Find a better agent loop. Verify it. Make it yours.¶

One public loop, end to end¶

The useful viral loop is not “copy a screenshot.” It is a reproducible chain where each recipient can understand the artifact quickly, verify the bytes independently, preserve attribution, change the design, and publish a new immutable version.

stable detail link
  → verified download
  → remix with signed parent lineage
  → local signature
  → focused pull request
  → new stable detail link

What is exchanged¶

The Exchange does not execute any artifact. Opening a card, verifying JSON, downloading bytes, or creating a draft never dispatches an agent, evaluates a workflow, follows a route, or resolves private knowledge.

The identity that survives sharing¶

Every published agent, workflow, or Agent Graph is addressed by:

artifact type + publisher id + artifact id + SemVer + digest

Agents, workflows, and Agent Graphs live at immutable paths:

registry/cartridges/<publisher>/<id>/<version>/cartridge.acx
registry/cals/<publisher>/<id>/<version>.cal.json
registry/graphs/<publisher>/<id>/<version>.agent-graph.json

Changing signed bytes requires a new SemVer and a new path. An existing coordinate cannot be silently overwritten, including with --force. “Latest” is only a discovery shortcut; dependencies and lineage always pin a concrete digest. A cartridge carries acx.artifact_id and acx.artifact_version inside its signed ROM metadata; its coordinate digest remains the ROM digest.

Signed lineage.parents[] records whether the new artifact is a fork, remix, derived-from, or supersedes publication. A parent reference carries the artifact type, publisher, id, optional version, and required sha256 digest. It preserves attribution, but it does not transfer namespace ownership, signature trust, license permission, or runtime authority.

Agent Graph: the information layer between loops¶

A CAL says what happens next. An Agent Graph says who owns the context, who can direct whom, where reports return, and where separate loops meet.

This is deliberately fuzzy in the useful places:

• actors are logical seats selected by role, capability, tags, or prose rather than named machines;
• knowledge modules describe intent, decisions, evidence, status, risk, and tacit context without embedding the private content;
• routes make direction, advice, reporting, review, approval, and escalation expectations visible;
• loop bindings pin whole workflows without copying their task nodes; and
• convergence points say which steward combines knowledge from at least two loops, under bounded waits and rounds.

The strict parts are references, return routes, dependency coordinates, direction conflicts, and bounds. That combination lets a Product Owner seat tell whichever developer agents are staffed what outcome is needed, while developers return status, evidence, risks, and blockers through an explicit reporting path. Research and delivery can remain separate CALs and still converge into one product decision.

Read the animated Agent Graph guide or open the Studio to describe one in plain language first and add structure as it becomes useful.

Browser verification: precise boundaries¶

The static app can recompute the canonical JCS digest and verify the Ed25519 DSSE/in-toto signature of a workflow or Agent Graph with WebCrypto. That proves that the JSON matches the signed digest and binds the publisher claim inside the artifact.

It does not prove:

• that the signer controls the claimed reverse-DNS or GitHub namespace;
• that a workflow is safe to execute or locally staffable;
• that an Agent Graph grants a real organizational permission;
• that a cartridge's SQLite ROM, package specification, level credential, or capability evidence is valid; or
• that a license, payment, entitlement, or identity transaction occurred.

A valid unknown signer is therefore shown as portable, not trusted. Namespace trust requires a verified trust-registry key and the DNS-TXT or GitHub-OIDC proof defined by the standard.

For a cartridge, download first and verify locally:

acx verify downloaded-agent.acx
acx spec downloaded-agent.acx
acx load downloaded-agent.acx --print-only

For JSON artifacts, repeat the browser result with the CLI before operational use:

acx workflow verify downloaded.cal.json
acx graph verify downloaded.agent-graph.json
acx graph digest downloaded.agent-graph.json

graph digest hashes the unsigned JCS form — the entire document with only top-level integrity removed. It is the digest pinned by Agent Graph lineage and workflow dependencies.

Remix safely in Studio¶

Studio is a local-first authoring surface included in the static build. It can start an Agent Graph or workflow from scratch, import a signed JSON artifact, and turn it into an unsigned remix:

1. the parent's integrity block is removed;
2. the parent publisher/id/version/digest is retained under signed lineage;
3. the draft receives a new identity before signing;
4. edits stay in browser memory unless you explicitly save locally; and
5. export produces JSON and an exact CLI handoff, never a registry write.

No private key belongs in a browser editor. Sign and verify the exported file locally:

acx graph lint my-remix.agent-graph.json --publish
acx graph sign my-remix.agent-graph.json \
  --publisher io.github.yourhandle \
  --out my-remix.signed.agent-graph.json
acx graph verify my-remix.signed.agent-graph.json
acx share graph my-remix.signed.agent-graph.json --dry-run

The same sequence works with workflow lint, workflow sign, workflow verify, and share workflow.

Lifecycle status and dependency safety¶

Published bytes remain immutable. The separate registry/status.json ledger can mark their digest-pinned identity deprecated, withdrawn, or superseded, with a reason and optional successor. The Exchange shows that warning before download. Status is registry advice, not cryptographic revocation; key and level credential revocation have their own verification paths.

A published Agent Graph pins each ACX Workflow dependency by publisher, id, version, and digest. The registry build resolves that exact coordinate and fails on a missing or mismatched dependency. It never falls forward to “latest.” This keeps a graph's reporting and convergence architecture attached to the exact task loops its author reviewed.

Build it anywhere¶

Build the validated registry projection and then the static app:

node --experimental-sqlite tools/build-registry-index.mjs
node --experimental-sqlite tools/build-static-exchange.mjs
# output: dist/exchange/

Choose any output directory and an optional public base URL for canonical/Open Graph metadata:

node --experimental-sqlite tools/build-static-exchange.mjs \
  --out docs-site/site/exchange \
  --site-url https://lboel.github.io/acx/exchange/

All runtime links are relative, so copying the output directory to another host or subpath does not require a JavaScript rebuild. The optional --site-url affects share metadata, not routing.

The build treats registry/index.json as an allowlist but never trusts it blindly. It independently re-verifies signed workflow/graph JSON and opens each cartridge read-only to check live ROM trust, its closed package profile, ROM-only publication state, publisher/id/version binding, and ROM digest. It then refuses traversal and symlink escapes, copies authoritative bytes unchanged, and writes manifest.json with output digests. Stable detail pages remain understandable without JavaScript and carry useful share metadata.

Publish the remix¶

The browser never writes to the registry. Publication stays an ordinary reviewable git operation:

acx share graph my-remix.signed.agent-graph.json --dry-run
acx share graph my-remix.signed.agent-graph.json
node --experimental-sqlite tools/build-registry-index.mjs
npm test
git diff --check
git diff -- registry/

The pull-request gate compares canonical artifact paths with the exact base commit, refuses modification, deletion, or rename of an accepted release, and then re-verifies live bytes, publication metadata, signatures, lineage, pinned dependencies, the status ledger, and the generated index. Human review decides namespace evidence, license fit, usefulness, and community policy.

See also¶

• Share ACX — the short human and agent-native PR flow.
• Sharing over git — immutable paths, index, status ledger, and CI contract.
• Agent Graph — fuzzy information architecture with hard invariants.
• Conditional Agentic Loops — bounded multi-agent task graphs.
• Signing & trust — what portable, trusted, and tampered mean.