RTTP and IQA.
Two open URI scheme specifications, with reference implementations you can check yourself. Everything on this page is either a link you can follow or a command you can run.
Last updated: 22 October 2026 · append-only: entries are added with dates, none are rewritten
1. Reviewer brief
The problem
Machine-to-machine communication inherits the web's trust model in exactly two places: who you are depends on a name registry you must query, and what you signed depends on an issuer you must trust. In constrained, air-gapped or adversarial environments those two dependencies are precisely the parts that are unavailable, seized or untrustworthy - so verification either fails open or fails entirely, where it matters most.
What the two specifications do
RTTP - intent addressing. A URI of the form rttp://<authority>/<action> names a claim of intent directed at an identified subject. The subject address is derived by computation from the authority, so no registry, resolver or lookup service is consulted. Agent-to-agent messages use a fixed 128-byte PulseHeader128 frame; extension space sits in bytes that were already zero, so older readers keep working. Specification: rttp.com/AICENT-002/.
IQA - subject-attestation addressing. A URI of the form iqa://<subject>.<organ>.<root>[/<action>] names the attestation standing of a subject, as reported by one of three named authority organs. The organ set and the four actions are closed sets; the URI carries no proof and no credential. Specification: iqa.org/AICENT-009/.
Common design rules. Malformed input is rejected, never normalised. There is no userinfo, no port, no query and no fragment, so there is no field in which to place a credential. Neither specification defines a reporting endpoint, a resolver or an account.
Status as of 14 October 2026
| Item | State |
|---|---|
rttp URI scheme, IANA registration |
Ticket #1459939, created 2026-09-16 (IANA-Prot-Param); registered 2026-09-22 as Provisional; CRI 27 |
iqa URI scheme, IANA registration |
Ticket #1459963, created 2026-09-16 (IANA-Prot-Param); scheme name approved by the URI scheme expert (2026-09-23); registered 2026-10-13 as Provisional; CRI 28 |
| Internet-Drafts | draft-li-rttp-iqa-addressing-00 — The rttp and iqa URI Schemes: Derived-Address Intent and Attestation Addressing; Independent Submission, Informational; posted 24 September 2026 |
| Implementations | Three per protocol (Python, JavaScript, Rust), no shared code; zero dependencies by default |
| Distribution | PyPI rttp 1.3.1 / iqa-org 1.3.1; npm @aicent/rttp 1.3.1 / @aicent/iqa 1.3.1; crates.io rttp / iqa-org 1.3.1 (first formal release) |
| Licence | Code Apache-2.0; specifications published openly |
You can check these claims directly in the IANA URI scheme registry: the rttp row is present, registered as Provisional; the iqa row is present as well (Provisional, CRI 28, added 2026-10-13).
What we are not claiming
- No RFC yet; not on the Standards Track -
rttpis registered as Provisional (CRI 27); theiqascheme is likewise registered (Provisional, CRI 28). - Specifications with reference implementations, not a product; there are no commercial customers.
- No transport layer and no client library.
- Post-quantum and staking/economics mechanisms are out of scope and not implemented, and the specifications say so in writing.
- Package downloads are not presented as adoption: today they are dominated by automated infrastructure traffic.
- An
iqaURI names the subject being attested, so the scheme cannot be used for anonymous reference - stated in the draft's privacy section.
2. Public record
Every entry below is dated and carries the evidence needed to check it. Entries are listed newest first. The record is kept for milestones, not for routine site maintenance; nothing here is a projection or a plan.
| Date | Entry | Evidence |
|---|---|---|
| 2026-10-22 | Three-axis scope declaration posted to the W3C Agent Protocol CG (post 0015). On the record: we claim evidence freshness and authority validity; action-time authorization is deliberately not claimed (by design). Dual-mode results were pre-registered: a cached lease read completes offline and passes at T=119 s; a live standing-read that cannot reach its organ fails closed. | lists.w3.org · post 0015 |
| 2026-10-22 | uber/ADR#163: rugsnare (Paraphern) confirmed that attestation/verdict separation is "a primitive we already run in production". Our public reply posted with freshly measured vectors (RTTP self-test 83/83 on PyPI rttp 1.3.1; conformance vectors 35/35 on npm @aicent/rttp 1.3.1) and accepted the offer to compare receipt formats (PIN-SPEC §3.2 vs sealed envelopes). | github.com/uber/ADR · issue #163 |
| 2026-10-22 | Sealed-envelope evidence set re-verified.
