Metadata-Version: 2.4
Name: agp-tpe
Version: 2.5.0
Summary: AGP Trust Primitive Engine for deterministic Trust Policy 2 evaluation
Project-URL: Homepage, https://github.com/agpprotocol/agp
Project-URL: Repository, https://github.com/agpprotocol/agp
Project-URL: Documentation, https://github.com/agpprotocol/agp/blob/main/trust_primitive_engine/INTEGRATION-GUIDE.md
Project-URL: Issues, https://github.com/agpprotocol/agp/issues
Author: AGP Protocol
License: Apache License
        Version 2.0, January 2004
        http://www.apache.org/licenses/
        
        Copyright 2026 AGP contributors
        
        Licensed under the Apache License, Version 2.0 (the "License");
        you may not use this file except in compliance with the License.
        You may obtain a copy of the License at the URL above.
License-File: LICENSE
Keywords: agp,deterministic-evaluation,ed25519,policy-engine,trust-policy
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.12
Requires-Dist: cryptography>=42.0
Requires-Dist: jsonschema<5,>=4.26
Description-Content-Type: text/markdown

# Agent Governance Protocol (AGP)

**AGP is an experimental governance layer for multi-agent systems.**

It defines how independent agents or authorities can propose, review, approve,
reject, veto and audit high-impact decisions without trusting a single
coordinator as the sole source of truth.

> Status: experimental. AGP is not yet a production standard.



## 120-Second Demo

Run the public AGP demo with no external dependencies:

    python3 examples/120_second_demo/demo.py

Fast mode:

    python3 examples/120_second_demo/demo.py --fast

Valid governance path:

    python3 examples/120_second_demo/demo.py --happy-path --fast

The demo shows a coordinator changing a deployment payload after approval.
A coordinator-trusting workflow accepts it because the approval count is still present.
AGP rejects it because the approvals are bound to the exact approved input.

[Read the demo documentation](examples/120_second_demo/README.md)

## Whitepaper

The current public review draft is:

**AGP Whitepaper v0.9.2 — A Deterministic Governance Layer for Multi-Agent Systems**

- [Read online](docs/whitepaper/AGP_Whitepaper_v0.9.2.md)
- [Download PDF](https://github.com/agpprotocol/agp/releases/tag/whitepaper-v0.9.2)
- [Submit technical feedback](https://github.com/agpprotocol/agp/issues/1)

The whitepaper is experimental, is not a production standard, and has not yet received independent security review.

## Why AGP?

- **MCP** connects models to tools and data.
- **A2A-style protocols** let agents communicate.
- **Workflow engines** coordinate execution.
- **AGP** governs collective decisions.

A workflow can record that a deployment was approved. AGP additionally aims to
make the authority snapshot, evidence, ballots, resolution and history
independently verifiable.

## Core properties

- deterministic resolution;
- canonical serialization;
- independent Python and Go implementations;
- Ed25519 signed envelopes;
- replay, expiration and revocation checks;
- append-only transparency log;
- external audit receipts;
- conformance and adversarial test vectors.

## Architecture

```mermaid
flowchart LR
    P[Proposal] --> E[Evidence]
    E --> B[Signed ballots]
    B --> R[Deterministic resolution]
    R --> L[Transparency log]
    L --> A[Independent audit]
```

## AGP vs. a conventional workflow

| Property | Workflow | AGP |
|---|---:|---:|
| Coordinates steps | Yes | Yes |
| Deterministic replay across implementations | Not inherent | Yes |
| Signed authority actions | Optional/custom | Built into profile |
| Evidence version validation | Optional/custom | Yes |
| Revocation-aware decisions | Optional/custom | Yes |
| Tamper-evident history | Optional/custom | Yes |
| Independent audit without trusting coordinator | Not inherent | Yes |

AGP is intentionally more complex. For low-risk internal automation, a
conventional workflow is usually the better choice.

## Reproducible results

```text
AGP v0.3 Conformance:          260/260 passed
AGP v0.4 Signed Conformance:    10/10 passed
AGP v0.5 Transparency:           8/8 passed
AGP vs Workflow benchmark:       8/8 attacks detected by AGP
```

The workflow baseline in the benchmark detected 0/8 because it treated
coordinator state as authoritative. This is a limited experimental benchmark,
not a claim that all workflow engines are insecure.

## Trust Primitive Engine quick start

The AGP Trust Primitive Engine 2.5 is published on PyPI as `agp-tpe`.

Requirements:

- Python 3.12+

Install it without cloning this repository:

```bash
python -m pip install agp-tpe
```

Verify the installed distribution and packaged schemas:

```bash
python - <<'PY'
from importlib.metadata import version
from trust_primitive_engine import DEFAULT_SCHEMA_DIR

print("agp-tpe", version("agp-tpe"))
print("schemas:", DEFAULT_SCHEMA_DIR)
assert DEFAULT_SCHEMA_DIR.is_dir()
PY
```

Use the stable public facade:

```python
from trust_primitive_engine import (
    TrustPolicyEvaluationError,
    evaluate_trust_policy,
)

try:
    result = evaluate_trust_policy(
        signed_context=signed_context,
        policy=policy,
        keyring=keyring,
        policy_set=policy_set,
    )
except TrustPolicyEvaluationError as exc:
    print(exc.code, exc.detail)
else:
    print(result["status"])
```

A real evaluation requires an AGP signed Decision Context, a Trust Policy,
and the corresponding verification keyring. See the
[Trust Primitive Engine integration guide](trust_primitive_engine/INTEGRATION-GUIDE.md)
for the complete input contract, policy references, failure handling, and
command-line examples.

> TPE 2.5 remains experimental and has not received an independent security
> audit.

## Repository benchmark quick start

Requirements:

- Python 3.10+
- Go 1.22+

```bash
git clone https://github.com/agpprotocol/agp.git
cd agp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements-v0.4.txt
python3 run_benchmark_all.py
```

Expected final line:

```text
AGP BENCHMARK COMPLETE
```

## Repository map

```text
spec/           Conformance profile
python/         Python resolver
go/             Go resolver
signed/         Signed envelope conformance
transparency/   Append-only audit log
benchmark/      AGP vs workflow experiment
examples/       Reference scenarios
docs/           Architecture, threat model and evaluation
```

## What AGP does not claim

AGP does not:

- replace authentication, authorization or IAM;
- replace orchestration engines;
- guarantee that evidence is factually true;
- eliminate compromised members;
- solve governance for every multi-agent system;
- claim production maturity.

## Current research question

> Do high-impact multi-agent systems need a portable, independently verifiable
> governance layer distinct from communication and orchestration?

## Documentation

- [Architecture](docs/ARCHITECTURE.md)
- [Threat model](docs/THREAT_MODEL.md)
- [Benchmark](docs/BENCHMARK.md)
- [Roadmap](ROADMAP.md)
- [Contributing](CONTRIBUTING.md)
- [Security policy](SECURITY.md)
- [Governance](GOVERNANCE.md)

## License

Apache License 2.0. See [LICENSE](LICENSE).
