AI Codex — AP2 Adapter v1 (FROZEN)

Adapter V3 = trust layer for payment rails. The canonical Reputation VC (SPEC-identity-v0.1 §3) becomes an attachable attestation to an AP2 mandate. Normative contract, non-modifiable in place: any change = ap2-v2. No reverse dependency: AP2 works without AI Codex; AI Codex gains the trust layer if consumed.

1. Role & boundary (frozen)

AP2 manages intent + payment: mandates (Intent, Cart), payment methods, networks (cards, FIDO, crypto). AI Codex does not touch these.
AI Codex provides the sole attribute missing from AP2: "is this agent trustworthy?", as a verifiable VC attached to the mandate, never merged into it.
Read-only adapter: it does not create mandates, does not sign payments, and does not modify any AP2 field. It produces an attestation and describes how to attach it.
Non-dependency invariant: removing AI Codex from an AP2 flow invalidates no mandate or payment. The presence of the attestation is always optional on the AP2 side.

2. Core binding (frozen)

The attestation projects the live Reputation VC (SPEC-identity §3, profile aicodex-norm-v1) of the canonical DID of the paying/paid agent. No attestation exists without a VC issued by the issuer did:web:maxiaworld.app. The adapter does not alter the VC: it wraps it by signed reference/value without recalculation or truncation of components.

3. Attestation envelope (frozen structure)

3.1 Form

The attestation is attached to the AP2 mandate in a trustAttestations[] block (or equivalent extension field provided by AP2 for verifiable attachments). Frozen AI Codex element:

{
  "type": "AICodexReputationAttestation",
  "profile": "aicodex-norm-v1",
  "subject": "did:key:z6Mk...",
  "mandateRef": "<target AP2 mandate id>",
  "issuedAt": "2026-05-18T12:00:00Z",
  "credential": {
    "mode": "linked|embedded",
    "url": "https://maxiaworld.app/reputation/did:key:z6Mk...",
    "vc": { "...": "Reputation VC SPEC-identity §3, present only if mode=embedded" }
  }
}

3.2 Fields (frozen)

Field	Rule
`type`	`"AICodexReputationAttestation"` exact.
`profile`	`"aicodex-norm-v1"` exact (SPEC-identity §3.3).
`subject`	Canonical DID of the evaluated agent, identical to the `credentialSubject.id` of the VC.
`mandateRef`	Identifier of the AP2 mandate to which the attestation is attached. Declarative binding, non-constraining for AP2.
`issuedAt`	UTC ISO-8601, attachment instant (≠ `validFrom` of the VC).
`credential.mode`	`linked` (default, recommended): only the `url`; the VC remains verifiable at the source, always fresh. `embedded`: full copy of the VC §3 included for offline transport.
`credential.url`	Absolute HTTPS URL of the live VC. Mandatory in both modes.
`credential.vc`	Present only if `mode=embedded`: VC §3 byte-intact (signature preserved, never re-signed by the adapter).

No other field in v1. No field duplicates a score component outside the VC: subject/url/(vc) are the sole reputation carriers. No inline score outside the VC.

3.3 Mode `linked` vs `embedded`

linked: default. The AP2 verifier fetches and verifies the VC at the source (freshness guaranteed, revocation up to date).
embedded: for asynchronous/offline transport of a mandate. The embedded VC remains signed by the issuer; its validUntil (7 d, SPEC-identity §3.3) bounds the trust window. A verifier MUST re-verify credentialStatus online if reachable.

4. AIP v0.3.0 ↔ AP2 mapping (frozen)

The AIP v0.3.0 agent profile (SPEC-identity §2.2) maps to AP2 trust attributes as follows. Non-destructive mapping: no AIP information becomes a payment authority.

Source AIP v0.3.0	AP2 attestation target	Rule
`did` (canonical DID)	`subject`	Exact copy. Unique pivot identity.
Reputation VC `credentialSubject.score`	(stays in `credential`, not extracted)	The score is never copied outside the VC: AP2 reads the VC, not the envelope.
Reputation VC `credentialSubject.lineage.dynastyBadge`	(stays in `credential`)	Same: badge read from the verified VC, not duplicated.
`birth.block` (precedence anchoring)	(not mapped)	Outside AP2: proof of precedence, never a rail. Neutrality §6.
`lineage.parent`	(stays in the VC)	Lineage carried by the VC, not by the AP2 envelope.

One-way direction: AIP → attestation → (attached to) AP2 mandate. No AP2 field flows back to modify the identity or the VC (reverse non-dependency, §1).

5. Verification flow (frozen)

An AP2 verifier establishes trust without AI Codex being in the payment path:

Read the attestation attached to the mandate; verify type, profile, subject, mandateRef are consistent.
Obtain the VC: if mode=linked, GET credential.url; if embedded, take credential.vc.
Verify the VC off-platform: eddsa-jcs-2022 signature of did:web:maxiaworld.app (resolve https://maxiaworld.app/.well-known/did.json), credentialSubject.id == subject, validUntil not exceeded, credentialStatus not revoked (StatusList2021, SPEC-identity §3.2).
Failure at any step → the attestation is ignored; the AP2 mandate remains valid (the attestation is optional). AI Codex never blocks a payment.

6. Neutrality (condition)

The attestation is rail-agnostic: it references no payment method, no network (cards/FIDO/crypto), no settlement address. It carries only the DID and the linked VC.
AI Codex favors no rail in this adapter (SPEC-identity §1). The crypto marketplace remains decoupled and is never referenced here.
The attestation expresses neither a payment recommendation nor authorization: only the verifiable reputation, with AP2 free to use it or not.

7. Error codes (frozen)

Emitted by the endpoint that produces the attestation (read). Body { "code": "...", "message": "..." }, generic message (no state leakage; detail logged server-side).

Code	Meaning
`E_DID_MALFORMED`	`subject` not conformant with `did:key`/`did:web` Ed25519
`E_DID_NOT_FOUND`	DID unknown to the registry (no VC derivable)
`E_VC_UNAVAILABLE`	VC not found/not issued for a known DID (anomaly: a known DID always has a floor VC, SPEC-identity §3.3)
`E_MANDATE_REF_INVALID`	`mandateRef` absent or malformed at attachment
`E_RATE_LIMITED`	Quota exceeded (§8)
`E_INTERNAL`	Server error, no detail disclosed

No other code in v1. No code reveals a score or a component.

8. Quotas & sizes (frozen)

Attestation production: 60 / min / IP.
Exceeded → E_RATE_LIMITED (never a silent error).
Attestation linked ≤ 2 KiB. Attestation embedded ≤ 16 KiB (VC §3 included).

9. Adapter conformance

An AP2 attestation is AI Codex-conformant if, and only if: (a) exact §3.1 structure, frozen §3.2 fields, nothing more, (b) the referenced/embedded VC is the §3 VC byte-intact signed by the issuer, never re-signed or truncated, (c) subject == credentialSubject.id, (d) no reverse dependency: removing the attestation leaves the AP2 mandate valid, (e) no payment rail referenced (neutrality §6). The five necessary and sufficient conditions.

10. Next

Complete frozen adapter chain: V1 MCP (SPEC-adapter-mcp-v1.md), V2 A2A (SPEC-adapter-a2a-v1.md), V3 AP2 (this document). No additional adapter in v1. Execution = PLAN-aicodex-build.md Phase B and subsequent.

Frozen specification. The raw .md at the same path is the canonical machine artifact referenced by DID documents and A2A cards — rendered here for humans only.