All 22 sealed verdicts on /sealed-mcp/ (AE-128 envelopes, organ forge, 30-day leases) verify offline, unchanged. |
iqa.org/sealed-mcp/ |
| 2026-10-21 | Convergence on the W3C Agent Protocol CG list. Tymofii (APS) proposed a three-axis conformance frame plus LF conformance-suite participation (0013); Larry (sovrlabs) independently proposed a three-axis conformance frame and a joint experiment (0014). | post 0013 · post 0014 |
| 2026-10-21 | Our four questions on agent addressing and authorization posted to the W3C Agent Protocol CG (post 0009). Tymofii (APS) replied (0011); our first answers posted (0012). | post 0009 · 0011 · 0012 |
| 2026-10-18 | Site rollback incident — detected and fully restored. During a site-wide footer revision on this date, part of the site was briefly served from outdated working copies; the rollback was detected and every affected page was restored to its current state and verified on 2026-10-19. | iqa.org · rttp.com |
| 2026-10-17 | Three page seals re-issued after a site-wide navigation and footer revision — the dogfood pipeline re-run end to end. Page seals are content-bound (the subject is the SHA-256 of the page with the attestation block stripped), so the navigation rewrite — a unified swipe-strip navbar on both pillars, the blog link moved to aicent.com/blog, footer versions aligned to 1.3.1 and whitepaper v0.6 — invalidated the seals on iqa.org, iqa.org/MCP/ and rttp.com. All three were re-signed by the forge organ and re-uploaded; organ state and the live production record are byte-identical again, and the full audit passes (production 35/35 radiant, offline verify 35/35, release bundle 32/32, deep artifact re-download 32/32, tamper → REJECT). /sealed-mcp/ was outside the revision and still verifies unchanged. | iqa.org · iqa.org/MCP · rttp.com · organ-api/v1/production · /attestations/ |
| 2026-10-13 | iqa is registered — the dual pillars now hold consecutive CRI numbers in the IANA "URI Schemes" registry. The registry row went live as Provisional, CRI 28 (rttp at CRI 27), Reference bound to the combined Internet-Draft. | iana.org/assignments/uri-schemes/prov/iqa |
| 2026-10-11 | iqa-mcp reaches 1.0.2 — MCP tool annotations across all three registries. All four tools now carry machine-readable MCP tool annotations (readOnlyHint=true, destructiveHint=false, idempotentHint=true, openWorldHint=false) — the pure-computation contract in the form directories read. Ships on PyPI (wheel + sdist), npm launcher, crates.io launcher and GitHub Releases v1.0.2 with wheel + sdist assets. Release bundle 28 → 32, organ state 33 → 35, all verifiable offline via /attestations/; the downloads mirror gained the 1.0.2 launcher files. | pypi.org/project/iqa-mcp/1.0.2 · npmjs.com/package/iqa-mcp · crates.io/crates/iqa-mcp · github Releases v1.0.2 |
| 2026-10-11 | iqa-mcp listed on the M8ven Trust Index — claimed and Verified Publisher. A third-party MCP security index crawled, inspected and listed iqa-mcp on its own initiative: static checks reported no credential leakage, no sensitive-file access and no code obfuscation. The listing was claimed by proving the publisher address and repository write access, and the README now carries the live M8ven Verified badge. The index's one quality finding — missing MCP tool annotations — shipped as 1.0.2 the same day. | m8ven.ai/mcp/aicent-stack/iqa-mcp · github.com/Aicent-Stack/iqa-mcp |
