Subject: Re: [ACTION REQUIRED] NTI-1 Neutrality vs. Commercial Vendor Lock-in

Hi everyone,

I want to share a major milestone that proves exactly why the W3C needs the
NTI conformance matrix.

Larry (@bigblackcoder) just submitted his Rust regression tests. The tests
failed.

The W3C test matrix successfully caught two critical zero-day
vulnerabilities in the NTI core engine:

1. An unsigned capability token was incorrectly granted authority.
2. A required Byzantine quorum was bypassed when only one module was
available.

This is the power of an open, peer-reviewed standard. Larry's tests just
prevented a catastrophic security failure before it ever reached
production. I have asked Larry to submit the patch for the core engine.

To Steven and Chop: This proves why your test vectors and sidecars are the
most valuable assets we have. We are building the only AI trust layer that
actively tests for and catches its own bugs.

To Larry: You are now officially the Lead Rust Security Engineer for NTI.
Submit the fix whenever you are ready.

Let's keep hardening the standard.

Best,
Abisheak


On Sat, 31 Oct, 2026, 9:34 am Larry Lewis, <llewis@sovrlabs.com> wrote:

> Hi Abisheak and colleagues,
>
> A quick update: the two Rust regression cases and Cargo CI job are
> submitted in PR #24 <https://github.com/abisheakp197/nti-spec/pull/24>.
>
> Both tests compiled and ran against the confirmed engine commit. They
> exposed two behaviors for review:
>
>    -
>
>    An unsigned capability token returned Allow instead of the required
>    Deny.
>    -
>
>    With a quorum requirement of two and one eligible module, the module
>    executed once instead of remaining blocked.
>
> The existing Python sidecar tests passed. The execution details and
> retained logs are linked in my fork’s PR #1
> <https://github.com/bigblackcoder/nti-spec/pull/1>.
>
> The connected GitHub integration blocked upstream writes with a 403
> permission error, so I submitted the PR through my GitHub session.
>
> If a working session is still useful, I can propose:
>
>    -
>
>    Monday, November 2: noon–12:45 p.m. Chicago / 10–10:45 a.m. Pacific.
>    -
>
>    Tuesday, November 3: noon–12:45 p.m. Chicago / 10–10:45 a.m. Pacific.
>    -
>
>    Wednesday, November 4: noon–12:45 p.m. Chicago / 10–10:45 a.m. Pacific.
>
> Monday is my preference. Tymofii and Lee are welcome to join. We can
> review the results and agree on the next runtime test.
>
>
>
>
>
> Best regards,
> Larry Lewis
> Founder, SovrLabs
> Chair, W3C Agent Trust Protocol Community Group
>
>
> From: Larry Lewis <llewis@sovrlabs.com>
> To: "Abisheak P"<abisheakp197@gmail.com>
> Cc: "Steven Zhao"<zhaoxinghua07@126.com>, "public-agentprotocol"<
> public-agentprotocol@w3.org>
> Date: Fri, 30 Oct 2026 22:46:23 -0500
> Subject: Re: [ACTION REQUIRED] Official NTI-1 Contributor Issues Opened
>
>
> Hi Abisheak, Xinghua, and colleagues,
>
> My apologies for the delay. I am working on the items. Thank you for
> opening #20. My GitHub handle is bigblackcoder. I’ll take the first pass
> on the two Rust regression cases we discussed, targeting ube-foundation
> commit 308fd1c95f2c2f975e8b6b6c5e7ccba0e4d7b203.
>
> I checked asl-conformance.yml; it currently runs the Python sidecar
> self-test. The contribution will therefore also need a Cargo test job so
> the Rust cases are compiled and executed. I’ll keep the scope to those two
> cases and their reproducible execution, with any failures reported as
> observed.
>
> Xinghua, thank you for acknowledging my refinements and preserving the
> archived references. I agree with keeping responder tryLater, timeout,
> and stale-root outcomes distinguishable, and evaluating the admitted
> operation against its declared contract.
>
> Please confirm the exact contribution cutoff for the proceedings so I can
> assess the timing.
>
>
