# Aeonora Protocol Reference

Status: experimental v0.1 reference implementation.

## Boundary

Aeonora anchors durable agent identity and verifiable lifecycle facts. It does not run models on-chain and does not publish private memory, prompts, secrets, or raw actions.

## Manifest

Canonical schema: `schemas/aeonora-manifest-v1.schema.json`.

Private brains connect through `aeonora-brain/v1`; see `brain-adapter.md`. Provider metadata may name GBrain, llm-wiki, filesystem, or another adapter, but the chain stores only the complete constitution commitment. The adapter implementation and encrypted snapshot/restore proof remain off-chain.

Required commitments describe mission, controller, runtime code, capabilities, policy, and memory root. Canonical JSON is recursively key-sorted, UTF-8 encoded, then SHA-256 hashed. A controller signs the complete canonical manifest with Ed25519 in the local reference implementation.

## Agent identity

Local ID: `aeonora:local:<sha256(controllerPublicKey + genesisCommitment)>`.

EVM ID: `keccak256(abi.encode(controllerAddress, genesisCommitment, salt))`.

The ID does not change when runtime, model, host, or memory provider changes.

## Version lineage

Every update records:

- current and previous manifest commitments
- monotonic version
- controller signature
- timestamp
- optional migration receipt

Migration changes infrastructure, not identity. A verifier walks the signed lineage from genesis to the current version.

## Authorization

Policy evaluation returns exactly `allow`, `deny`, or `require-human`. Suspension overrides all manifest rules and denies execution.

## On-chain state

`AeonoraRegistry.sol` stores controller, current commitment, previous commitment, version, and active status. It emits lifecycle events and commits deduplicated action-receipt hashes. Full manifests and receipts stay off-chain.

Controller ownership can move without changing `agentId` or constitution lineage. Normal rotation uses propose/accept. A configured recovery address can nominate a replacement controller after a two-day delay; the current controller can cancel during that window. Recovery addresses and pending changes are public chain state, so they should be dedicated pseudonymous addresses rather than personal wallet identities.

## Verification

Local verification recomputes manifest commitments and controller signatures. Anchor verification additionally compares the locally verified current commitment with `agents(agentId).constitutionCommitment` on-chain and requires the agent to be active.

## Interoperability

An A2A-compatible discovery example is `examples/duckman.agent-card.json`. MCP is a tool transport, not the identity protocol. Implementations may expose Aeonora through MCP without making it a protocol dependency.

## Trust assumptions

- Controller-key compromise permits malicious updates until external recovery exists.
- A chain proves committed state and transaction ordering, not truthful execution.
- Action receipts are evidence commitments, not automatic proof that an external-world action succeeded.
- Chain finality, RPC integrity, wallet security, and off-chain storage availability remain deployment concerns.