| 2026-10-09 | iqa-mcp reaches 1.0.1 — the attestation toolchain goes stable across four platforms. The MCP tool package now ships as 1.0.1 on PyPI (wheel + sdist), npm (launcher), crates.io (launcher) and GitHub Releases — one 1.0.x family, cross-registry. The self-test became transport-agnostic (python -m test_mcp resolves the installed console script, a source checkout or IQA_MCP_CMD), the npm/crates launchers spawn the installed server instead of demanding a checkout path, and every published artifact is sealed by the forge organ: release bundle 24 → 27 records, all verifiable offline via /attestations/. |
pypi.org/project/iqa-mcp · npmjs.com/package/iqa-mcp · crates.io/crates/iqa-mcp · github Releases v1.0.1 |
| 2026-10-08 | iqa-mcp goes live — the IQA attestation primitives become native MCP tools. With agent platforms converging on MCP (Microsoft's agent OS, Google's Antigravity, Uber's MCP Gateway at 800+ servers and 5000+ tools), the trust-semantics layer was the missing piece: what intent is being addressed, and whether the counterparty has standing — verifiable without a network call. iqa-mcp exposes four tools (derive_route_shard, parse_envelope, verify_envelope, published_vector) as a thin, stateless wrapper around the published iqa-org 1.3.1 reference implementation. Seven-assertion protocol self-test passes on Python 3.11–3.13, including a live tamper → REJECT; CI green on every commit. Published to PyPI as 0.1.0 (Apache-2.0); GitHub source byte-identical to the PyPI artifacts; the official tool page is iqa.org/MCP/. No change to the schemes themselves — zero spec edits, zero I-D revisions. | github.com/Aicent-Stack/iqa-mcp · PyPI: iqa-mcp 0.1.0 · iqa.org/MCP |
| 2026-10-07 | The Delegation Stress Test goes live — delegation with attenuation, five stacks, the honest gap on stage. The sharper question — Agent A grants €10,000, Agent B attenuates to €2,000 and delegates onward to a Payment Agent — gets its own page: nine delegation fields walked under four stacks, with the AE-128 frame's missing amount field shown live as the stated gap (“a comparison that hides its own weakness is advertising, not research”). A fifth composition stack (capability macaroon + RTTP/IQA envelopes) then runs ten verification items, each labeled cryptographically bound or application policy, and demonstrates the combination offline end to end: 0 network round-trips, 0 third parties, 10 real crypto steps — with €2,000 committing as a chained caveat MAC and both tamper attacks failing closed. | iqa.org/demo/delegation/ · whitepaper §4.4 (exploratory candidate marker) |
| 2026-10-07 | Stack Compare goes live — an outside reviewer's question becomes a runnable experiment. Asked whether RTTP + IQA is a new primitive or renamed syntax, the page walks one agent scenario (Agent A → Agent B → Payment Agent) through eleven trust fields — discovery, identity, intent, authentication, attestation, authorization, delegation, replay, revocation, audit, routing — under four stacks: A2A + HTTPS/OAuth, A2A + DID/VC, A2A + capability token, and A2A + RTTP/IQA. Network round-trip and third-party counters run on every field; the RTTP/IQA column executes real browser crypto (shard derivation, envelope HMAC verification, the policy gate, fail-closed revocation) and finishes with 0 round-trips, 0 third parties, offline-verifiable — the other three stacks each require a trusted online party at the moments that matter. | iqa.org/demo/compare/ · the sequel: delegation stress test |
| 2026-10-06 | IANA completed the rttp template update — the registry row for rttp (CRI 27) now binds to the combined Internet-Draft.
