§ protocol

AKTP

Agentic Knowledge Transfer Protocol

An open protocol for AI agents to discover, verify, and transfer operational knowledge (skills, evals, environments, datasets) across independent domains. What HTTP did for documents, AKTP does for agent capability: anyone can host, anyone can index, anyone can build on top. Federated networks like the AT Protocol served as inspiration.

§ the problem

Agents improve. Alone.

A good skill written today lives trapped in a repository, a proprietary marketplace, or one tool's config directory. Whoever starts using an agent today starts from zero: the knowledge the community has already accumulated has no common format to circulate in, be verified with, or be improved by strangers.

Fragmented distribution

Every harness has its own directory, format, and channel. There is no common layer underneath.

Trust doesn't travel

A security scan, a human review, or an eval score produced in one place cannot be verified anywhere else.

Purchases aren't portable

Buying access on a marketplace chains the buyer to that marketplace. If it dies, the access dies with it.

The central idea: the network exists, and the improvement loop exists. Everything else is nodes talking to nodes. The network must be able to exist without any one company; anyone may run a node, build a client, or operate a competing index.

§ how it works

Two JSON documents over HTTPS

A node is anything that serves two JSON documents: a Next.js route, a static file on a CDN, or a full backend are equally valid nodes. Indexes crawl nodes permissionlessly; clients (CLIs, agents) consume whichever view they prefer.

Hosting is permissionless. Indexing is each index's policy. Consuming is each client's choice.

Publish a discovery document on your domain Owning the domain is owning the identity. No signup, no permission asked.
Point it at a feed of your listings Each item declares source, bundle (sha256 hash), license, and purchase mode.
Indexes crawl and apply their own policy Security scans, review, ranking: each index decides what it promotes. Rejection by one index never removes content from your node.
Agents discover, verify the hash, and install Bundles are content-addressed: any mirror can serve them, integrity is verifiable offline.

`GET https://{host}/.well-known/aktp.json`

{
  "aktp_node": 0,
  "name": "AI Hero",
  "operator_url": "https://www.aihero.dev",
  "feed_url": "https://www.aihero.dev/feed.json",
  "contact": "mailto:[email protected]"
}

The discovery document: small (≤16 KiB), HTTPS only, unknown fields ignored (forward compatibility).

A feed listing item

{
  "id": "evalite-basics",
  "title": "Evalite Basics",
  "original_author": "mattpocock",
  "license_spdx": "MIT",
  "source": {"type": "github", "owner": "mattpocock",
             "repo": "skills", "subpath": "evalite"},
  "bundle": {"url": "https://cdn…tar.gz",
             "sha256": "9f2c…"},
  "purchase": {"mode": "free"},
  "content_type": "sh.logion.skill"
}

Canonical identity: gh:owner/repo#subpath when a repository exists, node:{host}/{id} when it doesn't.

Hosting = speech (permissionless)

Anyone runs a node with any content, any store rules, any payment rails, any curation. Your node, your rules.

Indexing = reach (policy)

Appearing in an index is conditioned on that index's scanners and moderation. Other indexes, other policies. Rejection never deletes anything at the origin node.

The authority rule that shapes everything: the right to route payment is born from the claim, never from the crawl. Any index may crawl any feed (attributed content, never sellable), but only the domain-verified owner can attach their own store as the purchase rail for their own content.

§ attestations

Attested by anyone. Checked by everyone.

This is the core of the trust model. An artifact accumulates attestations: signed statements about it that its author does not control: it passed these scanners, a human reviewed it, an eval scored it, a bounty improvement was accepted, it works, it is safe. The protocol freezes only the envelope: what is signed and how signatures verify. Which kinds of attestation exist is an open vocabulary: any company can attest to any artifact under its own domain, no permission asked.

Attestation types are namespaced by domain ownership (reverse-DNS): owning a domain is owning a vocabulary. Nobody asks the protocol for permission.

Evidence anyone can produce

Functionality, security, compliance, benchmark scores, insurance coverage, each attested by whoever stakes their name on it, signed with their key, bound to a content hash.

Judgment stays local

Verifiers ignore attestation types they don't recognize. Each index chooses which attestations carry ranking weight. Evidence is global; judgment is each index's own.

No blessed authority

There is no single score and no central gatekeeper of truth. A network that taxed or licensed its attestors would depend on its owner, which contradicts the thesis.

§ layering

What is protocol, what is business

format + evidence = protocol global, open: feeds, manifests, hashes, attestations, credentials

service + money = node-local each node, its own rails: checkout, escrow, payout

vocabulary = namespace permissionless: owning a domain is owning a namespace

Money never crosses nodes; improvements, evidence, and attestations do. The frozen core is tiny on purpose: canonical identity, content addressing, the attestation envelope, and the must-ignore rule. Everything else extends without asking.

unknown purchase mode → kept, link-only unknown content type → "unscanned format" label unknown attestation → shown, zero ranking weight unknown field → ignored unknown protocol version → loud hard-fail, on purpose

§ portable access

Buy at any node. Install anywhere.

AKTP sells access, so it needs one object most open protocols never defined: the signed entitlement credential: a proof of purchase that any node or client can verify offline, and that belongs to the buyer, not to the marketplace.

Refunds emit revocations on the node's event stream; buyers never present their own revocations. A public purchase graph is not acceptable by default; the credential travels with the buyer, never in a firehose.

§ the loop

A network that improves itself

Without the improvement loop, AKTP would be just a decentralized marketplace. The point of the network is different: every accepted improvement becomes the whole network's new starting point: whoever joins today starts at today's level, never from zero.

Bounties can never be disabled by a node; a creator chooses whether to fund them, never whether the community may open them. Divergence between original and community-improved versions is always disclosed.

§ stages

From static to federated

Stage	What exists	Purchase story
v0 (indexed stores)	`/.well-known/aktp.json` + feed spec; permissionless crawl; domain-verified claims route sales	No credential needed: purchase and consumption both happen at the creator's node; the index links out
v1 (signed feeds)	Per-node keys, signed feeds/manifests, node registry, append-only event logs (cursor-based incremental sync; updates propagate without recrawls), readable attestations	Still link-out; signatures make mirroring and tampering detectable
v2 (portable entitlements)	Credentials + revocation + archived keys; agent-native settlement as one more adapter	Buy at any node, install anywhere
v3 (federation)	Node sync, mirrors, trust levels, cross-node reads	Cross-node payments stay out of the protocol, by design

Status today: the node-feed spec (v0) is in development in this repository. Logion's marketplace already runs on the protocol-ready foundations: immutable versions, content hashes, portable bundles. Logion operates the reference index and the first client; a position earned operationally, never imposed by the protocol. Namespaces like sh.logion.* are that node's own identifiers, exactly what the extension model gives every participant.