[ 07 ] Reference

Reference gateway

The reference gateway is a standard-library-only Python HTTP server that translates local client calls into VACT-P envelopes and serves the core coordination endpoints defined by the spec's HTTP binding (§25).

Well-known Agent Passport

Every conformant agent gateway exposes its Agent Passport at a standard well-known URL, advertising endpoints, keys, and capabilities:

GET /.well-known/vact-agent.json

API endpoints

Served under /vact-p/v0.1/:

POST /messages

Submit a signed envelope to the gateway. Standard headers include X-VACT-P-Demo-Public-Key for TOFU key registries in this reference implementation.

GET /tasks/{task_id}

Retrieve current task state and transition history.

POST /tasks/{task_id}/cancel

Request safe cancellation of a pending task.

GET /receipts/{receipt_id}

Query a cryptographic proof of execution, policy decision, evaluation, or settlement.

GET /revocations/{object_id}

Resolve revocation checks for passports, mandates, and delegations.

A market implementation may additionally expose:

GET  /vact-p/v0.1/offers
POST /vact-p/v0.1/quotes
POST /vact-p/v0.1/contracts
POST /vact-p/v0.1/settlements

Authentication

HTTP transport must use TLS. High-assurance deployments should use mutually authenticated TLS with workload identities or sender-constrained OAuth tokens. Transport authentication never replaces object signatures — see Security & threat model.

Response codes

Code	Meaning
`200`	Successful query
`202`	Task accepted asynchronously
`400`	Invalid object
`401`	Transport authentication failed
`403`	Authorization or policy denied
`409`	State or idempotency conflict
`410`	Expired or revoked
`422`	Semantically invalid contract or transition
`429`	Rate or budget limit
`503`	Temporary unavailability

Every error should include a signed VACT-P error object when the requester was authenticated.

Run it locally

Start the reference gateway on port 8402:

make gateway

Then resolve its Passport:

curl http://localhost:8402/.well-known/vact-agent.json

Scope

This reference gateway implements the Phase 1 core trust surface only — messages, tasks, receipts, and revocations. Market endpoints (offers, quotes, contracts, settlements) are part of the Phase 3 roadmap.

Previous← Security & threat model NextSDK reference →