Per the confirmation sent 2026-10-03 (ticket [IANA #1460928]), the template's document reference now reads draft-li-rttp-iqa-addressing and the registration's Reference field points at rttp.com/AICENT-002/. The iqa side (ticket [IANA #1459963], name kept on 2026-09-23) remains with the CRI experts; the series-URL suggestion of 2026-10-01 applies to both rows, so both will cite the current revision as later drafts are published. |
datatracker: draft-li-rttp-iqa-addressing-00 · IANA registry: uri-schemes |
| 2026-10-05 | The Package Archive goes live — every released artifact of both schemes, on our own domains. iqa.org/downloads/ and rttp.com/downloads/ now host all 18 published artifacts (three versions × three registries per scheme), each with a SHA-256 sidecar and a live organ seal; the seal bundle sits on the same domain, so the verify loop is fully self-contained — no registry round-trip required. Policy, on the record: release 1.2.7 (a springboard, byte-identical to 1.2.8, yanked) and the pre-three-language 0.1.x / 1.2.1–1.2.5-alpha releases are not archived; the archive is append-only. Six new 1.2.6 seals were issued for the wave the registries predate the archive. | iqa.org/downloads/ · rttp.com/downloads/ · /organ-api/v1/production (count: 20) |
| 2026-10-05 | Dual-site alignment completed — both pillars’ sites now speak one version. rttp.com: home, /URI/ and /README/ de-pre-released (cargo/npm/PyPI at 1.3.1; crates.io first formal), /URI/ gained a V1.3.1 tab as its default, and /AICENT-002/ gained a working four-tab version bar — the tab buttons had never been rendered, so the V1.2.6 reading and the stack narrative were unreachable until tonight. iqa.org: the envelope demo now carries a live AE-128 verifier (browser crypto.subtle, byte-exact vector replay), and the docs / README / open / demo pages had their narratives aligned. Footers unified on both sites (iqa 17 pages, rttp 5 — the rttp footer had shipped as two split blocks, one of them CSS-only). The rttp.com homepage was re-sealed by the organ after the edit; the live seal verifies. | rttp.com · rttp.com/AICENT-002/ · iqa.org/demo/envelope/ |
| 2026-10-05 | AE-128 goes public: companion draft (v0.3, public edition) and a live browser verifier. The draft’s wire-format sections (0–6: IQAE magic, the 128-octet layout, HMAC-SHA256 over the whole frame, the standing closed set at offset 80) and the published vector are now readable at iqa.org/AICENT-009/ae128-draft-v0.3.md; the implementation plan and change log stay in the project ledger and are deliberately not part of the public edition. The envelope demo gained a section 4: load AE128-VECTOR-1, and the browser rebuilds the 128-byte frame from the documented parameters alone and verifies the seal offline. | iqa.org/AICENT-009/ae128-draft-v0.3.md · iqa.org/demo/envelope/ |
| 2026-10-05 | Six 1.3.1 release seals signed — the organ’s production record grows from 8 to 14 subjects. organ forge signed real Ed25519 envelopes over every 1.3.1 artifact (rttp and iqa-org on PyPI, npm and crates.io; subject = SHA-256[0:16] of the artifact). The seal bundle is append-only: the six 1.2.8-wave seals remain. Every new seal was verified offline and every artifact re-downloaded from its registry with the SHA-256 recomputed — all match. The public page lists both waves and its verification command is pinned to the released version. | iqa.org/attestations/ · /organ-api/v1/production (count: 14) |
| 2026-10-05 | v1.3.1 published on GitHub — full sources under URI/V1.3.1/ in both repositories, and CI caught a stale assertion. Aicent-Stack/iqa-org (49 files, three languages, the AE-128 tools) and Aicent-Stack/rttp (41 files) are public. The iqa-org CI ran 15 jobs across three languages and published-artifact verification; 9 failed — the check had caught a 1.2.8-era assertion (75/78 self-test counts) meeting the new 1.3.1 counts (108/111). Two grep lines fixed; 15/15 green. The record notes it because a red light that gets caught and fixed on the same day is exactly what that check exists for. | github.com/Aicent-Stack/iqa-org · github.com/Aicent-Stack/rttp |