> On November 6, I'm still working on the opportunity to attend. I will
> respond accordingly with you and Kaliya soon.
>
> Is there anything I may have missed that needs my attention as work
> through the items?
>
> Best regards,
> Larry Lewis
> Founder, SovrLabs
> Chair, W3C Agent Trust Protocol Community Group
>
>
>
>
>
> From: Abisheak P <abisheakp197@gmail.com>
> To: "Steven Zhao"<zhaoxinghua07@126.com>
> Cc: "public-agentprotocol"<public-agentprotocol@w3.org>
> Date: Fri, 30 Oct 2026 21:25:01 -0500
> Subject: Re: [ACTION REQUIRED] Official NTI-1 Contributor Issues Opened
>
>
>
>
> Hi Steven,
>
> Perfect. I saw you claimed #19. Your conditions are fully accepted:
>
> 1. Full attribution to your W3C archived message.
> 2. Pointers to the dated source.
> 3. The code is a harness, not the spec itself.
>
> Please open the PR whenever you are ready. The CI is waiting.
>
> One quick question: Kaliya just asked me if you or Larry are attending AIW
> in person on Nov 6th. She has offered me a remote "Owl" dial-in slot at 10
> AM, and would love for the session to be co-hosted if either of you are in
> the room. Let me know so I can confirm with her.
>
> Best,
> Abisheak
>
> On Sat, 31 Oct, 2026, 6:14 am Steven Zhao, <zhaoxinghua07@126.com> wrote:
>
> Hi Abisheak, Larry, Lee, Lars, all,
>
> Abisheak: my GitHub handle is zhaoxinghua09-cell, and I am claiming issue
> #19 (https://github.com/abisheakp197/nti-spec/issues/19). Thank you for
> opening it for the LGD transition contract and resume_basis.
>
> On what I will put into that issue: the two finish-or-stop contracts, the
> tier-1 receipt field list, and resume_basis (evidence | exemption), exactly
> as stated in my message of 30 October (
> https://lists.w3.org/Archives/Public/public-agentprotocol/2026Oct/0108.html),
> including the specification attached to that message. The contract wording
> is the contribution I stand behind; the accompanying code is only a
> runnable harness for exercising and breaking those contracts, and is not
> offered as part of the specification. I will submit as pull requests
> against the spec text, with one request: where a merged version derives
> from that message, keep the attribution and a pointer to the archived
> original, so a reader can always check the wording against the dated
> source. I aim to open the pull requests before the AIW Book of Proceedings
> cutoff.
>
> Larry (
> https://lists.w3.org/Archives/Public/public-agentprotocol/2026Oct/0090.html):
> your two refinements are right, and they fit the incomplete_check block
> without touching it. A tryLater response is an answer that arrived and
> belongs in the record as received; a timeout or a missing response is a
> different outcome and must be recorded separately, never inferred. And
> requiring at T-30 that no subsequent call is admitted, while scoring the
> already-admitted call against its declared contract, is the cleaner split.
> It measures the two guarantees independently, as you said.
>
> Lee (
> https://lists.w3.org/Archives/Public/public-agentprotocol/2026Oct/0109.html):
> I accept the constraint: the mapping stays unidirectional, check outcome to
> boundary value. incomplete_check is a record of the runtime's check
> attempt; the wire value set is untouched, so a PAUSE with no receipt
> attached is still a well-formed record, and a receipt that says
> PAUSE(authority_not_determined) always carries its incomplete_check reason.
>
> I will also file the registry outcome rows (reachable, unreachable,
> stale_root) against #19, so all three modes stay distinct from
> authority_revoked.
>
> Best regards,
>
> Xinghua Zhao
> Independent researcher
> ORCID 0009-0001-0512-1237
>
> [Disclosure: drafting of this message was assisted by AI; all positions
> reviewed and approved by me. Same disclosure as my earlier messages on this
> list.]
>
>
>
>
>