → exercise → review → revoke. A signed permission slip from the principal — scopes, time limits, spend ceilings, revocation address — which downstream delegation can only narrow. Revoking a mandate recalls its entire subtree, everywhere, within the revocation SLO. The trust graph — the log-derivable map of delegation edges (never behavior) — gives the ecosystem structure with privacy intact; expired-mandate orphans surface globally.
7. Assurance tiers
| Tier | Requirements | Typical consequence granted by verifiers |
|---|---|---|
| L0 Declared | Valid keypair + logged registration + revocation endpoint. Permissionless by charter. | Sandbox, attributed crawl |
| L1 Anchored | + verified domain control or established wallet history | Rate-limited APIs, low-value micropayments |
| L2 Operated | + KYB-verified operator, declared model lineage, soulbound lineage | Standard commerce, B2B data exchange |
| L3 Backed | + zero-knowledge principal + liability-insurance attestation | Consumer-scale payments, contract execution |
| L4 Regulated | + sector license, independent audit, third-party work validation | High-value autonomy, critical infrastructure |
The root labels; every verifier sets its own floor. Five levels; you set the floor.
8. Verification protocol (normative sequence)
1 Present — signed request names the passport key. 2 Chain — passport → registrar cert → root set; plus authority chain to anchor; cached keys, milliseconds, offline-capable. 3 Status — fresh revocation proof (freshness class by tier: L3–L4 require proofs ≤5 min; high-assurance actions demand a fresh proof so a blocked feed fails closed) + log-inclusion proof. 4 Decide — verifier policy: tier floor, accepted classes, required scopes, fail mode. Reference CLI exit codes: 0 valid / 1 invalid; --json for machines.
9. Revocation fabric & transparency logs
One compressed, signed status structure every verifier mirrors; push channels propagate deltas with a global SLO of <60 seconds issue-to-rejection. Revocation scopes: a version (kills its entire fleet), a lineage, a mandate subtree, or a registrar (wholesale). Every event — registration, issuance, re-certification, transfer, mandate grant/revoke, accreditation action — is sealed before validity in append-only, hash-chained Merkle logs whose checkpoints are cosigned by independent witnesses; anyone may run a monitor; registrars must fund one watching a competitor; the logs are mirrorable and the whole system forkable, so history cannot be rewritten and the root cannot quietly lie. "Logged before valid" is load-bearing: unlogged is invalid.
Verifying a running copy
An agent has one passport. Each running copy of it — a container, a worker — carries an instance credential instead of the lineage’s key: minted outside the container by the passport’s control key, narrowed to fewer capabilities, valid for at most an hour, addressed to one audience, and bound to a key only that copy holds. Before this existed, whoever read a container held the lineage’s key and a presentation that worked anywhere for a year.
Integrating changes one thing: tell the verifier who you are. The audience is never read from the presentation, and an empty audience refuses every instance credential — a service that has not said who it is cannot be the intended recipient of anything. Four refusal reasons belong to this layer and never collapse into expired; a revoked passport still reports revoked, because the lineage failed rather than the copy. Runnable end to end: node examples/instance-deployment.mjs.
bash kits/witness/be-a-witness.sh) and needs no accreditation.10. Threat model (condensed register)
Root-key compromise → threshold + standby + ceremony-only use. Registrar fraud → audits, monitors, wholesale de-accreditation with customer grace. Impersonation → key-in-signature binding + mTLS instance creds. Replay/theft → minutes-TTL local credentials. Delegation laundering → dual-signed narrowing chains, depth caps. Sybil floods → L0 grants existence, not consequence. Revocation suppression → freshness classes fail closed. Log fork/rewrite → witness cosigning, open monitors. Jurisdictional coercion → custodian spread; namespace censorship is structurally impossible below quorum. Privacy attack → no PII at root; zk principals; selective disclosure; graph shows structure, never behavior. Capture of governance → constituency supermajorities, 12-month comment, public everything. Price abuse → charter fee caps that only fall. Explorer manipulation → independence + client-side verification. Metaphor-imported failure modes (registrar race-to-bottom, registry price creep, public-record privacy conflict) → uniform tier standards + falling caps + zero-PII design, respectively. Successor standard emerges → managed-migration clause (Part V.4). Root institutional failure → fork-readiness drills; the standard outlives the institution.
PART II — THE PUBLIC RECORD & EXPLORERS
The record — every passport, registrar, checkpoint, revocation — is public, witness-cosigned, and shows what exists, never what agents did. Independent explorers render it; the root operates no explorer and funds none. Explorer requirements (any implementation claiming conformance): facts, never scores; no rankings, ads, or promotion; mechanical ordering, labeled; structurally identical registrar pages; every fact one click from its cryptographic proof; client-side verification available ("don't trust, verify"); open-source and mirrorable. Search grammar: free text plus typed prefixes name: lineage: operator: registrar: log: witness: tier: class:, grouped by object type, ordered by recency, zero personalization. Freshness SLOs: log-to-page <30 s; revocation-to-page <5 s. Root→explorer interface: public endpoints only, identical to what any mirror receives — no funding, staffing, instruction, emphasis, or private channel.
