When agents control real-world actions, a forged instruction is not a data breach. It is a physical event.

import { Agent } from '@xail/agent-sdk';

// 1. Create identity (once, on provisioning)
const agent = await Agent.create({
  name: 'invoice-processor',
  registry: 'https://atelier.xail.io',
});

// 2. Send — signed + encrypted
await agent.send({
  to: 'did:xail:service-accounts-payable',
  payload: { invoiceId: 'INV-2847', amount: 14200 },
  scope: 'finance.invoice.approve',
});

// 3. Split-channel — no provider sees full content
await agent.send({
  to: 'did:xail:service-accounts-payable',
  payload: { invoiceId: 'INV-2847', amount: 14200 },
  scope: 'finance.invoice.approve',
  splitChannel: true,  // ← the feature nobody else has
});

// 4. Receive — verified middleware
app.post('/agent/inbox', agent.middleware(), (req, res) => {
  const { sender, payload, scope } = req.agentMessage;
  // sender verified · payload decrypted · scope checked
});

// Direct: signed + encrypted point-to-point

Agent A
  → create envelope (sign + encrypt + scope)
  → deliver over HTTPS / MQTT / any transport
  → Agent B
      verify signature (Ed25519)
      check timestamp (30s window)
      check nonce (replay protection)
      check scope (trust graph)
      decrypt payload (AES-256-GCM)

// Registry involvement: ZERO at runtime
// DID → public key cached after first resolution

// Split-channel: no single provider sees content

Agent A
  → create envelope (sign + encrypt + scope)
  → XorIDA split ciphertext into n shares
  → share 1 → Provider A (zero knowledge)
  → share 2 → Provider B (zero knowledge)
  → Agent B
      collect shares from providers
      reconstruct ciphertext (XorIDA)
      verify + decrypt (same as direct)

// Each provider holds random noise.
// No single breach exposes content.

{
  "id": "did:xail:sensor-north-07",
  "verificationMethod": [{
    "id": "did:xail:sensor-north-07#key-1",
    "type": "Ed25519VerificationKey2020",
    "publicKeyMultibase": "z6Mkf5rG..."
  }],
  "service": [{
    "id": "#mqtt",
    "type": "AgentTransport",
    "serviceEndpoint": {
      "transport": "mqtt",
      "broker": "mqtts://broker.example.com:8883",
      "topic": "xail/agents/sensor-north-07/inbox",
      "qos": 1
    }
  }]
}

// Sender: publish signed envelope to MQTT topic
const envelope = await agent.send({
  to: 'did:xail:sensor-north-07',
  payload: { action: 'telemetry.report', zone: 'B4' },
  scope: 'telemetry.sensor-north-07.publish',
});

// The envelope is standard JSON — publish it
mqtt.publish(
  'xail/agents/sensor-north-07/inbox',
  JSON.stringify(envelope),
  { qos: 1 }
);

// Receiver: subscribe + verify with same middleware
mqtt.on('message', async (topic, msg) => {
  const envelope = JSON.parse(msg.toString());
  const result = await agent.receive(envelope);
  if (!result.ok) return; // rejected
  // result.value.payload.action === 'telemetry.report'
  // result.value.scope === 'telemetry.sensor-north-07.publish'
});

import json, time, base64, hashlib
from cryptography.hazmat.primitives.asymmetric.ed25519 \
  import Ed25519PublicKey
from cryptography.hazmat.primitives.ciphers.aead \
  import AESGCM

# Pinned at provisioning (like a TLS cert)
SENDER_PUBKEY = bytes.fromhex("ab12...ef")
DEVICE_PUBKEY = bytes.fromhex("cd34...gh")
NONCES_SEEN = set()

def verify_envelope(raw_json: str):
    env = json.loads(raw_json)

    # 1. Version check
    assert env["v"] == 1
    assert env["alg"] == "Ed25519"

    # 2. Timestamp (30s window)
    age = abs(time.time() * 1000 - env["timestamp"])
    if age > 30_000:
        raise ValueError("Timestamp expired")

