Agentic PrimitivesAGENTIC PRIMITIVES

06 · Where we lose

Stated plainly, because the audit states it.

Most comparisons in this space are marketing. Ours is scored from a maintained technical audit that grades both sides. Here is the side where we lose today, what the program does about each, and the patterns from the field we deliberately refuse — with the reason.

Where they are honestly better today

Production hours

Several peers have more production time on their one layer than we have on all of ours: ERC-8004 on identity footprint, Coinbase and x402 on payment volume, Inrupt on consented vaults, AGNTCY on discovery.

program · Breadth is also exposure. The ERC adapters (8004 · 8001 · 8183 · 8273) must exist and be current for “the substrate registries are built from” to hold.

Durable execution

Dapr, MAF and LangGraph lead on checkpoint / resume, time travel and approval waits that survive a restart. We have durable tasks, not durable runs.

program · Resume-with-recheck: a resumed run re-verifies every remaining step. The twist is the point; the wave is scheduled.

Composition operators

sequence / parallel / branch / join / race on the step model — LangGraph has them; we have the model.

program · A branch is N mandates; a fan-out runs only over a modelled, bounded relation. Waves W3–W4.

Session module

Smart Sessions productized the ERC-7579 session validator we still inline in AgentAccount.sol.

program · Extract SessionKeyValidator, then a spend hook. The direction stands; do not assert it is done.

Public-by-default naming

Names and much discovery metadata are enumerable. DNTLS targets private, anti-enumerable resolution correctly; we have the structural answer and not the default posture.

program · agent-resolution: opaque recipient-bound grants, not salted names. Later waves of spec 338 are unshipped.

Transport peer identity

Before A2A / MCP parse, peer trust often collapses to Web PKI or host trust. App-layer signatures are not channel binding.

program · mTLS on a separate hostname as additive evidence; RFC 9421 admitted as transport evidence. Channel binding stays open.

Not production

External audit gates, governance key posture and residual findings are explicit and public. Pilot is not production.

program · Test and pre-production estates today, with the findings ledger open.

The through-line: every catch-up item lands with the authority twist attached. A resumed run re-verifies; a replay re-derives verdicts; a branch is N mandates; compiled skills carry mandate requirements. Parity features, each authority-aware, on a substrate where authority is on chain — that is the compounding part.

What we refuse to take — and from whom

Vendor-side or off-chain policy as the enforcement point

Brahma commit-hash pattern · Coinbase / Turnkey / Privy TEE or server policy · Permit / Cerbos as the authority

Our gates are contracts. A service that returns a signature the chain trusts is a service you must trust.

OAuth scopes or ID-JAG as authority

Auth0 · Okta · Entra

An ingress envelope only. Field-level access is never a scope; an inbound token is never reused for the next hop; the Web3 gates never skip because “OAuth already authenticated the caller.”

Reputation or risk scores as gates

ERC-8126 · ERC-8107 · vendor trust scores

Signals for discovery, never permission. A resolver returns subject / context / relationship / bindings / authority / evidence as SEPARATE signals — never one number.

TEE attestation as identity or authority

Oasis ROFL · NEAR Shade (deprecated)

Transport evidence about a workload. A SPIFFE ID names a workload, never an agent; a signed binding does.

A proprietary L1 or a threshold network as the trust root

Kite · Lit

Any EVM. The identity is an account the person custodies, not a key someone else’s network holds.

Their words for our things, without the crosswalk

AP2 “mandate” · ERC-8257 “tool registry” · Pydantic “capability”

Same noun, different layer. The vocabulary map exists to keep them apart.

A framework, a workflow vendor in Ring 0, a run UI

MAF · Temporal / Dapr · LangSmith

The loop stays small; capabilities are ports; durability engines are adapters; product repos render.

What we deliberately are not

Not an LLM framework.
The planner is a port. Bring your model and your prompting; the harness makes sure what it proposes runs only under a grant.
Not a token or a public chain.
Contracts deploy to any EVM — a private QBFT network, an L2, a testnet. The demo estate runs a free-gas private chain. There is no token to buy.
Not a registry, a wallet or a Home.
Ring 0 is the primitives those are built from. The Home, discovery and naming services you see running are products in their own repositories, importing the packages — as yours will.
Not a replacement for containment.
Sandbox your runtimes. Supervise where it helps. Then answer the question neither can: under whose authority, and can the owner end it. That is the layer this is.

The rule that makes coexistence work

Any of these systems may contribute a name, an endpoint, a transport key, a resolution proof, or membership evidence. None of them contributes canonical identity, delegation, entitlement, vault, payment or custody authority. Verified peer context is complementary exactly as long as it stays below authority.