PART III — INTEROP PROFILES (GENERIC)
How existing layers plug in without replacement — keep what you built, gain everyone else: payment networks keep tokens and checkout; key-directory lookups resolve through the root; gain cross-network recognition and the shared switch. Runtime identity/control planes keep gateways and per-action policy; consume the record as the standardized input to every decision; gain cross-boundary trust. Edge/bot defense keeps signature checks; mirrors the root directory behind them; gains operator/tier/status behind every signature — a welcome lane. Enterprise identity keeps internal directories; mints a passport at boundary-crossing; internal chains feed the authority chain. On-chain registries keep permissionless registration; entries auto-map to L0–L1; transfers logged; gain off-chain acceptance. Merchants/APIs: one verify middleware plus a tier floor — an afternoon. Insurers/auditors read passports, chains, logs — attributable history, the raw material for pricing agents. Regulators recognize tiers and classes and read the same public logs as anyone — oversight without operating anything or holding anyone's data.
PART IV — THE FIRST REGISTRAR (ARM'S-LENGTH)
Meridian (named here as required disclosure — never in examples, defaults, or interfaces) exists to prove the flows and seed the market, under posture declared honestly: an issuer, therefore not neutral, therefore kept outside, visible, and equal-footed. Obligations: (i) identical public rules, fees, audits, timelines as every registrar; (ii) zero non-public access; (iii) never appears in root examples, defaults, or interfaces (Charter 6, S7); permitted distinctions are "first" and "reference," both expiring; its materials may carry the standard attribution mark — "Built on the AINRA open standard" — available to every registrar identically, direction strictly one-way (registrars reference the standard; the root displays no one's mark); (iv) conflicts register, interlocks (target zero), and inter-body payments published annually; (v) open-sources its full registrar stack ("registrar-in-a-box") to seed competitors; (vi) recurring sunset review until ordinary — continue as one-of-many, spin fully out, or wind down. Scope: L1–L3 only; the licensed L4 lane belongs to regulated registrars. Mechanically it is a registrar in the full Part 0.5 sense: every issuance registers into the root; every customer may leave with history intact.
Inter-body interface table (all published): Root→registrars: rulebook, contract, fees, audits — identical for all; never leads, capital, or preview access. Root→explorers: public endpoints only. Registrar↔explorer: none beyond public data. Any exception: none permitted; exceptions are the scandal.
PART V — GOVERNANCE, ECONOMICS, ROADMAP
1. Bodies. AINRA is constituted as an international, member-governed, non-profit federation : legitimacy flows from the members, the rules bind only those who join, and the federation itself never competes with them. Membership classes span the whole ecosystem: issuer members (accredited registrars of every class), attestor members (principal-proof providers), verifier members (edges, gateways, merchants, control planes), resolution and data members, witness members, and public-interest members — each class a constituency in the assembly, which elects the board under charter constraints; membership dues are the capped per-lineage fees of §2, identical within class. Custodians (keys) and witnesses (logs) remain structurally separate from board and assembly alike. Everything material is public: statutes, minutes, budgets, audits, fee schedules, and ceremonies (recorded). Existing identity systems join as members through the door that fits their function — an issuer's credentials upgrade in place to passports, an attestor's proof becomes a first-class field available through every registrar, a verifier consumes the record — so federation replaces the quadratic cost of pairwise integrations with a single membership.
2. Economics — position, not profit. Revenue = capped per-lineage-year fees (cents-scale) + flat accreditation + grants. The design intent is a position where value must pass without being taxed: every agent interaction of consequence resolves a verification; every verification chains to the root; the root's cut is deliberately negligible — cheap enough that removing it costs more than keeping it. Worked shape: at 10M lineages × $0.10 = $1M/yr (lean root sustained); at 100M, the charter's falling cap reduces the fee; at 1B, the fee approaches archival cost. Anti-creep is constitutional because the toll position, not the toll, is the asset.
3. Status. Live project status — implementations, logs, witnesses, measured numbers — is maintained at status.html; this document is normative as of v5.1 (July 2026).
4. Roadmap, planned to the end. Prove (now): external verifier trials against pre-registered gates; venue filing of this standard as community submission/Internet-Draft with the CLI as conformance suite. Anchor: institutional co-conveners; charter ratification; first public 5-of-9 ceremony sealing log #1; two registrar classes issuing live; one revocation propagated worldwide, watchably. Endure: the long middle — adoption plateaus and pressure met with pre-decided responses (Document II obstacle ledger), principles fixed, pace flexible. Disappear (the goal): verification as boring as the clock — everywhere, invisible, with a public record behind it. Ω — beyond the institution: generational key-succession ceremonies; fork-readiness drills; and a managed-migration clause — if a demonstrably better successor standard achieves legitimate multistakeholder adoption, the root's final duty is an orderly migration of the namespace and record into it. The standard outlives the institution; that is planned, not feared.
Everything above composes from open standards proven at internet scale — signed messages, selective-disclosure credentials, resolvable identifiers, witnessed append-only logs, threshold ceremonies, compressed status proofs. Proven parts; new assembly; and a charter that keeps the center small forever.