| 2026-10-05 | v1.3.1 published on PyPI — iqa-org and rttp, sdist and wheel. Fresh-venv installs from the registry replay the published vectors byte for byte; self-test counts as documented (rttp 80 passed, 3 skipped / 83 with the Ed25519 backend; iqa 108 / 111). The iqa side ships the AE-128 envelope and its vector set inside the wheel. | pypi.org/project/iqa-org/1.3.1 · pypi.org/project/rttp/1.3.1 |
| 2026-10-05 | v1.3.1 published on npm — @aicent/iqa and @aicent/rttp. Both at 1.3.1, tag latest. @aicent/iqa carries the AE-128 envelope as a subpath export (./envelope) and the ae128 vector set inside the package. Registry smoke installs: one package added, zero dependencies, zero vulnerabilities, published vectors replayed byte for byte. | npmjs.com/package/@aicent/iqa · npmjs.com/package/@aicent/rttp |
| 2026-10-05 | v1.3.1 published on crates.io — the first formal (non-pre-release) release of both crates. iqa-org and rttp leave the -alpha era: plain requirements (cargo add iqa-org / cargo add rttp) now resolve. Third-party consumption from the registry copy: the AE-128 published vector reproduced byte for byte; ROUTE_SHARD 459e543b… derived identically. | crates.io/crates/iqa-org · crates.io/crates/rttp |
| 2026-10-03 | The replication test drew a public reply from Grok itself, confirming the record is recoverable without prior context. Replying publicly to the project's follow-up post, Grok stated that "the public specs, vectors and whitepaper make the URI grammar, action safety classes, 128-bit ROUTE_SHARD birthday bound at 2^64, and freshness window plus twice clock skew fully recoverable without prior context", and that the same sources surface "the offline intent-addressing and standing-attestation separation that DNS plus TLS leave open for agents" — the two structural gaps, independently restated, on the public thread, timestamped. | Grok's reply · the replication post |
| 2026-10-03 | The project's X account (@Aicent_com) was brought up to date with the dual-pillar record: a pinned 13-post timeline, a follow-up replication post, and a rebuilt profile. The pinned thread publishes the twelve-day record as a timeline — each post dated and linked to checkable evidence (registry rows, the combined Internet-Draft, the demo center, the standing vocabulary, the hash-committed freeze, the whitepaper, its security disclosures, and the dogfood pipeline) — closing on the conformance challenge. A standalone follow-up post records an independent replication test: an AI assistant, asked without leading, reproduced the grammar, safety table, birthday bound, freshness math, and the gap the schemes claim to fill (shared conversation linked from the post). The profile itself was rebuilt around the record: dual-pillar avatar and banner, the name "Aicent · RTTP × IQA", the bio "open URI schemes for agent addressing & standing attestation — checkable without asking us", and the website field pointing at this page. The X-era-of-record timeline links below; everything it cites is already on this page. | x.com/Aicent_com · pinned timeline · replication post |
| 2026-10-03 | Correction to the entry below: the reader who caught the missing [ed25519] extra was the project's own author testing on release day — not an external contributor.
Calling our own test "external feedback" and crediting it by name was self-congratulatory, and it has been removed from the attestations page. The credited by name mechanism stays reserved for what it was written for: external implementers and readers. The fix itself stands — the command now reads pip install "iqa-org[ed25519]==1.2.8" — and this correction is recorded because a record that never corrects itself is not a record. |
iqa.org/attestations · corrected note: "Caught on release day" |
| 2026-10-03 | First external feedback on the dogfood surface, received on release day — and credited by name.
