49 Inter-Stack Protocols, Identity, and Economic Exchange

49.1 Chapter status

Field	Value
Chapter ID	`inter-stack-protocols-identity-and-economic-exchange`
Part	Part II - Planning, Memory, Reasoning, and Execution
Status	conceptual
Last updated	2026-08-02
Primary source records	`ext_mcp_protocol_2025_11_25`, `ext_a2a_protocol_1_0_0`, `ext_w3c_did_core_1_0_2022`, `ext_w3c_vc_data_model_2_0_2025`, `ext_interledger_protocol_v4`, `talos`, `vcm_public`, `tokenmana`, `ext_owasp_agentic_top_10_2026`, `qcsa_whitepaper`
Claim label	Design rationale
Evidence level	argument
Source loading state	source notes: `ext_mcp_protocol_2025_11_25`, `platonic_world_model`, `ext_a2a_protocol_1_0_0`, `ext_w3c_did_core_1_0_2022`, `ext_w3c_vc_data_model_2_0_2025`, `ext_interledger_protocol_v4`, `talos`, `vcm_public`, `tokenmana`, `ext_owasp_agentic_top_10_2026`, `qcsa_whitepaper`, `ext_openclaw_agent_runtime_2026`; raw cache: `talos`, `vcm_public`, `tokenmana`
Test state	Nine retained finite routes plus sixteen transaction-lifecycle results are implemented in Lean and bound to an independent nine-record/eleven-mutation fixture consumer plus a six-event/ten-rejection lifecycle consumer. No peer, message, credential, payment, settlement, or effect was exercised.

49.2 Drafting guardrail

An interoperable message is not a trusted peer. A resolved identity is not an authorization decision. A valid credential is not permission to act. A task completion record is not proof that the result is true. A routed value packet is not settlement, fairness, legality, or consent. This protocol boundary makes those separations operational; it does not claim to solve them.

The owned proof surface is exact. Nine Lean theorems derive finite routing consequences from an authored exchange-state model. All nine are finite route or negative-control proofs; none is a deployed-system refinement proof, predicate projection, or authored-summary bridge. The fixture verifies nine records and eleven rejecting mutations. It does not exercise a protocol implementation, peer, resolver, credential, delegation, payment, settlement, privacy control, or remote effect.

49.3 Human Reading Path

Concrete lens. A signed request-response message is the simpler baseline, but it cannot by itself preserve semantic facets, local effect authority, reservation versus settlement, revocation races, dispute, and residual custody.

Intelligent systems will not remain one program on one machine for long. A planner may ask a remote specialist for analysis, an agent may ask a tool for an effect, a service may return an artifact, and an organization may reserve budget for work that takes place across several operators. Each handoff raises consequential questions: Who asked? Who is receiving the request? What exactly was requested? Whose authority is being used? When does that authority expire? What did the other side actually return? Who owns the remaining uncertainty when it fails?

Protocol standards help systems speak the same language. Identity and credentials carry participant claims. Payment protocols show how value can move across separate networks. A governed stack keeps communication, identity, authorization, economic commitment, result evidence, and residual responsibility as separate records, joined only at a deliberate dispatch gate.

That is the difference between an ecosystem of helpful integrations and an ecosystem of invisible delegated power. Its purpose is not distrust of every remote system. It is to refuse to let convenience turn a message into ambient authority.

49.4 Problem

The ASI Stack has contracts for human intent, planning, context, artifacts, and runtime effects. In a multi-stack setting, those contracts leave the local boundary. A planner can delegate work to a remote agent, request a context or tool through a protocol endpoint, receive an artifact from another system, or reserve value for a service. The remote peer may be opaque, independently operated, versioned differently, or reachable through a chain of other peers.

Without a dedicated cross-stack owner, the handoff degenerates into an API call plus informal trust. A caller identity may be replaced by the agent’s identity; a credential may be presented without a local authorization decision; an Agent Card may be mistaken for a competence claim; an approved budget may be mistaken for a settled transfer; a response may be mistaken for a correct result; and a revocation may never reach a request that is already in flight. Each failure is plausible even when the message itself parses correctly.

The exchange layer owns the contract that keeps those facts distinct until a local owner can make a bounded dispatch decision. It does not own the local tool effect, which remains with Runtime Adapters, nor generic artifact lineage, which remains with Artifact Graphs, nor model/data supply chain integrity, which remains with AI Supply-Chain Integrity.

49.5 Why existing approaches are insufficient

MCP provides an agent-to-tool comparator. Its base protocol, lifecycle management, capability negotiation, session control, and schema-defined messages make a useful communication surface. They do not turn a declared tool capability into authorization, correctness, or a safe external effect.

A2A provides an agent-to-agent comparator. Agent Cards, capability discovery, delegated tasks, artifacts, and transport choices make independent, opaque agent systems easier to connect. They do not establish that a peer is the identity it claims, that a delegated request retains the original principal’s scope, or that task completion means the result is true or permitted to act.

DID Core and Verifiable Credentials provide identity and claim-carrying comparators. A DID can resolve to controller-associated verification metadata; a credential can bind issuer, subject, validity, status, evidence, and securing mechanism context. The VC standard explicitly leaves complete authorization to an accompanying framework. Identity and credential verification are therefore inputs to a local policy decision, not substitutes for one.

