# VAGP 0.3 — public evidence summary

Snapshot: 19 September 2026. Implementation examined: 36420c9 (SH-02).

VAGP 0.3 is a public open protocol and implemented reference profile, not a production deployment or an independently certified standard. It has 15 normative principles and 13 invariants and is released as v0.3.0 under Apache-2.0.

## Versioned history

- Initial implementation: b3b697b.
- Independent validation identified enforcement defects and inadequate regression protection. The review was not an unconditional security endorsement.
- First hardening: bb18346, addressing concurrent revision rollback, signed intent verification and ambiguous provider outcomes.
- Independent retest: assessed bb18346 and identified remaining regression, persistence classification and signature-vector work.
- SH-02: 36420c9, with follow-on security tests, persistence failure classification, fixed Ed25519/EdDSA evidence vectors, P15 Evidence Certainty and V-13 Monotonic Trusted State.

The independent retest predates SH-02. This summary makes no claim of a subsequent independent retest or certification of SH-02. Repository test totals are intentionally omitted; a count alone does not establish security adequacy.

## What the implementation establishes

Exact attested Agent DNA and revision binding; deterministic authority evaluation; non-amplifying delegation; single-use permit enforcement; verified and persisted signed intent before provider I/O; linked signed outcomes that preserve observed certainty; retirement of old trusted revisions across concurrent access and restart.

Attestation proves the trusted issuer's assertion. Independent admission or observation must establish correspondence between the attested manifest and the applied runtime. The issuer and its signing authority must remain isolated from the agent runtime.

## Boundaries

- Public /v1 remains VAGP 0.2. No public 0.3 admission API was added.
- Google Cloud and Microsoft Azure live PoVs demonstrate the frozen 0.2 model, not the 0.3 profile.
- Execution grants and permits are process-local, not portable bearer credentials.
- Multiple-proof policy and authentication of lineage evidence references remain deferred. Lineage grants no authority.
- Durable local reference state is not a claim of a production distributed control plane.
- Website interactions are educational simulations. They invoke no provider, protocol evaluator or signing service.

## Canonical public sources

Public repository: https://github.com/verimand/vagp

Release: https://github.com/verimand/vagp/releases/tag/v0.3.0

Security contact: verimand.dev@gmail.com

Selected public paths:

- protocol/specification/VAGP-0.3.md
- docs/adr/ADR-035-agent-dna-and-vagp-0.3.md
- docs/reviews/VAGP-0.3-INDEPENDENT-VALIDATION.md
- docs/reviews/VAGP-0.3-INDEPENDENT-VALIDATION-RETEST.md
- docs/reviews/VAGP-0.3-SH-02-REMEDIATION.md

VAGP remains vendor-, infrastructure- and jurisdiction-neutral. Publication/reuse terms are not yet specified.