# AgentProof Millennium Architecture

## Objective

Design autonomous transaction trust so a record created today can still be interpreted after present-day payment rails, blockchains, models, clouds, and companies are obsolete.

## Architecture

### 1. The Permanent Record Layer
Agent Transaction Passport™ (ATP) carries authority, evidence, agreement, fulfillment, settlement, attestations, and integrity references.

### 2. The Resolution Layer
Autonomous Trust Resolution answers one narrow question:

> Given this principal, agent, mandate, counterparty, action, transaction context, evidence, and policy: may this action proceed now?

Resolution outputs are ephemeral decisions with durable proofs. A resolution is not eternal permission.

### 3. The Trust Graph Layer
The operating network accumulates privacy-preserving relationships among principals, agents, credentials, counterparties, outcomes, disputes, fulfillments, revocations, and prior resolutions.

Public protocol. Proprietary intelligence.

### 4. The Outcome Layer
Long-term defensibility comes from connecting pre-transaction resolutions to later outcomes. The most valuable asset is not the resolver code; it is centuries of evidence about which conditions led to success, failure, fraud, dispute, or loss.

### 5. The Recourse Layer
Where legally and commercially appropriate, third-party capital or regulated partners can stand behind selected resolutions. Recourse is modular and never required by the base protocol.

## Cryptographic succession

No hash or signature algorithm is assumed eternal.

Future records should support:
```json
{
  "integrity": {
    "canonicalization": "named-method",
    "digests": [
      {"alg": "sha-256", "value": "..."},
      {"alg": "future-algorithm", "value": "..."}
    ]
  }
}
```

When an algorithm weakens, records are re-attested by hashing the original canonical object with stronger algorithms without altering the historical object.

## Time succession

Wall-clock timestamps are useful but not absolute truth. Long-lived records may carry multiple independent time attestations. A future verifier should distinguish:
- claimed event time;
- issuer time;
- settlement time;
- independent timestamp attestations;
- migration/re-attestation time.

## Identifier succession

Identifiers must be typed. DNS names, DIDs, legal identifiers, wallet addresses, public keys, account IDs, and future schemes may all expire. Records therefore keep historical identifiers while allowing later equivalence attestations and successor mappings.

## Federation

There is deliberately no single mandatory global root.

A resolver can combine:
- principal policy;
- enterprise policy;
- jurisdictional rules;
- credential-recognition rules;
- counterparty policy;
- recourse requirements;
- AgentProof network intelligence.

The result names the policy set used. Different ecosystems may reach different decisions from the same evidence without corrupting the underlying historical record.

## Failure model

AgentProof must assume:
- our domain can disappear;
- our database can disappear;
- our company can disappear;
- a blockchain can halt;
- a country can split;
- an algorithm can break;
- a standard body can dissolve;
- a currency can vanish.

The recovery answer is always the same: **self-describing exported records + open validation rules + cryptographic migration + independent implementations.**