Overview¶

An Agent Cartridge (.acx) is a single SQLite database that packages an AI agent — its skills, capability claims, memory, runtime contract, loop/context policy, and a cryptographically provable competence level — into one portable, signable, distributable artifact. Software engineering is the flagship use case, but the format is task-general: any agent that has skills, learns, and runs a loop fits — and cartridges level up, form teams, and run workflows together.

What an Agent Cartridge is¶

A cartridge is a self-describing SQLite ≥ 3.37 database, extension .acx, that an agent "trained" (leveled up) in one environment can be shared, verified, remixed, and re-hosted in another with deterministic integrity guarantees and no host lock-in (SPEC §1).

It is branded at the file-header level so file(1) recognizes it from a 72-byte read, with no page cache and no schema query:

$ file /tmp/demo.acx
/tmp/demo.acx: SQLite 3.x database, application id 1094932529, user version 16777472, ...

• application_id = 1094932529 is the magic 0x41435831 — the ASCII bytes A C X 1, stored at header offset 68.
• user_version = 16777472 (0x01000100) packs [spec_MAJOR][spec_MINOR][vec0_storage_format][flags] at offset 60.

Everything else — skills, capabilities, memory, signatures, credentials — lives in ordinary tables inside that one file. Because it is stock SQLite, stock tools work on it unchanged:

$ sqlite3 /tmp/demo.acx -Ax        # extract the sqlar archive
rom/skills/expertise-designer/SKILL.md

A cartridge is a signed harness¶

Lilian Weng's 2026 post "Harness Engineering for Self-Improvement" defines a harness as "the system surrounding a base model that orchestrates execution and decides how the model thinks and plans, calls tools and acts, perceives and manages context, stores artifacts, and evaluates results." She argues that "the layer between the raw model and the real-world context seems to be as important as the model's raw intelligence."

An Agent Cartridge is exactly that harness, captured as a self-contained, signed, portable artifact — an agent-OS image — that any compliant host can boot. The harness-requirements manifest is the boot contract; the loop/context policy encodes Weng's loop of "plan, execute, observe/test, improve, and execute again until the goal is achieved." See The agent OS.

The problem it solves¶

Today a specialized agent is trapped where it was built. Three properties are missing:

The cartridge fixes each of these by construction, and the fix is machine-checkable rather than promised.

weak agent   (competence 14): NOT ISSUED — gating failed: sigma=2.230 (<1.5?) ...
strong agent (competence 33): ISSUED ✅  mu=33.03 sigma=1.232 games=90 R=29.34 => acxLevel=29 tier=principal
anti-transplant — VC on mutated ROM: REJECTED ✅ [ 'ROM digest binding mismatch' ]

The five design goals¶

The standard is governed by five goals (SPEC §1):

1. Portable. Identity, trust, and behavior bind to a reverse-DNS publisher (e.g. io.github.agentibus/scenario-research-designer) and a content-addressed ROM manifest — never to a hostname. A cartridge verifies and runs unchanged across machines, orgs, and hosts.
2. Codebase-agnostic base, but field-learning. Every memory record is partitioned into a TRANSFERABLE tier (generalizable, signed, shareable) and a FIELD-LEARNED tier (codebase-specific, pseudonymously namespaced, quarantined). The agent keeps learning in the field without contaminating its shareable core.

3. Shareable and remixable. The immutable ROM zone is the portable core; the mutable SAVE zone holds local learning. A strip-to-ROM re-export proves, by hash equality, that field learning never mutated the core:

   rom hash before strip: sha256:f479be021b8ea2e55cc6e3e33b95df9d151196548dfc854dedbe578be7120642
   rom hash after  strip: sha256:f479be021b8ea2e55cc6e3e33b95df9d151196548dfc854dedbe578be7120642
   hash-equality proof:   EQUAL (ROM intact; SAVE removed)
   

4. Provable level. An agent's level is a W3C Verifiable Credential 2.0 embedding an Open Badges 3.0 achievement, issued by an independent verifier only after held-out re-execution, TrueSkill σ-gated (sigma < 1.5, gamesPlayed >= 30, conservative rating R = mu - 3*sigma), bound to the ROM digest, and revocable.

5. Open envelope, valuable contents. The container format, schemas, and descriptive layer are 100% open under Apache-2.0. Signed level attestations, verified capability evidence, and field-learned memory remain revocable, identity-bound assets inside a fully open envelope. Payments, entitlements, and licensing enforcement are outside ACX.

flowchart LR
    subgraph ACX[".acx cartridge — one SQLite file"]
        subgraph ROM["ROM zone · signed · shareable"]
            S[skills]
            C[capabilities]
            RM[ROM memory]
            SIG[Ed25519 / DSSE signature]
            ATT[level credential]
        end
        subgraph SAVE["SAVE zone · mutable · field-learned"]
            SM[codebase-fingerprinted memory]
        end
    end
    ROM -->|strip-to-ROM re-export<br/>hash unchanged| ROM

What is inside a cartridge¶

Each part of the cartridge has its own format page:

• Container format — the SQLite header brand, the exact table schema (cartridge, sqlar, memory, objects, signatures, attestations, vectors), the ROM/SAVE boundary, and strip-to-ROM (SPEC §3).
• Signing & trust — Ed25519 in a DSSE / in-toto envelope over a content-addressed ROM manifest recomputed from live bytes, plus the local / trusted / portable / legacy / tampered trust taxonomy (SPEC §4).
• Skills — SKILL.md files under rom/skills/<name>/ in the sqlar table, using agentskills.io frontmatter and extractable with stock sqlite3 -Ax (SPEC §5).
• Capabilities — structured claims {taskType, stack (purl), domain, proficiency (TrueSkill), evidenceRefs} that map to an A2A AgentCard; verified: true only when a level attestation resolves (SPEC §6).
• Memory — the two-tier partition, mandatory portable + codebaseFingerprint on every record, and the fail-closed secret-scrub gate on export (SPEC §7).
• Harness requirements — the four required tool-roles (acx:execute, acx:dispatch, acx:memory.write, acx:search), the MCP protocol floor, and the host capability-negotiation handshake (SPEC §8).
• Loop & context policy — the cycle [plan, gather_context, act, verify, reflect], verification with held-in/held-out regression gating, budgets, sub-agents, and observability (SPEC §9).

And beyond one cartridge:

• Conditional Agentic Loops — signed, bounded execution graphs that bind agent slots, required context, conditions, and completion contracts (SPEC §14).
• Agent Graph — the signed information architecture around those loops: who owns context, who directs or reports to whom, and where separate loops converge (SPEC §16).
• Provable level — how a level is earned by re-run and verified as unfakeable (SPEC §10).
• Distribution — the .acx file as one layer in an OCI image manifest (artifactType application/vnd.acx.cartridge.v1), verifiable with stock cosign/oras (SPEC §11).