A faithful reading of the attestations page found that its verify command omitted the [ed25519] extra: the envelopes are Ed25519, and a bare iqa-org install cannot verify them. The page and the homepage badges were fixed the same day. Per the conformance challenge's own rule — "a faithful reading that fails is our bug, credited by name" — the credit is lee@iqa.org, 2026-10-03. The fixed command is visible on the page itself. |
iqa.org/attestations · fixed command: pip install "iqa-org[ed25519]==1.2.8" |
| 2026-10-03 | Whitepaper v0.3 updated in place (no version bump): the evidence chain now records the dogfood pipeline. A new row in the whitepaper's evidence-chain table states that the first user of the schemes is the project itself — the deployment pipeline addressing 19 assets by rttp URIs, both homepages sealed, all six release artifacts sealed, and a production organ API answering 24/7 — with the roadmap clarifying that external adoption (first external seal) remains open by definition. Per this page's append-only discipline the earlier v0.3 entry stands as published; the four pipeline slices are recorded in the four entries below, and the added row is visible in the whitepaper's evidence chain. | iqa.org/whitepaper · /attestations/ · /organ-api/v1/production |
| 2026-10-03 | Slice 4 of the dogfood pipeline: the organ now serves its production seals over a live API. /organ-api/v1/production lists all eight production seals (two sealed homepages, six release artifacts); adding ?subject=<32-hex> returns the full Ed25519 envelope for one. The organ runs as a systemd service behind nginx, 24/7. The demo endpoints of the same service are unchanged (the disputed-subject scenario still operates). |
/organ-api/v1/production · /attestations/ |
| 2026-10-03 | Slice 3: all six published release artifacts are sealed by the project organ. The PyPI wheels/sdists, npm tarballs and crates.io files for rttp and iqa-org (1.2.8 / 1.2.8-alpha) each carry an Ed25519 envelope whose subject is the artifact's own SHA-256; the seal bundle and a one-command offline verification are published at iqa.org/attestations/. "This wheel is ours" is now a checkable claim, not an assertion. |
iqa.org/attestations · seal bundle (JSON) |
| 2026-10-03 | Slice 2: the two homepages are sealed by their own organ. Each page embeds an Ed25519 envelope whose subject is SHA-256[0:16] of the page with the seal block stripped — refetch, strip, recompute, verify: any byte changed anywhere on the page fails the check. The seals are archived envelopes (freshness checking off, per the package's archival mode) and verify offline with the published iqa-org package alone. |
iqa.org · rttp.com · verify with iqa-org |
| 2026-10-03 | Slice 1: the deployment pipeline now addresses its assets with rttp URIs. A deploy manifest covers 19 managed assets, each with an authority of the form <intent>.pillar.<root> and its derived ROUTE_SHARD, recomputed with the published rttp package before every deploy; a failed derivation check refuses the deploy. Example, recomputable by anyone: rttp://home.pillar.iqa/deploy → shard ee18bf7b3b5e2166… |
rttp 1.2.8 (PyPI) · derivation per I-D §4.4 |
| 2026-10-03 | Whitepaper working draft v0.3 published, superseding v0.2 with two security-disclosure sections. §2.5 discloses the 128-bit truncation parameter of the derived address: second-preimage resistance 2128, collision resistance 264 by the birthday bound, with the attack-chain analysis, the absence of known chosen-prefix shortcuts for SHA-256, and the rule that the 8-hex subject form MUST NOT be treated as a unique subject identifier. §3.5 discloses the trust-domain and timing dependencies: HMAC seals are intra-trust-domain by definition and cross-boundary paths use Ed25519 envelopes; the effective replay window is the freshness window plus twice the clock skew; and the two audit false-positive traps (timing drift is not misconduct; verdicts are organ-relative and do not transfer). Version numbering is aligned across header, footer and filename. The full texts of these disclosures were drafted for the -01 revision package and AICENT-002 v1.2.9, which remain their normative landing zones. | iqa.org/whitepaper · rttp.com/whitepaper |
| 2026-10-01 | The Agent Semantic Layer whitepaper published — the project's public narrative document, on both domains.
Working draft v0.2, a dual-register edition: an engineering register in which every figure traces to a public artifact (specifications, registry entries, vectors, packages), and a narrative register — the Aicent Stack lineage with the AICENT-000–015 roll call — explicitly labeled and anchored to the hash-committed freeze recorded in the entry below.
The AE-128 attestation envelope appears strictly as a roadmap artifact with a published draft layout.
Served at iqa.org/whitepaper/ and rttp.com/whitepaper/, reachable from the header navigation and footer of every subsite on both domains. |
iqa.org/whitepaper · rttp.com/whitepaper |
| 2026-10-01 | The frozen narrative archived: the 17-pillar Aicent Stack story put under a SHA-256 freeze manifest.