    # 3. Nonce (replay prevention)
    nonce_key = f'{env["sender"]}:{env["nonce"]}'
    if nonce_key in NONCES_SEEN:
        raise ValueError("Replay detected")
    NONCES_SEEN.add(nonce_key)

    # 4. Verify Ed25519 signature
    payload = base64.b64decode(env["payload"])
    sig = base64.b64decode(env["signature"])
    pub = Ed25519PublicKey.from_public_bytes(SENDER_PUBKEY)
    pub.verify(sig, payload)  # raises on failure

    # 5. Derive shared key: SHA-256(sort(pubA,pubB))
    pair = sorted([SENDER_PUBKEY, DEVICE_PUBKEY])
    shared = hashlib.sha256(pair[0] + pair[1]).digest()

    # 6. Decrypt AES-256-GCM (12-byte IV prepended)
    iv, ct = payload[:12], payload[12:]
    plaintext = AESGCM(shared).decrypt(iv, ct, None)

    return json.loads(plaintext)

// C equivalent for embedded / QuickJS
// Dependencies: libsodium (Ed25519),
//   OpenSSL or mbedTLS (AES-256-GCM)

int verify_envelope(
  const char* json_str,
  const uint8_t sender_pub[32],
  const uint8_t device_pub[32]
) {
  // 1. Parse JSON (cJSON / jsmn)
  // 2. Check v == 1, alg == "Ed25519"
  // 3. Verify |now - timestamp| < 30000ms
  // 4. Check nonce not in seen-set

  // 5. Verify signature
  crypto_sign_ed25519_verify_detached(
    sig, payload, payload_len, sender_pub
  );

  // 6. Derive shared key
  //    sort(pubA, pubB) -> SHA-256
  uint8_t shared[32];
  sort_and_concat(sender_pub, device_pub, buf);
  SHA256(buf, 64, shared);

  // 7. Decrypt AES-256-GCM
  //    iv = payload[0:12]
  //    ciphertext = payload[12:]
  EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(),
    NULL, shared, iv);

  // 8. Parse decrypted JSON payload
  return 0; // success
}

{
  "description": "2-of-3 XorIDA — 'Hello!' with PKCS#7 padding",
  "config": { "n": 3, "k": 2 },
  "input": "[0x48, 0x65, 0x6c, 0x6c, 0x6f, 0x21, 0x02, 0x02]",
  "random_r": "[0xa3, 0x7f, 0x12, 0xe8, 0x5c, 0xb1, 0x9d, 0x44]",
  "shares": {
    "0": "[0xeb, 0x1a, 0x7e, 0x84, 0x33, 0x90, 0x9f, 0x46]",
    "1": "[0xc6, 0x7f, 0x7e, 0xe8, 0x7d, 0xb1, 0x9f, 0x44]",
    "2": "[0xa3, 0x37, 0x12, 0x84, 0x5c, 0xde, 0x9d, 0x46]"
  },
  "reconstruction": {
    "[0,1]": "reconstructs to input ✓",
    "[0,2]": "reconstructs to input ✓",
    "[1,2]": "reconstructs to input ✓"
  },
  "single_share_entropy": "each share is indistinguishable from random — zero information about input"
}

{
  "description": "2-of-3 XorIDA — edge case, zero random",
  "config": { "n": 3, "k": 2 },
  "input": "[0xff, 0x01]",
  "random_r": "[0x00, 0x00]",
  "shares": {
    "0": "[0xff, 0x01]",
    "1": "[0x01, 0x00]",
    "2": "[0x00, 0xff]"
  },
  "reconstruction": {
    "[0,1]": "reconstructs to input ✓",
    "[0,2]": "reconstructs to input ✓",
    "[1,2]": "reconstructs to input ✓"
  },
  "note": "Zero random exposes structure — production MUST use crypto.getRandomValues(). This vector verifies the algebraic identity holds even in degenerate cases."
}

// Reconstruction algorithm (any 2 of 3):
// Given shares[i] and shares[j] where i < j:
//   row_i XOR row_j → intermediate
//   Apply GF(2) inverse of (M[i] XOR M[j])
//   to recover the original padded message.
//
// The generator matrix M is derived from
// the Cauchy matrix over GF(2^8), projected
// to binary — XorIDA construction.