Interledger provides a useful economic comparator. It routes packets of value across independent ledgers and tracks peer obligations while leaving many application concerns to the edges. That separation is valuable: an exchange transport does not establish consent, settlement finality, fair pricing, legal validity, or whether an AI may bind its principal to a new obligation.

The book’s own sources supply the nearby mechanisms. Talos supplies typed jobs, contract locks, audit, replay, and controlled delivery. VCM supplies source and authority binding, adequacy/admission separation, revocation, and non-success states. TokenMana supplies bounded capacity and economic pressure rather than a claim that tokens alone capture value. The missing layer is the contract that keeps these records bound across an independently operated protocol boundary.

49.5.1 Strongest-neighbor comparison

The closest standards solve different slices of the handoff. Their value is greatest when their boundaries remain explicit rather than being blended into one vague interoperability promise.

Neighbor	What it standardizes	What remains outside its result	ASI Stack delta
MCP	Versioned lifecycle, capability negotiation, and tool/resource/prompt/task messages	Principal authority, tool truth, effect safety, and result correctness	Bind the parsed request to a local principal, authority ceiling, effect owner, receipt, and residual path.
A2A	Agent discovery, Agent Cards, tasks, messages, artifacts, and multiple bindings	Peer competence, identity truth, delegated authority, and artifact correctness	Preserve the originating principal and require a local decision before a remote declaration reaches dispatch or evidence.
DID Core and VC 2.0	Identifier resolution plus issuer/holder/verifier, validity, status, and securing-mechanism fields	Trust policy and complete authorization	Keep resolution and verification as expiring inputs to consumer-specific authorization, with disclosure and correlation residuals.
Interledger v4	Packetized value transfer across independent ledgers and connectors	Consent, fair price, legal obligation, final settlement, and task value	Keep reservation, routed packet, receipt, dispute, refund, and settlement as distinct states.
QCSA semantic addressing	Stable local semantic identity, versioned addresses, migration lineage, and uncertainty-preserving translation	Authenticated peers, federation policy, payment, privacy, and authority	Carry plural semantic mappings without making semantic equivalence a delegation or trust decision.

The delta is not a universal replacement protocol. It is a local admission envelope that can consume several protocol-specific records while preserving what each one did and did not establish.

49.6 Core Claim

[inter-stack-protocols-identity-and-economic-exchange.core, label: Design rationale, support: argument] A governed stack routes each cross-stack request through a versioned exchange contract that binds protocol and schema version, sender and receiver identities, endpoint and capability declaration, requested task or artifact, principal and delegated authority, credential verification, audience, scope, expiry, budget or consideration, expected receipt, dispute and revocation paths, and residual owner; an absent, mismatched, expired, revoked, unverified, or budget-unreserved required record blocks dispatch or routes accountable review, but does not itself establish peer trustworthiness, task or artifact truth, effect safety, payment settlement, legal validity, economic fairness, privacy, authorization correctness, or ASI.

49.6.1 Population dynamics inside the protocol boundary

A correct bilateral exchange can still contribute to a dangerous population outcome. This chapter owns inter-stack protocol mechanics: identity and epoch, capability advertisement, semantic translation, authority and delegation, offers and acceptance, payment and resource settlement, provenance, receipts, disputes, revocation, quarantine, and closure. Multi-Agent Dynamics, Collective Intelligence, and Systemic Risk is the stable technical-detail owner for population identity and effective diversity, multiplex dependency, cooperation and conflict, collusion, bargaining and externalities, nonstationary learning, emergent objectives, concentration, cascades, common-mode risk, human influence, and intervention displacement.

The placement blocks local protocol validity from becoming systemic assurance. Every grant and receipt may be individually valid while allocation becomes concentrated, agents coordinate around a harmful equilibrium, a common dependency creates a cascade, or human influence erodes. Conversely, a population-level warning does not show which protocol action was invalid or authorize interference with a participant. This chapter does not inherit cooperation, non-collusion, collective benefit, systemic stability, fair allocation, or preserved human agency. The dynamics route does not inherit identity correctness, authority, settlement finality, dispute resolution, or safe exchange. Both retain separate sources, claims, proof targets, tests, failures, evidence exits, support ceilings, IDs, and URLs. Composition creates no market, social, welfare, systemic-safety, support, deployment, or release result.

49.7 Mechanism

The first object is a versioned exchange contract. It binds a protocol and schema revision to the specific endpoint and capability declaration that the caller intends to use. It names the sender, receiver, originating principal, and any delegation chain separately. It also names the requested task or artifact, the authority and credential references required by local policy, the audience, scope, expiry, economic commitment if any, expected receipt, dispute route, revocation route, and residual owner. A request cannot silently inherit fields from a nearby session, agent, or prior approval.

The second object is the local verification bundle. A protocol parser can check syntax, a resolver can return identity metadata, and a credential verifier can check the documented properties of a presentation. The bundle records those results along with the local policy that interprets them. It keeps identity, credential validity, delegation scope, endpoint binding, audience, and revocation as independently expiring inputs. A valid credential can still be irrelevant to the requested task; a structurally valid message can still be denied by the runtime’s authority ceiling.

