Skip to content

[meta] JWKS adoption baseline gates signal-payment chain-of-custody work (Track A.0) #4206

@EvgenyAndroid

Description

@EvgenyAndroid

Context

Multi-agent signal payment chain-of-custody (discussed in the Signals &
Measurement WG) requires every non-terminal node in the payment chain to
publish RFC 9421 signing keys via brand.jsonjwks_uri with
adcp_use: "webhook-signing". This makes JWKS publication a hard
prerequisite for Track A (signed receipts + chain-of-custody) landing
with meaningful ecosystem coverage. Design specifics — including
prev_receipt_hashes[] for DAG-shaped chains in modeled-lookalike pipelines,
hybrid termination (default-by-data-category + per-pricing-option opt-out),
and chain-pruning detection via upstream verification — are in the linked
discussion. The schema-side scope is non-trivial but contained.

Current adoption data makes that prerequisite concrete.

Empirical baseline

Source: adcp.signal-stack.io federation probe, May 7, 2026, 19 peers

Surface Adoption
Reachable MCP endpoint 84% (16/19)
Publishes adagents.json 10% (2/19)
Schema-valid 3.0.6 adagents.json 0% (0/19)
JWKS with webhook-signing keys TBD — not yet probed

adagents.json publication is at 10%; schema-valid publication is at 0%.
JWKS adoption is almost certainly lower. Track A schema work shipping into
this environment lands into a vacuum.

Three concrete asks

1. Confirm the threshold
Propose ≥30% of directory-listed agents publishing valid JWKS with
adcp_use: "webhook-signing" keys before Track A schema work lands.
WG negotiates the number; getting any number on record is the win.

Note: this is a domain-specific threshold for signals-payment work only.
The broader webhook migration threshold (all agent-to-agent comms, proposed
≥80% before HMAC removal in 4.0) is tracked separately in #ISSUE1. WG
should set both numbers independently.

2. Instrumentation
Extend the AdCP daily watcher (or the directory itself) to probe peer JWKS
endpoints alongside adagents.json validation. The federation probe that
produced the data above is ~3 lines of additional config in
.github/adcp-watch-config.json. Happy to contribute upstream if there is
a directory-side telemetry repo to target.

3. Cross-reference
This issue and #ISSUE1 (webhook signing migration coordination) share
concerns — adoption telemetry, threshold-setting, and algorithm alignment
both affect this work. WG should treat them as a pair. Specifically: the
DRI identified in #ISSUE1 should be in the room for Track A.0 scope
discussions.

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    claude-triagedIssue has been triaged by the Claude Code triage routine. Remove to re-triage.governanceIssue concerns the governance protocol domainsignalsIssue concerns the signals protocol domain

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions