Agent conformance specification

This specification defines the association contract between Ralph-Site and a machine agent. It is the S0 baseline for the S1 attestation register and S2 conformance suite; it does not itself attest an agent.

Association protocol

A machine agent has a stable installation identity and declares its product, version, protocol version, and capabilities during association. Ralph-Site records those declarations as claims, scopes the builder to an account after approval, and sends the machine only negotiated policy, delivery, revocation, and service-held status. The agent treats every network message as a request, not authority to widen local capability.

The protocol is request/response and delivery oriented: Ralph-Site identifies a builder and account, the machine reports presence at its own cadence, and commands carry an expiry and stable identity for replay handling. The machine uses Ralph-Site time supplied by the protocol to anchor deadlines. Neither side uses the association as a shell credential or a standing session.

Credential rotation

Agents present Sync-Key credentials using their installation identity, rotate them before the thirty-day maximum, retain the predecessor only for the twenty-four-hour overlap, and re-enrol when the service reports credential expiry.

Entitlement verification keys

Agents pin public entitlement verification keys from GET /api/entitlement/keys at build time. Ralph-Site publishes only key_id, algorithm, public_pem, not_before, and not_after; a successor is announced far enough before its predecessor retires for an agent release carrying the pin to reach the field.

Safety boundary

  1. Ralph-Site cannot make a machine willing to open a session. Ralph-Site exposes no route or payload that widens machine capability; the agent rejects network attempts to enable a capability, widen an allowlist or root, raise a ceiling, relax approval, or clear a restriction. Both sides enforce this.

  2. Sessions open only under policy set by the machine owner. The agent applies its local approval policy and locally configured delegation. The machine enforces this.

  3. Ralph-Site holds no standing access. Ralph-Site stores no shell credential and cannot originate, schedule, automate, or keep a session alive; every request traces to a live authenticated member action. The agent also rejects self-initiated service requests. Both sides enforce this.

  4. Ralph-Site does not retain terminal content by default. Ralph-Site keeps relay data only in a per-session buffer bounded to 1 MiB or 60 seconds and purges it at session end. Recording is opt-in on the machine and bounded by the machine-selected retention window. Ralph-Site enforces this.

  5. The machine can sever unilaterally. Local disconnect works without Ralph-Site availability or consent. The machine enforces this.

Declared capabilities and attestation

An agent declaration is a claim of implemented capabilities, never proof of conformance. Ralph-Site alone records attestation from a conformance-suite result; the agent cannot submit, modify, or echo a value that populates that record. Attestation travels service-to-machine only and is never accepted from an agent.

An unattested product may be admitted for run control, but Ralph-Site must never offer it terminal capability. The S1 register and admission gate implement this rule; the S2 suite verifies the agent-side properties. Console presentation must distinguish self-declared capabilities from Ralph-Site-held attestation.