eatp-reference

Install kailash, create an InMemoryTrustStore or FilesystemStore, implement the AuthorityRegistryProtocol with all three methods, then call ops.establish() with an agent ID, authority ID, and capability requests. Follow with verify, delegate, and audit operations.

OAuth and OIDC handle user authentication, and SPIFFE/SPIRE handle service identity. EATP adds agent trust delegation with constraint tightening, autonomy governance, and unbroken cryptographic chains tracing every action back to human authority.

The kailash trust crypto function returns (private_key_base64, public_key_base64) with the private key first, which is the reverse of many libraries. Swapping the order causes silent signature verification failures, so always unpack private first.

BudgetTracker uses integer microdollars and a two-phase reserve-then-record lifecycle that fails closed when funds are insufficient. Threshold callbacks fire at 80%, 95%, and exhaustion, and SQLiteBudgetStore provides crash-safe persistence.

At STANDARD verification level, a missing reasoning trace produces a warning violation with valid=True. At FULL level, it becomes a hard failure with valid=False, blocking the action until a reasoning trace is attached.

The SDK is a policy decision point only; your application must enforce BLOCKED and HELD verdicts. FilesystemStore is single-process only, there is no built-in production authority registry, and PostgresTrustStore requires the separate kailash-kaizen package.