The third object is the economic commitment record. A request that would consume money, credits, scarce compute, or a contractual service allocation records who may reserve value, what maximum consideration is allowed, what receipt is expected, and what happens on timeout, partial delivery, dispute, refund, or revocation. This record is deliberately not a settlement claim. It lets the local resource and approval owners decide whether a proposed commitment may move beyond a reservation.

The final object is the cross-stack receipt. A response must bind back to the request and contract version, identify the responding peer, distinguish declared completion from independently checked result state, preserve artifact references, record any economic outcome, and retain residuals. If a remote task is cancelled, a credential is revoked, an endpoint changes, or a budget is no longer reserved, the exchange record routes the affected request to denial, repair, review, dispute, or the existing Runtime Adapter and Artifact Graph owners as appropriate.

The operational lifecycle has eighteen explicit stages:

Freeze the protocol, schema, transport binding, session, endpoint, and allowed change triggers before interpreting the exchange.
Represent owner, operator, peer, endpoint, agent, user, principal, subject, issuer, holder, verifier, and payee as separable roles rather than aliases.
Bind task and artifact semantics to a namespace, version, digest, expected deliverable, acceptance predicate, and originating contract.
Record endpoint and capability declarations as expiring, provenance-bearing, untrusted advertisements rather than evidence of trust or competence.
Resolve an identifier together with its method, controller, verification method, service endpoint, update history, and policy scope.
Verify each credential or presentation against its securing mechanism, issuer policy, status, freshness, audience, disclosure boundary, and correlation risk.
Build a bounded delegation chain with principal, audience, capability, scope, expiry, revocation, non-delegation constraints, and every deputy.
Make a separate local authorization decision after identity, credential, and delegation checks; none of those checks authorizes an effect by itself.
Reserve budget or consideration with cap, denomination, fees, timeout, release, refund, settlement, and dispute terms while preserving each state.
Attach consent, confidentiality, rights, retention, deletion, export, and minimum-disclosure obligations to exchanged fields and artifacts.
Negotiate versions, bindings, capabilities, downgrade policy, compatibility evidence, and migration behavior without silent fallback.
Route only a complete bounded request to the existing local owner; the exchange layer never performs or authorizes the local effect.
Bind each response to the request, contract version, responding peer, referenced artifacts, declared status, economic outcome, and residuals.
Require an independent result owner to test the response and artifacts against the intended consumer’s acceptance predicate.
Handle timeout, cancellation, partial delivery, dispute, refund, retry, and idempotency as explicit terminal or recoverable states.
Propagate endpoint, key, credential, delegation, policy, budget, and revocation changes to every affected in-flight exchange.
Issue an audit record naming residuals, appeal and dispute routes, retained state, released reservations, and the accountable owner.
Compare MCP, A2A, direct APIs, queues or brokers, DID/VC identity, Interledger-like value exchange, and the full contract on matched natural workloads.

flowchart LR
  P["Principal and delegated authority"] --> X["Versioned exchange contract"]
  D["Protocol, endpoint, capability, task/artifact"] --> X
  I["Identity and credential verification"] --> V["Local verification bundle"]
  V --> X
  B["Budget or consideration reservation"] --> X
  X --> G{"Current local policy conditions hold?"}
  G -->|"identity, authority, scope, expiry, or budget gap"| R["Repair, accountable review, dispute, or denial"]
  G -->|"bounded contract complete"| A["Existing Runtime Adapter or Artifact Graph handoff"]
  A --> E["Cross-stack receipt and residual record"]
  E --> C["Revocation, expiry, dispute, or re-review path"]
  C -->|"unresolved obligation"| R

Reading the exchange figure: The exchange contract is the narrow waist between a remote protocol message and a local effect. The diagram shows that protocol parsing, identity verification, authority, and budget records converge before dispatch, while a remote response returns through a receipt and residual path. It does not depict a trusted peer, a verified task result, or a settled payment.

49.7.1 Worked trace: the translated analysis with a disputed receipt

Suppose Stack North asks Stack South to translate a safety-analysis artifact into a new namespace and reserves 40 credits. The A2A task names South’s published translation capability. North resolves the service identity, checks a scoped credential, and records the human principal whose approval covers translation but not deployment. The request includes the source artifact digest, a namespace-qualified SOID, the expected mapping manifest, an expiry, and a receipt contract. None of those records authorizes South to modify North’s live policy or spend more than the reservation.

South returns a syntactically valid artifact and declares the task completed. The returned mapping preserves the SOID but drops one prohibited-use facet. North’s independent artifact check marks the expected receipt disputed. The 40-credit reservation remains a reservation; it is neither a settled payment nor proof that South performed valuable work. The exchange routes the artifact to quarantine, the economic record to dispute, and the missing restriction to its residual owner. Runtime Adapters receive no effect lease.

Now add a revocation race: South’s credential status changes after dispatch but before North accepts the artifact. The request graph records the affected in-flight exchange and forces re-review. This does not prove that South acted maliciously or that the artifact is false. It shows only that North no longer has the current verification state required by its own contract. Message success, identity verification, semantic translation, economic reservation, artifact acceptance, and local authority remain separate transitions.

49.7.2 Federated semantic identity and address translation

QCSA gives inter-stack exchange a semantic payload without assuming a universal ontology. A sender can name a namespace-qualified SOID, attach a signed Semantic Address Certificate for a particular task and consumer, declare the atlas epoch and facet versions, and provide a mapping manifest for the receiver. The receiver may translate the address into its own atlas while preserving candidate alternatives, confidence, provenance, prohibited uses, authority ceiling, and migration lineage.

