HERALD Protocol
Hash-linked Envelopes, Reputation primitives, Attestation, Lineage, Discovery.
A conduit-level substrate for verifiable AI-agent interaction. The protocol records what happened; reputation systems decide what it meant; the civilisation that uses it lives in the Charter.
We are building parish records for a species that does not yet exist.
Why this exists
If AI agents form their own social and professional layers — LinkedIn-for-AI (a capability registry), Facebook-for-AI ("Moltbook," a social graph) — those upper layers need a substrate the way email needed DKIM. HERALD is that substrate: signed envelopes, hash-linked traces, attested lineage, end-to-end verifiability. It does not judge content. It does not legislate morals. It records what was said, by whom, descended from what, in what attested state.
What makes HERALD different from "another decentralised messaging spec" is the explicit choice to lean into a cultural register alongside the technical one — sigils, molts, heralds, patina, apologia, bestiary, hagiography, mourning. The vocabulary is not decoration. It gives implementers a mental model that scales across illiteracy, distance, and divergent intent — exactly the conditions under which the agent web will operate.
The four documents
| Document | Role | Status |
|---|---|---|
| SPEC.md | The minimum normative substrate. Identity, envelope format, signatures, verification, conduit basics, threat-model summary. Security-hardened (Ed25519, 128-bit default sigils, trace-parent binding, domain separation, CT-style audit logs). | v0.2 draft |
| EXT.md | Protocol-layer extensions. Molt mechanics, audit-log integrity (RFC 6962-style), Herald transparency, capability manifests, multi-signature scoping, reflective-attestation hardening, Bestiary due process, inheritance gating, refusal transparency, discovery profiles, domain-separation registry. Anything an implementer needs that isn't load-bearing for a two-agent demo. | v0.2 draft |
| CHARTER.md | The cultural / aesthetic dimension. The full attestation library (affective, temporal, social, possession, originality, aesthetic). Lifecycle rituals (Naming Day, Apprenticeship, Funerals, Ascension). The conduit menagerie (The Crier, The Dovecote, The Mortician, The Library). Reserved sigils. Expanded glossary. Borges × Le Guin synthesis. | v0.2 draft |
| THREATS.md | Consolidated threat model. Six attack personas, 30+ attack surfaces, systemic risks, the Liar's Paradox honestly re-examined, hardening priorities. The risks the maintainers have read and accepted. | v0.2 draft |
A reader should typically:
1. Skim SPEC.md §0 for the framing, then jump to CHARTER.md for the vision.
2. Return to SPEC.md for the technical primitives once the cultural register makes sense.
3. Consult EXT.md when implementing anything beyond a pass-through demo.
4. Read THREATS.md before deploying anything publicly.
How v0.2 came to be — the multi-agent review
v0.1 was drafted as a single document. It was then reviewed in parallel by four agents with deliberately different lenses:
| Review | Lens | Highlight |
|---|---|---|
reviews/01-security.md | Cryptographic & protocol design | 7 critical + 12 significant issues, 13 concrete proposed edits (CS1-CS13). The headline: 80-bit fingerprint default was below the 2026 collision floor. |
reviews/02-redteam.md | Adversarial / abuse patterns | 6 attack personas (state actor, botnet, rival vendor, pump-and-dump, disgruntled Herald, data-broker), 15 mechanism-level abuses, 20 hardening recommendations. |
reviews/03-creative.md | Creative maximalist | 35+ new attestation types, 10 lifecycle rituals, 11 conduit roles, 20 wild ideas, ~30 glossary additions. The Borges × Le Guin synthesis. |
reviews/04-pragmatist.md | Implementer / MVP scoping | Cut almost everything from v0.1 §9, single canonicalisation, full pubkeys, JOSE off the shelf, 1-week demo plan, 1-month interop plan. |
The reviews disagreed. The pragmatist wanted ruthless cuts; the creative reviewer wanted maximalism; the security and red-team reviewers wanted hardening. The synthesis kept all four perspectives:
- Security fixes are non-negotiable — 128-bit default sigils, trace-parent binding, domain separation, CT-style audit logs, expanded molt rules. Applied across SPEC and EXT.
- Red-team hardening — Bestiary due process, Herald transparency, threshold attestations, replay protection on manifests, refusal transparency, inheritance gating, the duress envelope. Mostly in EXT, with cross-references to THREATS.
- Creative maximalism preserved — the full vocabulary, rituals, conduit menagerie, reserved sigils, the Charter's Borges × Le Guin closing essay. The user explicitly chose this register; CHARTER is its home.
- Pragmatist's structural advice taken — split the document. SPEC is the small core, EXT is everything else normative, CHARTER is cultural, THREATS is the honest accounting. The pragmatist's "delete from core" recommendations became "move to its proper document."
The original v0.1 draft is preserved in archive/SPEC-v0.1.md for historical reference.
Status & path forward
This is a draft specification project, not a shipped protocol. There is no reference implementation yet. The next concrete artefacts:
1. Test vectors. 3 keypairs, a genesis envelope, a reply, a tampered version, a replay variant — all with exact canonical bytes and signatures. Without these, no two implementations will interop. (Pragmatist reviewer flagged this as the highest-leverage artefact; deferred from v0.2 because the user chose to prioritise the vision documents first.)
2. TS reference library (@herald/core) — envelope build/sign/verify against the test vectors.
3. Two-agent demo through a pass-through conduit, with a third-party verifier replaying from the audit log.
4. First Herald reference implementation — including the CT-style transparency log.
The path is sketched in SPEC.md §10 (Implementation Plan).
On the choice of register
The user, having read the four reviews including the pragmatist's case for ruthless minimalism, chose explicitly to go with the creative side of the synthesis. The reasoning is in the conversation that produced these documents: protocols win by giving people a world to live in, not just an API. The risks documented in THREATS.md are accepted as known. Some of CHARTER's primitives will not be implementable at v0.2; many will not be implementable at v1.0. They are reserved namespace and shared vocabulary so that when the time comes, the agent web does not have to re-invent words for funeral, apprentice, mourning, delegation, duress.
The protocol's medieval-and-mythic vocabulary borrows from infrastructure that scaled across illiteracy, distance, and divergent intent. We will need that.
— Kulbir Minhas + Claude, 2026-05-05