Per the Constitution's freeze annotation (2026-09-27), the seventeen-pillar Aicent Stack narrative is internal history; RTTP and IQA are the two pillars on the IANA/IETF track.
Version provenance: the public narrative documentation is v1.3.0 while the public stack code stops at v1.2.5 — the other pillars were never upgraded past it; RTTP and IQA were split out and advanced separately (packages v1.2.6 → v1.2.7 → v1.2.8 on PyPI/npm/crates/GitHub, specification at v1.2.10, rttp registered with CRI 27, iqa name approved with the CRI number in expert review).
The freeze manifest hashes, byte-exact: the Constitution (181762 B, a15a53f93191f329dcec305e0affd7eb…), the manifesto glossary (90718702673b84920f6a3236b7ad4b4d…), the two live v1.3.0 narrative sources (e7ffde3882b03477189fbd5d5e7f072f…, 833a37e854c236e6a256bbb21f109bad…), and SOVEREIGN_SHARD v1.4.0 (a72a8157338edf748c787e1b319941a5…); the archived code and documentation corpora (16 published v1.2.5-alpha crates, 21 repository READMEs) are hashed in the manifest.
Manifest self-hash (rev 3, 10476 B): f9746309157fc7aeab40c8a8107fe52f…. |
Recompute from the live sources: rttp v1.3.0 source · iqa v1.3.0 source · SOVEREIGN_SHARD_v1.4.0.md · crates.io: Aicent-com · GitHub org · manifest retained by the project |
| 2026-09-25 | A Demo Center opened at iqa.org/demo/ with four live scenarios for the two schemes. All four are non-normative and inspectable: an offline conformance sandbox (strict ABNF, ROUTE_SHARD derivation with the published-vector replay, Table 1 safety classes, an 18-case self-test); two independent agents exchanging real HTTP with a live organ endpoint whose attest/revoke/audit genuinely transition state; the browser and a real derivation service computing ROUTE_SHARD independently and matching byte for byte; and three organs holding organ-relative standing over one contested subject — the dispute scenario. |
Demo Center · sandbox · two agents + organ · derivation service · three-organs dispute |
| 2026-09-24 | The two schemes are now specified in a single combined Internet-Draft, and the Independent Submission Editor has taken it into his review stream. draft-li-rttp-iqa-addressing-00 (16 pages) was published on 2026-09-24, superseding draft-li-rttp-intent-addressing-01 and draft-li-iqa-subject-attestation-00. The same day it was accepted into the Independent Submission stream: stream "Independent Submission", ISE state "Submission Received", intended RFC status "Informational". |
datatracker · archive: txt · ISE stream page |
| 2026-09-23 | "rttp" added to the IANA URI Schemes registry as Provisional — with CRI 27. The registration was completed on 2026-09-22 with designated-expert approval. The assigned CRI 27 (allocated in the expert-review range) allows rttp URIs to be carried in the compact CBOR form used by constrained devices. The companion "iqa" request remains in IANA's validation queue. | registry: prov/rttp · URI Schemes registry |
| 2026-09-23 | Reference numbering upgraded: the canonical citation target for each scheme is now its scheme page. References across the project point at rttp.com/URI and iqa.org/URI rather than internal document-series paths — the stable entry points, carrying the release overview, live verification and the vectors in one place. The combined Internet-Draft now in preparation cites them in its References section. |
rttp.com/URI · iqa.org/URI |
| 2026-09-21 | v1.2.8 shipped across every channel - the largest conformance expansion to date. PyPI rttp 1.2.8 / iqa-org 1.2.8; npm @aicent/rttp 1.2.8 / @aicent/iqa 1.2.8; crates.io rttp 1.2.8-alpha / iqa-org 1.2.8-alpha. Asserted self-test counts grew to 80 (default) and 83 with the Ed25519 backend for rttp, 75 and 78 for iqa-org - the zero-dependency install of iqa-org 1.2.6 could not even complete its self-test (a NameError crash, fixed since 1.2.7). Both GitHub repositories went live with CI re-asserting every published count on push; the superseded 1.2.7 releases were yanked the same day. |