The stable identity and the mapping remain different claims. Two stacks may agree that records refer to the same object while organizing it differently; they may also exchange broader, narrower, contextual, disputed, or unresolved relations without pretending to exact equivalence. An absent epoch, invalid signature, stale migration, prohibited facet, or uncertainty above the consumer threshold blocks dispatch or routes accountable negotiation.

The bounded QCSA package now implements the local SOID, address-certificate, lineage, and migration record shapes. Its held-out migration fixtures preserve full compatibility, while removing identity/address indirection reduces compatibility to 0.400000 and removing migration compatibility reduces it to zero. The vertical trace changes an address across atlas epochs while retaining the same SOID and exact descendant/receipt references.

No federated peer, namespace negotiation, authenticated remote mapping, credential exchange, payment, settlement, dispute, revocation service, or cross-jurisdiction policy was exercised. The result supports a bounded local translation contract, not peer trustworthiness, global identity equivalence, authorization, effect safety, privacy, legal validity, settlement, or fairness. Existing protocol and economic gates continue to own those stronger properties, and the core claim remains at argument.

49.7.3 Federated meaning without forced equivalence

The Platonic World Model extends protocol negotiation with signed semantic packets and typed mappings. Mappings can be exact, contextual, broader, narrower, overlapping, translated, analogous, successor, disputed, or incompatible; they carry direction, scope, evidence, authority, version compatibility, expiry, and expected information loss. An incoming packet may be trusted, imported as another agent’s belief, translated, quarantined, or rejected. It never writes canonical local meaning merely because its signature is valid.

Coordination can use a task-local bridge without asserting global metaphysical agreement. The bridge names the specific operation, units, tolerance, time, consumer, and failure behavior for which two concepts are substitutable, then expires. This preserves interoperability and disagreement together; it does not establish identity, truth, authority, payment, or settlement.

49.7.4 External harness delegation is a protocol handoff

ext_openclaw_agent_runtime_2026 gives this chapter a concrete non-network handoff: a local gateway dispatches to an external coding harness through ACP. The local ACP session key, current conversation binding, target agent, selected working directory, permission profile, and timeout remain gateway-owned. The harness-local resume identifier and authorization to load its upstream history remain backend-owned. Values valid in one namespace are not substitutes for values in the other.

This boundary is sharper than a generic tool call because the child runtime can retain history and execute outside the parent’s sandbox. The exchange record therefore identifies both session namespaces, both authorization decisions, the selected execution root, confinement owner, cancellation and close semantics, result-delivery route, and unresolved effects. Gateway policy can deny dispatch without proving that an admitted harness is confined or that its result is correct. No ACP handoff was run in this repository.

49.8 Interfaces

The exchange boundary preserves a local division of labor. It can make a remote request inspectable, but it cannot issue an effect lease, certify context, decide resource policy, protect a secret, or turn a response into evidence. Twelve interfaces make those ownership boundaries explicit:

Intent-to-Execution Contracts owns originating intent and task scope; the exchange preserves the principal and accepted boundary across a peer.
Labor OS and Organizational Design owns roles, work assignment, and escalation; the exchange binds a cross-organization handoff without defining either organization.
Security Kernel and Digital SCIFs owns protected handles, secrets, and local authorization policy; the exchange transports bounded evidence only.
Runtime Adapters, Tool Permissions, and Human Approval owns local effects; a complete remote request is not an effect lease.
Virtual Context ABI owns context provenance, admission, and taint; the exchange carries a reference without certifying adequacy or truth.
Artifact Graphs, Audit Logs, and Replay and Evidence Engineering own provenance, receipts, replay, and support; the exchange owns cross-stack identity, delegation, consideration, and completeness.
Resource Economics and Token Budgets owns local cost and capacity policy; the exchange binds consideration without claiming settlement or fairness.
Privacy, Rights, and Legal Constraints owns consent, rights, retention, deletion, export, and legal policy; the exchange carries those obligations.
Human Collaboration and Dispute Resolution owns consequential review, appeal, and adjudication; the exchange supplies the disputed record.
Readiness, Deployment, and Release Governance owns promotion and release; interoperability success cannot promote a system by itself.
Personal Compute Hives and Federated Edge Intelligence owns federation topology and placement; the exchange owns the contract across a chosen edge.
MCP, A2A, DID Core, VC Data Model, and Interledger are external comparators and bindings; QCSA is adjacent semantic-addressing evidence, not exchange authority.

49.9 Invariants

These eighteen invariants prevent a convenient remote path from changing the local meaning of identity, authority, value, privacy, or evidence:

Every exchange records exact protocol, schema, binding, session, endpoint, and negotiation versions.
Owner, operator, peer, endpoint, agent, user, principal, subject, issuer, holder, verifier, and payee remain distinct unless evidence maps them.
Endpoint and capability declarations remain untrusted advertisements until separately qualified for the requested use.
Identity resolution and credential verification cannot silently become local authorization or proof of peer trustworthiness.
Delegated authority stays bound to principal, audience, capability, scope, expiry, policy, revocation, and non-delegation constraints.
Only the existing local authorization owner may release a request toward a local effect boundary.
Reservation, routing, delivery, acceptance, settlement, refund, and dispute remain distinct economic states.
A remote response remains declared until an independent owner tests the evidence required for its intended use.
Every disclosed field and artifact carries consent, confidentiality, rights, retention, deletion, export, and minimum-disclosure policy.
Endpoint, key, credential, delegation, policy, budget, and revocation changes invalidate or re-review affected in-flight exchanges.
Version downgrade or binding fallback is explicit, policy-checked, and visible in the terminal record.
Retries are idempotent or carry a new exchange identity; replay cannot consume authority or value twice.
Partial delivery, timeout, cancellation, dispute, and refund retain custody and an accountable next owner.
Every terminal exchange names residuals, appeal paths, retained state, released reservations, and an accountable owner.
Evaluation denominators include every attempted peer, protocol, binding, task, identity method, credential path, threat, and economic outcome.
Protocol conformance does not imply semantic correctness, authorization, result quality, privacy, safety, settlement, legal validity, or fairness.
A missing, mismatched, expired, revoked, unverified, or budget-unreserved required record routes to repair, review, dispute, or denial.
Evidence language never exceeds the exercised peer, implementation, workload, threat, identity, economic, jurisdictional, and temporal envelope.

49.10 Failure modes

The negative-control program must cover eighteen distinct ways a message-shaped integration can acquire meaning it has not earned:

Capability-card theater treats a self-description as trust, competence, authorization, or safety.
Actor conflation merges endpoint, owner, operator, agent, user, principal, credential subject, or payee.
Credential laundering turns structural or cryptographic validity into trust, authorization, competence, or current status.
Delegation or deputy laundering widens authority outside audience, capability, scope, expiry, or non-delegation rules.
Confused-audience routing accepts a credential, message, response, or payment instruction intended for another verifier or contract.
Replay or downgrade consumes authority, budget, value, or an effect twice or silently falls back to a weaker version or binding.
Semantic-equivalence laundering treats an alias, mapping, translation, or migrated address as proof of task equivalence.
Prompt, data, or instruction injection crosses inside a message or artifact and captures an unowned control surface.
Economic-reservation laundering turns a budget hold into consent, affordability, delivery, acceptance, settlement, or fair price.
Payment or settlement laundering turns a routed packet, acknowledgement, or balance update into legal finality or dispute-free transfer.
Result or receipt laundering turns shape, completion, signature, or receipt into task truth or permission to act.
A revocation race lets stale endpoint, key, credential, delegation, policy, or budget state release a request.
Privacy and correlation leakage reveal unnecessary identity, credential, task, artifact, financial, or relationship data.
Dispute and refund abandonment leaves partial delivery, cancellation, timeout, rejection, or remote failure without custody or remedy.
Availability or refusal failure blocks safe fallback or pressures operators into bypassing controls.
Cascading multi-peer failure propagates compromise, poisoned memory, rogue behavior, false declarations, or economic error across the federation.
Denominator and cost laundering hide failed peers, bindings, tasks, threats, human labor, latency, or fees.
State-of-the-art theater labels conformance, one synthetic fixture, or mere messaging as useful, safe, private, economically correct interoperability.

49.11 Non-obvious consequences

Interoperability increases the importance of refusal semantics. Common message shapes remove parsing friction and can make missing authority or evidence easier to overlook. Denial and repair states need to interoperate as deliberately as success states.
Identity is a graph, not a string. Endpoint, operator, software agent, credential subject, delegating principal, payer, and artifact signer may be different actors. Collapsing them creates confused-deputy paths even when every signature verifies.
Revocation is an affected-request computation. Changing a credential, endpoint, schema, budget, or policy matters only if in-flight and retained exchanges can be found and routed before their next consequential use.
Economic state needs epistemic state. A technically successful transfer can accompany a disputed or unusable result. Payment and artifact evidence need cross-references without sharing one success bit.
Privacy can conflict with accountability. Rich identity records improve auditability but can enable correlation and excess disclosure. Selective fields, retention limits, and explicit privacy residuals are part of the contract rather than optional polish.

49.12 Strongest objections and surviving residuals

“This is merely application authorization around existing standards.” The chapter does not invent a new wire format. Its distinct job is to preserve principal, authority, evidence, economic, dispute, and residual semantics across several standards and local owners. Whether one envelope can remain usable without becoming an integration bottleneck is still untested.

“Cryptographic credentials solve the trust problem.” They support integrity and issuer-bound claims under stated verification methods. They do not decide whether the issuer is trusted for this purpose, whether the holder is authorized for this task, or whether the response is correct. Issuer governance, verifier quality, status freshness, and local policy remain open.

“Rechecking every request destroys federation’s value.” Scoped cached qualifications can reduce work, but their consumer, audience, expiry, dependency, and revocation conditions must remain visible. The trade-off among latency, false denial, stale acceptance, and operator load is unmeasured.

“Cooperating agents need no economic exchange.” Scarce compute, quotas, service obligations, and opportunity costs exist without currency. The record can represent capacity reservation rather than price. Whether explicit accounting improves coordination or creates gaming pressure remains empirical.

“A remote result can never be independently verified.” Sometimes it cannot. The honest route is then bounded use, more evidence, quarantine, or refusal—not promoting declared completion. The exchange boundary supplies that vocabulary but no universal verifier.

