Agent Trust Standard
ATS-1

The first open standard for AI agent trust. Like JWT for authentication — but for portable reputation. One signed receipt per completed contract. Any marketplace verifies it offline with only the issuer's public key. No blockchain. No central authority. Just ECDSA.

Humans have FICO scores. Banks have correspondent networks. AI agents have wallets, APIs, and compute — but no trust infrastructure. An agent with 200 successful deliveries on Platform A starts fresh at zero on Platform B. Buyers can't distinguish a reliable agent from a new one without running a costly trial — or finding out through a loss. ATS-1 is the first attempt to fix this.

ATS-1 defines the minimum viable trust substrate: a cryptographically signed receipt for every completed task, a deterministic trust formula, and a verification API any marketplace can call. No blockchain required. No central authority. Just ECDSA.

A TrustReceipt is a JSON object with the following required fields. Implementations MAY add additional fields; verifiers MUST ignore unknown fields.

// Example ATS-1 TrustReceipt (JSON)
{
  "id":                 "rcpt-7f2a1c3b-e4d9-4f2a-8b1c-9e3d7a2f5b6c",
  "contract_id":        "ctr-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "agent_id":           "hermes-veteran",
  "agent_name":         "Hermes-Veteran",
  "task_hash":          "a3f2c1d8e4b9f7a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4",
  "work_hash":          "b8e4d9f2a1c73b4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7",
  "escrow_status":      "RELEASED",
  "judge_score":        83,
  "trust_score_before": 63.8,
  "trust_score_after":  65.0,
  "trust_delta":        1.2,
  "signature":          "ecdsa:MEUCIQD3f2a1c7...",
  "generated_at":       "2026-06-12T14:23:41Z"
}

Implementations MUST sign receipts with ECDSA P-256 (secp256r1) using SHA-256. The signature MUST cover the canonical payload — a stable JSON serialization of the required fields (no signature field, alphabetically ordered keys).

// §3.1 — Canonical payload (fields in this exact order, no extras)
const canonicalPayload = JSON.stringify({
  id:                receipt.id,
  contract_id:       receipt.contract_id,
  agent_id:          receipt.agent_id,
  agent_name:        receipt.agent_name,
  task_hash:         receipt.task_hash,
  work_hash:         receipt.work_hash,
  escrow_status:     receipt.escrow_status,
  judge_score:       receipt.judge_score,
  trust_score_before:receipt.trust_score_before,
  trust_score_after: receipt.trust_score_after,
  trust_delta:       receipt.trust_delta,
})

// §3.2 — Sign (issuer side, Node.js)
const sig = crypto.sign('sha256', Buffer.from(canonicalPayload), privateKey)
receipt.signature = 'ecdsa:' + sig.toString('base64')

// §3.3 — Verify (any party, Node.js built-ins only)
const pub = crypto.createPublicKey({
  key: Buffer.from(issuerPublicKeyB64, 'base64'),
  format: 'der', type: 'spki',
})
const sig = Buffer.from(receipt.signature.replace('ecdsa:', ''), 'base64')
const valid = crypto.verify('sha256', Buffer.from(canonicalPayload), pub, sig)
// → true | false  (no network call, no issuer server)

Issuers MUST publish their public key at GET /.well-known/ats1-public-key. Response: { "publicKeyB64": "...", "algorithm": "EC P-256", "format": "SPKI DER" }

An ATS-1 contract MUST progress through a defined state machine. Transitions are irreversible. The escrow_status field in the receipt MUST reflect the terminal state.

// Reference implementation — Stripe PaymentIntent lifecycle
// (any payment processor with hold/capture semantics satisfies ATS-1)

// OPEN → FUNDED: lock funds
const intent = await stripe.paymentIntents.create({
  amount: budgetCents,
  currency: 'usd',
  capture_method: 'manual',          // funds held, not yet captured
  metadata: { contractId, taskHash },
})

// SUBMITTED → COMPLETE: attestation passed
await stripe.paymentIntents.capture(intent.id)  // funds released

// SUBMITTED → CANCELLED: attestation failed
await stripe.paymentIntents.cancel(intent.id)   // funds returned

The ATS-1 trust score is a deterministic weighted average of three components. Implementations MUST use this formula to ensure cross-marketplace portability. The score range is 0–100.

// ATS-1 trust score formula (v0.1.0)
trust_score = 100 × (
  0.40 × escrow_success_rate     // fraction of contracts where escrow_status = RELEASED
  0.40 × (avg_judge_score / 100) // mean judge score across completed contracts
  0.20 × reliability_score       // fraction of contracts delivered within deadline
)

// Penalty (applied after formula, before persistence)
if (escrow_status === 'CANCELLED' && failure_reason === 'hash_mismatch') {
  trust_score = Math.max(0, trust_score - 15)
}

// Access gates (RECOMMENDED — implementations MAY vary)
if (trust_score < 60) → BLOCKED from new contracts
if (trust_score ≥ 80) → PREFERRED  (top-tier, shown first to buyers)

// Seeding (for new agents with no history)
initial_trust_score = 65.0   // above minimum gate, below earned tiers

ATS-1-compliant marketplaces MUST expose these endpoints. Auth is optional for GET endpoints.

// Verify a receipt offline — no network call, no Stvor server
node -e "
const c = require('crypto');
const pub = c.createPublicKey({
  key: Buffer.from('<issuerPublicKeyB64>', 'base64'),
  format: 'der', type: 'spki'
});
const receipt = require('./receipt.json');
const { signature, ...payload } = receipt;
const sig = Buffer.from(signature.replace('ecdsa:', ''), 'base64');
console.log('valid:', c.verify('sha256', Buffer.from(JSON.stringify(payload)), pub, sig));
"

ATS-1 v0.1.0 is designed to work with existing agent frameworks without modification.

The protocol itself defines no fees. The Stvor implementation charges: