# GRIP — Governed Runtime Intent Protocol

**Specification artifacts for GRIP/1.0-draft.2.**
Companion to the paper *"GRIP: The Governed Runtime Intent Protocol — an open
protocol for authorised, bounded and attributable agent execution."*

> **Status: Request for Comments.** Proposed, not adopted. There are no external
> implementers yet. This is issued for public comment and adversarial review; it
> is not a frozen specification.

## What is here

| Path | What it is |
| --- | --- |
| `schema/1.0-draft.2/` | JSON Schema (2020-12) for the envelope and all six objects |
| `registry/` | Act families, consequence classes, denial reasons, budget axes, boundaries, conformance levels |
| `tools/gripcore.py` | JCS (RFC 8785) canonicalization, object identity, detached JWS (RFC 7515/8037/7797) |
| `tools/grip_verify.py` | **`grip-verify`** — the eight-rule chain verifier of §4.6 |
| `tools/make_vectors.py` | Regenerates every test vector deterministically |
| `vectors/` | The canonical worked chain (Appendix C) plus six negative vectors |
| `conformance/run.py` | Asserts each vector fails exactly the rules it should |

## Quickstart

Everything runs from one download — no repository access needed. Ninety seconds
from here to a verified chain.

```
curl -O https://grip.foxora.dev/spec/grip-1.0-draft.2.zip
unzip grip-1.0-draft.2.zip && cd grip
```

Checksum at `https://grip.foxora.dev/spec/grip-1.0-draft.2.zip.sha256`.

The verifier needs Ed25519, which means one package and no others. The virtual
environment is not fussiness — current macOS and most Linux distributions
refuse `pip install` into the system Python:

```
python3 -m venv .venv
.venv/bin/pip install cryptography
```

Then run the suite. Six of the seven vectors are negative, and each must fail
exactly the rules it is meant to fail:

```
.venv/bin/python conformance/run.py     # 7/7 vectors behave as specified
```

One chain on its own, and a regeneration that should reproduce every byte:

```
.venv/bin/python tools/grip_verify.py \
  --bundle vectors/refund-happy-path/trust-bundle.json \
  --objects vectors/refund-happy-path/objects

.venv/bin/python tools/make_vectors.py  # keys are seeded, output is byte-identical
```

Requires Python 3.10+.

## The six objects

**Mandate** the agreement · **Grant** the permission · **Receipt** the record ·
**Stop** the human gate · **Settlement** the closing · **Context Envelope** what
the model saw. One envelope, one hash chain, one detached-JWS signature scheme.

An object's `id` is `sha256:` + the SHA-256 of its JCS-canonical form with `id`
and `sig` absent. That same preimage is what `sig` signs. Nothing else is ever
injected into an object — a verifier that adds a field breaks every digest it
then checks.

## Conformance

Cumulative. **GRIP-0** Witness · **GRIP-1** Accountant · **GRIP-2** Warden ·
**GRIP-3** Sovereign. See `registry/conformance-levels.json` for the normative
requirements, and §4.7 of the paper for what each level honestly is.

## Reading the verifier's output

The output is a **per-rule verdict, never a scalar score**:

- `pass` / `fail` — the rule held, or did not
- `unevaluable-critical` — a branch a conformant gate refused for an unknown
  critical extension; correctly-refused authority is not chain failure
- `incomplete` — the chain could not be shown to extend its latest head
  attestation. **A chain with no attestation is reported incomplete, not clean.**

## Known limits of this reference implementation

Stated plainly, because a verifier that oversells itself is worse than none:

- Rendering constraints on trust classes (§4.3.6) are conformance-clause
  obligations and are **not** chain-verifiable. The verifier says so in its notes.
- Consequence-class assignment is the Grant issuer's; misclassification is not
  chain-detectable. The verifier reports what executed settle-free.
- v1's independence predicate is identity inequality only. It does not resist
  sock-puppet validators under one principal.
- Token-mode Stop approvals trust the runtime's discard promise. Signature mode
  does not, and deployments that can give approvers keys should.
- `prev`-links authenticate ordering within the disclosed set. They cannot detect
  a withheld suffix or a parallel fork; that is what anchoring is for.

## Licence

Specification text, schemas and registries: **CC-BY-4.0**.
Code (`tools/`, `conformance/`): **Apache-2.0**.

## Cite

> Parashar, M. D., & Parashar, A. (2026). *GRIP: The Governed Runtime Intent
> Protocol.* Foxora Labs Ltd. GRIP/1.0-draft.2.