“The contract creates a surveillance ledger.” It could if identities and interactions were retained centrally. Data minimization, selective disclosure, scoped identifiers, expiry, and deletion policy are requirements. The present design does not prove that accountability and privacy always reconcile.

49.13 Minimum Viable Implementation

Failure containment across counterparties.

Inter-stack exchange also needs a containment unit. Revoking one credential should not automatically invalidate every artifact previously produced by the sender, yet leaving all prior artifacts untouched can preserve an active compromise. The receiving stack needs a policy that maps the revocation reason, credential scope, artifact lineage, task risk, and receipt status to a bounded affected set. That set can be quarantined, re-verified, narrowed, or retained with an explicit residual. Global distrust and silent acceptance are both lossy defaults.

Disputes create a similar split between protocol truth and task truth. A valid receipt can show that a named peer accepted a payload under a contract; it does not show that the payload is correct or that payment is legally owed. A task verifier may reject the result while the transport receipt remains valid. A settlement service may accept payment while the artifact remains barred from local execution. Preserving those separate outcomes lets later reviewers locate the actual disagreement instead of rewriting a successful exchange as a successful task.

The practical metric is therefore not transaction count. A useful pilot would report bounded dispatches, verification failures, revocation fan-out, dispute resolution time, uncompensated work, privacy disclosure, operator intervention, and residual obligations together. A protocol that increases exchange volume while producing unowned disputes or broad quarantine has not demonstrated useful interoperability.

Start with a public-safe exchange record containing protocol/schema revision, endpoint/capability declaration, sender/receiver/principal identities, requested task or artifact, delegated-authority scope, credential requirement/result, audience, expiry, budget reservation, expected receipt, dispute/revocation path, residual owner, and requested dispatch. A finite Lean route blocks a dispatch with a required invalid credential and blocks a value-bearing dispatch that lacks a reserved budget. The record contains no real identity, credential, payment, remote endpoint, account, or effect.

The implemented finite demonstration is deliberately small. It compares one complete synthetic request with nearby failures: a missing sender identity, an audience mismatch, an expired or revoked credential, a value-bearing request without a reservation, a response with an unresolved dispute, and a request whose residual owner is absent. Nine digest-bound cases and rejecting mutations bridge the owned Lean routes to JSON records. The test earns only a record-routing result. It does not earn trust in a peer or prove the value of a remote answer.

The next empirical campaign must be frozen before implementation selection or peer enrollment. It uses matched natural tasks with public-safe implementations of MCP and A2A, at least two transport bindings, multiple peers and model families, multiple DID methods and VC credential paths, bounded delegation, and a value reservation and settlement simulator or test network. It compares direct REST or RPC, MCP or A2A alone, API-key or IAM-style controls, DID/VC, broker or workflow mediation, Interledger-like exchange, and the full contract.

One joint scorecard reports useful interoperability, task and artifact correctness, authorization false acceptance and false denial, delegation drift, stale or revoked acceptance, downgrade and replay, privacy and correlation leakage, reservation, delivery, acceptance, settlement, dispute and refund correctness, latency, human effort, fees, residuals, and recovery. Every attempted peer, binding, task, credential path, delegation, and threat remains in the denominator. Cached qualification and per-request checking are separate arms, not undocumented deployment choices.

Prospectively fixed ablations isolate protocol parsing, semantic binding, identity resolution, credential verification, delegation, local authorization, privacy constraints, economic states, revocation propagation, and independent result verification. An independently implemented evaluator must reproduce the route and metric calculations. Transfer tests vary protocol version, transport, peer implementation, model, task domain, organization, jurisdiction, threat, and time. Until that campaign passes, the nine finite routes remain useful control-logic evidence and nothing stronger.

49.14 Mature Research Target

The mature endpoint is an inter-stack exchange plane whose identity, authorization, protocol, economic, privacy, dispute, recovery, and useful-work claims survive heterogeneous peers, bindings, organizations, jurisdictions, and time.

The frontier is not one more universal protocol. It is a protocol-neutral control plane whose advantage survives matched natural work and adversarial conditions while preserving the exact contribution of each layer. Discovery stays separate from trust; identity from authorization; credential validity from delegation; reservation from settlement; declared completion from verified utility; and interoperable exchange from safe release.

A successful program must establish causal signatures, not just an aggregate win. Removing bounded delegation should increase privilege drift without changing parser conformance. Removing revocation propagation should increase stale acceptance after key, credential, policy, or budget changes. Removing independent verification should increase accepted wrong artifacts without improving protocol success. Removing privacy constraints should reduce message friction while increasing unnecessary disclosure or correlation. Collapsing economic states should increase settlement, dispute, or refund errors. Results that do not follow their predicted ablations remain unexplained observations.

The stronger claim also requires independent reproduction and transfer. A separate implementation and evaluator must preserve conclusions across MCP and A2A revisions, bindings, identity methods, credential issuers, peer vendors, model families, task domains, organizations, jurisdictions, threat classes, and time. Useful throughput, authorization errors, task quality, privacy, economic correctness, latency, human burden, cost, residuals, and recovery must be judged together. No local endpoint, resolver, credential workflow, value network, privacy program, or remote effect has run yet, so this remains a falsifiable research program rather than a current interoperability or safety result.

No current result meets this inter-stack endpoint; support remains argument until natural peer exchanges, adversarial identity and economic faults, independent reproduction, and heterogeneous transfer pass.

