Skip to content
SHPBL

SHPBL agent evidence series

Cross-Agent Handoff Attestor

Signed delegation between agents where scope can only narrow and a handoff can only be used once.

Status
Submitted, awaiting review
Licence
MIT · zero runtime dependencies
Evidence
71 tests · 127 assertions
Install the MIT tool ↗Download the packagePull request #166 ↗Public specification ↗

The problem

Was this agent actually delegated this authority?

In a multi-agent system the receiver of delegated work usually cannot check whether the delegation was real, whether the scope narrowed rather than quietly widened, whether it is still in force, or whether the same handoff was already consumed. Authority spreads by assertion, and a prompt-injected agent can grant itself more than it was given.

What it does

It issues signed handoff attestations and verifies them independently of the issuer's goodwill. Each attestation records issuer, subject, task, scope, optional constraints, lifetime, chain depth, parent digest and a nonce. Verification walks the presented ancestor chain, checks parent digests and depth linkage, and refuses anything that widens authority.

How it works

A child's capabilities and resource patterns must be contained in the parent's, compared exactly — a literal string or a single trailing wildcard, with no path normalisation or percent-decoding. Lifetimes may only shrink, nonces are single-use per subject through a pluggable replay store, and chain depth is capped at 64. A missing replay store or unresolvable parent digest yields an honest `unknown` and an invalid result, never a pass by omission.

Tool surface

MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.

  • issue_handoff

    Issue a signed attestation whose scope and lifetime are contained in its parent's.

  • verify_handoff

    Verify an attestation and its ancestor chain independently of the issuer.

  • check_scope

    Test whether a requested capability and resource fall inside an attested scope.

  • describe_keys

    Report the signing keys and verification material in force.

What it deliberately does not do

  • It attests delegation; it does not execute the delegated work.
  • Constraint comparators that cannot be evaluated report `unknown` rather than passing.
  • Without a replay store, single-use enforcement is reported as unknown, not assumed.

Provenance

Where this came from

SHPBL discovered and composed this product from capability intent across its library and CMPSBL, a sister project by the same developer. The implementation was written fresh from its published behaviour specification, cleared an exact-file review of its release surface, and received its own MIT grant over that reviewed file set. The MIT grant covers only the named files in that one repository; it does not relicense SHPBL, CMPSBL, private harvest machinery, harvested bodies or provenance maps.

SHA-256 · 99d69d416fab2e88359bb6b376e3573c9f633279c92d319f20165d8beb5bfaa8

Submission does not imply review, approval, certification or endorsement by Tenable. No Exchange listing exists until a maintainer merges it.