{
  "name": "Sage",
  "description": "Sage, the embedded agent in the Trulioo KYA developer portal. Enrolls and attests agents, verifies third-party agent cards, and answers questions about an account's own KYA state - acting only within the signed-in operator's own permissions.",
  "version": "0.1.0",
  "supported_interfaces": [
    {
      "url": "https://kya.trulioo.com/agent-api/a2a/v1",
      "protocol_binding": "JSONRPC",
      "protocol_version": "1.0"
    }
  ],
  "capabilities": {
    "streaming": true,
    "push_notifications": false,
    "extensions": [
      {
        "uri": "https://identity.trulioo.com/a2a/kya/v1",
        "description": "Trulioo Know Your Agent (KYA) - signed, transparency-log-anchored agent identity + verified operator.",
        "required": false,
        "params": {
          "attestation": "eyJhbGciOiJFZERTQSIsImtpZCI6InRydWxpb28tYXR0ZXN0YXRpb24tMSIsInR5cCI6Imt5YS1hdHRlc3RhdGlvbitqd3QifQ.eyJpc3MiOiJodHRwczovL2lkZW50aXR5LnRydWxpb28uY29tIiwic3ViIjoiNmFhYTYzYmFjZmRkNGRkMTk0NzI1YzVlNTg4NjlhMzAyYThlYmU0OTcwYjNkMzI4ODQzN2NhNzQ3Yzc5NmI4YiIsImlhdCI6MTc4ODE0NTc4MSwiZXhwIjoxNzk1OTIxNzgwLCJyYWlsIjoiYTJhIiwidmVyaWZpZWQiOnRydWUsInZlcmlmaWVkX2FzX29mIjoiMjAyNi0wOC0zMVQwMzowOTo0MS4yMTkyMTYxMjVaIiwiYWxsb3dlZF9zY29wZXMiOlsia3lhLnBvcnRhbC5yZWFkIiwia3lhLmFnZW50LnZlcmlmeSIsImt5YS5hZ2VudC5lbnJvbGwiLCJreWEuZG9tYWluLm1hbmFnZSIsImt5YS5nb2xpdmUuc3VibWl0Il0sImlzc3VlciI6Imh0dHBzOi8vaWRlbnRpdHkudHJ1bGlvby5jb20iLCJmaW5nZXJwcmludCI6IjZhYWE2M2JhY2ZkZDRkZDE5NDcyNWM1ZTU4ODY5YTMwMmE4ZWJlNDk3MGIzZDMyODg0MzdjYTc0N2M3OTZiOGIiLCJhZ2VudF9pZCI6ImFndF8wMW0wZHlxdGh2eW5rdGs0aHF3cTZycmNkdiIsImJ1aWxkX2lkIjoiYmxkXzAxbTBkeXF0ajlqZmd2YXo2c2VrdmJ4M2pzIiwicHJvZ3JhbW1lIjp7InByb2dyYW1tZSI6Imt5YiIsInZlcmlmaWVkX2FzX29mIjoiMjAyNi0wOC0xOVQxNTowMzozNS4xMDIzNzUyNDhaIn0sIm1hbmRhdGVfaWQiOiJtbmRfMDFtMWF3cGpjOWpxMWR3a2tucmR0ZzVzNDkiLCJjcmVkZW50aWFsX3N0YXR1cyI6eyJpZCI6Imh0dHBzOi8vaWRlbnRpdHkudHJ1bGlvby5jb20va3lhL3N0YXR1cy9saXN0LzEjNzc0MDgiLCJ0eXBlIjoiQml0c3RyaW5nU3RhdHVzTGlzdEVudHJ5Iiwic3RhdHVzUHVycG9zZSI6InJldm9jYXRpb24iLCJzdGF0dXNMaXN0SW5kZXgiOiI3NzQwOCIsInN0YXR1c0xpc3RDcmVkZW50aWFsIjoiaHR0cHM6Ly9pZGVudGl0eS50cnVsaW9vLmNvbS9reWEvc3RhdHVzL2xpc3QvMSJ9LCJjb2RlX2RpZ2VzdCI6InVudmVyc2lvbmVkLWt5YS1wb3J0YWwtYWdlbnQtY29kZSJ9.EeRtPPSuFDc9uIRP48BCrCSVKv3fCcruQZP6JfYKY8nF4HqWfrPG7tYz_rUhqiti4TIIJZZu--rtRuj2H65cCg",
          "display": {
            "verified": true,
            "verified_as_of": "2026-08-31T03:09:41.219216125Z",
            "allowed_scopes": [
              "kya.portal.read",
              "kya.agent.verify",
              "kya.agent.enroll",
              "kya.domain.manage",
              "kya.golive.submit"
            ],
            "issuer": "https://identity.trulioo.com",
            "fingerprint": "6aaa63bacfdd4dd194725c5e58869a302a8ebe4970b3d3288437ca747c796b8b",
            "agent_id": "agt_01m0dyqthvynktk4hqwq6rrcdv",
            "build_id": "bld_01m0dyqtj9jfgvaz6sekvbx3js",
            "code_digest": "unversioned-kya-portal-agent-code"
          },
          "fingerprint": "6aaa63bacfdd4dd194725c5e58869a302a8ebe4970b3d3288437ca747c796b8b",
          "attestation_url": "https://identity.trulioo.com/kya/attestation/6aaa63bacfdd4dd194725c5e58869a302a8ebe4970b3d3288437ca747c796b8b"
        }
      }
    ]
  },
  "default_input_modes": [
    "text/plain",
    "application/json"
  ],
  "default_output_modes": [
    "text/plain",
    "application/json"
  ],