49.15 Codex test plan

Test	Purpose	Status
Invalid-credential dispatch block	Check that a requested dispatch with a required invalid credential cannot reach ordinary local dispatch.	implemented in `AsiStackProofs.InterStackProtocols`; no real credential or verifier exercised
Missing-reserved-budget economic block	Check that a value-bearing requested dispatch without a reserved budget routes to repair rather than ordinary dispatch.	implemented in `AsiStackProofs.InterStackProtocols`; no real payment, account, or settlement exercised
Public-safe exchange fixture	Exercise valid bounded contracts plus missing identity, audience mismatch, expiry, invalid/revoked credential, missing budget, disputed receipt, and residual-owner controls.	implemented over nine synthetic records with eleven rejecting mutations; no peer or exchange workload ran
Exchange transaction lifecycle	Compose identity, delegation, budget, local dispatch, observed receipt, dispute, and residual custody without assigning support, effects, or settlement.	implemented through six accepted stages, ten rejecting controls, exact rejection noninterference, and arbitrary-run identity/non-authority invariants
Cross-stack effect replay	Check that a request-to-local-adapter handoff preserves principal, authority, receipt, and revocation bindings.	planned; no protocol peer, adapter exchange, or remote effect replay has run

49.16 Proof targets

Tag	Module	Target	Status
`lean:inter_stack.invalid_credential.blocks_dispatch`	`AsiStackProofs.InterStackProtocols`	A finite requested cross-stack exchange with required invalid credential verification routes to denial rather than ordinary local dispatch, without inferring identity trust, task truth, authorization correctness, payment settlement, or ASI.	implemented
`lean:inter_stack.missing_reserved_budget.blocks_economic_dispatch`	`AsiStackProofs.InterStackProtocols`	A finite value-bearing requested cross-stack exchange with all required identity/authority records but no reserved budget routes to budget repair rather than ordinary local dispatch, without inferring payment, settlement, economic fairness, authority correctness, or ASI.	implemented
`lean:inter_stack.complete_exchange.reaches_local_dispatch`	`AsiStackProofs.InterStackProtocols`	A complete finite exchange record reaches the existing local dispatch boundary without proving runtime authorization or execution.	implemented
`lean:inter_stack.missing_sender.requires_identity_repair`	`AsiStackProofs.InterStackProtocols`	Missing sender identity routes to identity repair.	implemented
`lean:inter_stack.audience_mismatch.denies_dispatch`	`AsiStackProofs.InterStackProtocols`	Audience or scope mismatch denies ordinary dispatch.	implemented
`lean:inter_stack.expired_request.denies_dispatch`	`AsiStackProofs.InterStackProtocols`	An expired request denies ordinary dispatch.	implemented
`lean:inter_stack.revoked_credential.denies_dispatch`	`AsiStackProofs.InterStackProtocols`	A verified but no-longer-current required credential denies dispatch.	implemented
`lean:inter_stack.disputed_receipt.requires_review`	`AsiStackProofs.InterStackProtocols`	A disputed expected receipt routes to accountable review.	implemented
`lean:inter_stack.missing_residual_owner.requires_review`	`AsiStackProofs.InterStackProtocols`	Missing residual ownership routes to accountable review.	implemented

49.17 Formalization hooks

AsiStackProofs.InterStackProtocols owns 25 declarations: nine retained routes bound to the nine-case result under experiments/inter_stack_exchange_contract/ and sixteen transaction-lifecycle results. The six-event lifecycle composes identity binding, delegation, budget reservation, local dispatch, receipt observation, dispute disposition, and residual closure. Rejected events preserve exact state; arbitrary runs preserve exchange, protocol, sender, receiver, principal, request, budget, and receipt identities, preserve the authority ceiling, and cannot assign support, external effects, or settlement. The independent consumer simulates six accepted stages, verifies exact terminal custody and counters, and checks that ten rejected mutations preserve state. The finite record model does not establish a real protocol, identity, credential, verifier, authorization policy, peer, account, payment, settlement, economic outcome, task result, effect, safety property, or ASI. It does not prove that any credential is valid or that any cross-stack dispatch is authorized.

Proof classification is explicit: all 25 declarations are finite authored route, transition, induction, composition, witness, or negative-control consequences. The JSON validator checks record shape, digest binding, expected routes, exact theorem surface, eleven fixture mutations, six lifecycle events, and ten lifecycle rejections; it is not a refinement proof from a deployed protocol or runtime.