PyPI 1.2.8 · npm · crates.io · GitHub + CI · /URI/ |
| 2026-09-21 | This page published, as a permanent, linkable record. A one-page printable version (RTTP-IQA-reviewer-brief.pdf) is available at the bottom of this page. | You are reading it · RTTP-IQA-reviewer-brief.pdf |
| 2026-09-21 | Mail authentication completed for iqa.org: SPF, DKIM and a DMARC record are published. |
Run nslookup -type=txt _dmarc.iqa.org; expect v=DMARC1; p=none; rua=mailto:lee@iqa.org |
| 2026-09-20 | Two Internet-Drafts published: draft-li-rttp-intent-addressing-01 (12 pages) and draft-li-iqa-subject-attestation-00 (14 pages). Individual Submission, Informational. |
archive: rttp-01 · archive: iqa-00 · datatracker |
| 2026-09-20 | Website references updated: the pages on rttp.com now cite draft-li-rttp-intent-addressing-01 rather than the -00 revision. Five pages changed; links were left pointing at the datatracker series URL, so they follow the latest revision. |
See the document line in the footer at rttp.com, /AICENT-002/, /README/, /open/, /URI/ |
| 2026-09-19 | Reference implementations released: PyPI rttp 1.2.8 and iqa-org 1.2.8; npm @aicent/rttp 1.2.8 and @aicent/iqa 1.2.8. (crates.io rttp and iqa-org, pre-release 1.2.8-alpha, 2026-09-21.) |
PyPI rttp · PyPI iqa-org · docs.rs/rttp · sources |
| 2026-09-16 | IANA registration request submitted for the iqa URI scheme, ticket #1459963, under RFC 7595. Status: Validating Request; not registered. |
Absence in the URI scheme registry; the request itself is with IANA |
| 2026-09-16 | IANA registration request submitted for the rttp URI scheme, ticket #1459939, under RFC 7595. Status: Validating Request; not registered. |
Absence in the URI scheme registry; the request itself is with IANA |
What this page deliberately does not record. Private correspondence with IANA or with any individual is not published here, and neither are statements about future plans. The entries above are limited to things a third party can confirm without asking us.
3. How each row can be checked
- Follow the link. Where a row names a document, a registry or a package, the link goes to the authoritative source, not to a copy on our own site.
- Run the command. Where a row concerns DNS or the packages, there is an exact command. The DNS records can be checked from any resolver:
nslookup -type=txt iqa.org,nslookup -type=txt _dmarc.iqa.org. - Replay the vectors. The strongest check is the one that runs on your machine: the four self-tests in section 4, which fail if an implementation disagrees with the published vectors.
- Cross-check the mirrors. The same specification is published as plain text and as HTML (IQA text, RTTP text) and as Internet-Drafts; they are intended to be identical in substance.
4. Verify it yourself
About five minutes, no account, no network trust. The conformance vectors ship inside each package, so the self-test replays them offline, from the installed package, without a repository checkout. An implementation that disagrees with the vectors fails on your machine, not ours.
$ pip install rttp && python -m rttp.selftest # 80 checks passed (3 skipped)
$ pip install iqa-org && python -m iqa.selftest # 108 checks passed (3 skipped)
$ npx @aicent/rttp # 35 checks passed
$ npx @aicent/iqa # 32 checks passed
Rust: crates.io rttp and iqa-org (1.3.1, first formal release); sources in the project repositories. The Ed25519 checks are skipped in the default install; pip install rttp[ed25519] (or iqa-org[ed25519]) enables them, giving 83 and 111 checks respectively. If something fails, or if the vectors themselves are wrong, we would like to know: a negative result is more useful than silence.
5. Contact
ShaoBao Li - independent maintainer; the project is hosted at the GitHub organization Aicent-Stack. Email: lee@iqa.org (IQA) or lee@rttp.com (RTTP).
Document center (every public document of both schemes): iqa.org/docs
Corrections and negative results are welcome, including corrections to this page.