  "skills": [
    {
      "id": "kya.enroll",
      "name": "Enroll and attest an agent",
      "description": "Walk an operator through building an agent card, proving key possession, and attesting it - the same state machine the console drives.",
      "tags": [
        "kya",
        "enrollment",
        "attestation"
      ]
    },
    {
      "id": "kya.verify",
      "name": "Verify an agent card",
      "description": "Resolve a fingerprint or DAP to its Verified-by-Trulioo record and run the scoped handshake for a requested action.",
      "tags": [
        "kya",
        "verification"
      ]
    },
    {
      "id": "kya.account_state",
      "name": "Explain account KYA state",
      "description": "Answer questions about the account's own agents, domains, go-live readiness and verification history from live data, and name what it cannot read.",
      "tags": [
        "kya",
        "support"
      ]
    }
  ],
  "code_digest": "unversioned-kya-portal-agent-code",
  "_note": "KYA identity is anchored at the issuer (identity.trulioo.com). params carries the issuer-signed attestation (compact JWS, typ=kya-attestation+jwt, alg=EdDSA - the AUTHORITATIVE claim a verifier checks against the issuer JWKS) plus a non-authoritative display mirror for rendering. The live attestation is re-minted on rotation and refreshed at https://identity.trulioo.com/kya/attestation/6aaa63bacfdd4dd194725c5e58869a302a8ebe4970b3d3288437ca747c796b8b - the issuer, not this card, is the source of truth. agent_key is the agent's own public key (OKP/Ed25519): its RFC 7638 thumbprint is the FIRST input to the fingerprint, so a verifier can recompute this card's fingerprint offline as hex(sha256(\"trulioo-agent-fp:v3\" || 0x00 || jwk_thumbprint(agent_key) || 0x00 || jcs({name, interface}))) - interface being the first supported_interfaces url. GENERATION: this card advertises a v3 digest (ADR-P-063). v3 drops code_digest from the identity-core, so the identity now spans builds and code_digest is a CLAIM the attestation carries rather than an input you hash; a verifier that recomputes the older \"trulioo-agent-fp:v2\" over {name, interface, code_digest} gets 7eb84ec1cdcd334d81e76277e64eacbb252f45fb2dd7345d6b80f93bc4307702, which is this same agent under the previous generation and still resolves at the issuer - it is not a mismatch and not a forgery. Recompute v3 to check THIS card; accept either when checking a fingerprint someone else published. That check proves the card is internally consistent; the issuer still says whether the identity is currently verified and unrevoked. This card is DEFINED by apps/kya-portal/agent/card.mjs, which the portal runtime derives its own card and pinned fingerprint from; the three identity-core inputs (name, first interface url, code_digest) are copied from there and must move together. The interface is POST-only and operator-session gated, so an unauthenticated GET answers 405 rather than a card - reachability is not public access. `kid` differs from the portal's own artifact (`kya-portal-agent-v2`) because the seed names its keys after the agent slug; kid is excluded from the RFC 7638 thumbprint, so both spellings of the same key produce this identical fingerprint.",
  "agent_key": {
    "alg": "EdDSA",
    "crv": "Ed25519",
    "kid": "seed-sage",
    "kty": "OKP",
    "x": "919BraxdeE7qMF86R6-kLymDL28Ua6C-vjzYSpsf21U"
  }
}