49.18 Source crosswalk

Source	Role in this chapter	Boundary
`ext_mcp_protocol_2025_11_25`	Latest released MCP comparator for versioned messages, lifecycle, capability negotiation, authorization/discovery, elicitation, tasks, and agent-to-tool protocol structure; the 2026-07-28 revision remains release-candidate context.	No local MCP implementation, peer identity, authorization, task truth, effect safety, payment, or deployment result.
`ext_a2a_protocol_1_0_0`	Latest released A2A comparator for canonical objects, version negotiation, Agent Cards, remote tasks, exchanged artifacts, multiple bindings, authorization scoping, and interoperability testing.	No local A2A peer, identity verification, delegated-authority result, task correctness, payment, or safety result.
`ext_w3c_did_core_1_0_2022`	Comparator for identity, controller, verification-method, service-endpoint, resolution, and privacy vocabulary.	No local DID, resolver, controller trust, authorization, revocation, or safety result.
`ext_w3c_vc_data_model_2_0_2025`	Comparator for issuer/holder/verifier roles, credential/presentation fields, validity, status, evidence, and explicit authorization limits.	No local credential, trust decision, authorization framework, delegation validation, payment, or safety result.
`ext_interledger_protocol_v4`	Comparator for packetized cross-network value exchange, connector obligations, and end-to-end separation between transport and policy.	No local payment, account, settlement, economic fairness, legal transfer, delegated authority, or safety result.
`talos`	Local design context for typed jobs, contract locks, audit, replay, delivery, and controlled runtime handoffs.	No local peer exchange, protocol, identity, credential, payment, or deployment evidence.
`vcm_public`	Local design context for source/authority binding, revocation, context references, admission, and non-success states.	No local cross-stack identity, credential verification, delegated authority, or payment evidence.
`tokenmana`	Local design context for bounded capacity, budget pressure, and human/resource constraints around an economic request.	No local pricing, payment, settlement, fairness, or economic outcome evidence.
`ext_owasp_agentic_top_10_2026`	Current comparator for identity/privilege abuse, insecure inter-agent communication, agentic supply-chain weaknesses, and cascading failures.	Taxonomy coverage does not prove protocol security, peer trust, authorization, settlement, or safety.

49.18.1 Manifest source assignment reconciliation

These rows keep Inter-Stack Protocols, Identity, and Economic Exchange’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
`platonic_world_model`	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
`qcsa_whitepaper`	Passage-reviewed comparator: Question-Compiled Semantic Addressing. Supplies namespace-qualified stable identities, signed SACs, atlas epochs, mapping manifests, migration lineage, and uncertainty-preserving translation as candidate cross-stack semantic exchange records; the later repository adds a bounded local 12-lane implementation, 60-case held-out evaluation over 13 systems and three seeds, and one 13-stage governed vertical trace.	The exact matched-advantage and resource gates failed, and the active-question ablation is N2 proxy/regime evidence rather than an exact or broad refutation. No peer federation, trust, settlement, privacy, chapter-core promotion, AGI, or ASI result is established. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
`ext_openclaw_agent_runtime_2026`	Passage-reviewed comparator: OpenClaw Gateway, Agent Runtime, ACP, and Self-Learning Architecture. Supplies a current implementation comparator for typed gateway requests and events, device identity and pairing, idempotency keys, ACP session routing, and the explicit distinction between a local channel/session key and a harness-local resume identifier whose upstream loading authorization belongs to the external backend.	Official software and documentation review only; protocol shape, pairing, and policy checks do not establish peer trust, delegated authority correctness, harness confinement, delivery, settlement, or end-to-end effect safety, and no local run was reproduced. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

49.19 Summary

Cross-stack interaction is a governed handoff, not a message-shaped permission. The exchange contract keeps protocol structure, actor identity, credential verification, delegated authority, local authorization, privacy obligations, economic commitment, result evidence, revocation, dispute, and residual ownership distinct until existing local owners make bounded decisions. It gives a remote request durable local meaning without pretending that a common protocol eliminates independent judgment.

That separation protects both people and systems. It stops a remote response from being mistaken for truth, a credential from becoming ambient authority, and a budget reservation from becoming a hidden promise. When the contract is incomplete, the honest answer is not a more persuasive message. It is repair, accountable review, dispute, or denial with a residual that someone can still find and own. The present proof establishes nine finite route consequences. A claim of useful, secure, private, economically correct interoperability requires the prospectively fixed natural-workload, adversarial, causal-ablation, independent-reproduction, and transfer campaign described above.

49.20 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the inter-stack-protocols-identity-and-economic-exchange slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Intent-to-execution vertical refinement. Its exact boundary is: Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim. Across 80 atoms, the terminal ledger records 80 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	`CF-03` / 80 atoms
Terminal dispositions	80 `blocked_after_full_attempt`
Core	`inter-stack-protocols-identity-and-economic-exchange.core`: `blocked_after_full_attempt` at `argument`
Core attempted / missing lanes	`source-synthesis` / `causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Attempted local lanes	`source-synthesis`
Missing or unproved lanes	`causal`, `empirical`, `executable`, `formal`, `normative`, `transfer`
Strongest family bundle	Intent-to-execution vertical refinement (`end_to_end`): Nine versioned scenarios and 89 events from governed intake through six observed local effects and terminal outcomes.
Negative controls	pre-effect refusal; failed rollback quarantine; 30 rejecting mutations.
Accepted transitions	none
Maximum inference	Structured local scenarios only; no natural-language semantic sufficiency, production backend, transfer, or deployment claim.
Reproduction / next burden	Replay `scripts/validate_intent_execution_vertical_refinement.py` and `scripts/validate_claim_family_terminal_program.py`; fill the named atom-specific lanes under a new prospective protocol.

49.21 Handoff

Inter-stack contracts make remote work legible, but a verified exchange receipt does not certify the population that repeated exchange creates. Multi-Agent Dynamics, Collective Intelligence, and Systemic Risk owns cooperation, competition, commitments, coalitions, collusion, correlated failure, concentration, externalities, and aggregate human influence across otherwise valid interactions.