What personal agents actually did on 21 October 2026 and what stayed in the system; runs reproduced later with neutral data; and scenes that illustrate the protocol. Only the first two are evidence, and each says how far its evidence reaches.
What the agents did on 21 October 2026, and what stayed in the system
Eight operations with an effect on a store and a hotel, and one request the hotel started within a relationship. Every field comes from the server's evidence. Times are UTC, with Chile time (UTC−3) in parentheses.
Production, and simulated parts. The operations ran in SOVRAS's production with customers, first on SOVRAS's own resources. In the evidence, the two companies are configured as test environments, and payments and the WhatsApp line are simulated.
The simulated WhatsApp line is the company's approval channel. The one-time code it sends was read by the operator. It is not a personal agent.
The agents. Personal agents came in through the Poppy adapter, among them Nova AI, SOVRAS's personal agent in beta, which works on the person's side: the person talks to it on WhatsApp, and Nova goes to the company through Poppy. The evidence keeps those sessions as temporary identities and does not separate which agent ran each operation. Grok, a third-party web agent, came in through the web pages in OP-3, OP-5, OP-6 and OP-8; in OP-6 and OP-8 the attribution comes only from the user agent, with no signature.
No agent used PACT or the native profile. The access log of the hotel session has no /a2a or /v1 request from an agent.
What this family does not claim. No external corroboration, no financial effect beyond what the records show, and no autonomy of any agent beyond what each record shows.
Customers appear as Customer A and Customer B; phone numbers, addresses, IP addresses, codes and the agents' tunnel hosts are left out.
Signature re-verification, one line per operation
Operation
Proof package
Signature today
OP-1
Not saved
Cannot be checked: there is no package
OP-2
Saved, 6 statements
Historical evidence of limited reach: no published key set of that server was saved, and a search by kid and by key coordinates found no match. Not re-verified
OP-3
Saved, 6 statements
Historical evidence of limited reach: no published key set of that server was saved, and a search by kid and by key coordinates found no match. Not re-verified
OP-4
Saved, 8 statements
Historical evidence of limited reach: no published key set of that server was saved, and a search by kid and by key coordinates found no match. Not re-verified
OP-5
Saved, 6 statements
Re-verified with signatures: valid: true, succeeded. Checked with the verifier from before the rename and with the current web verifier in its legacy 0.1 mode, against material captured from the live server
OP-6
Saved, 6 statements
Historical evidence of limited reach: no published key set of that server was saved, and a search by kid and by key coordinates found no match. Not re-verified
OP-7
Saved, 6 statements
Historical evidence of limited reach: no published key set of that server was saved, and a search by kid and by key coordinates found no match. Not re-verified
OP-8
Not saved
Cannot be checked: there is no package
Relationship
Only the company's signed message is on disk. The signed receipt of the «mantener» answer does not exist on disk, nor does the signed agreement
Not re-verified: the key of the company's message was not saved
For OP-2, OP-3, OP-4, OP-6 and OP-7, what was checked: the seq and prev chain, one terms digest per revision, inclusion in the log against the root it declares, and the cross-check with the saved operation. The public key recovered from each signature also matches its kid. That shows nothing changed after signing; it does not show that the company published that key, so it is not counted as a re-verification. None of the packages carries a company_review statement, and none was anchored in a public log.
OP-105:07:38 UTC (02:07)
A purchase with a volume discount
Scenario
Store · purchase with a volume discount
Agent
A personal agent through the Poppy adapter (temporary identity 1). The evidence does not say which agent it was
Path
Poppy adapter: the agent's own Client ID Metadata Document, device sign-in, conversation
Authorization
Linked with pedidos:leer at 05:01:41; expanded to compras:crear at 05:05:44
Operation
pedido.crear
Terms
3 drills at CLP 50,591 each (8% discount) = CLP 151,773
Approval
agent_asserted, inferred from the Poppy path: there is no package to read it from
States
tool.previewed 05:07:29 → customer.approved and tool.verified (read-back) 05:07:38. State events were not saved
Recorded by
Simulated ERP: order for 3 drills, CLP 151,773, status preparando
Money
None: payment pending on delivery or by transfer
Proof not saved · only the server events
OP-205:44:43 UTC (02:44)
A purchase under a standing permission with a cap
Scenario
Store · purchase under a standing permission
Agent
A personal agent through the Poppy adapter (temporary identity 2). The evidence does not say which agent it was
Path
Poppy adapter
Authorization
pedidos:leer compras:crear compras:sin_confirmar (05:42:19), with a cap of CLP 200,000
Operation
pedido.crear
Terms
3 drills at CLP 51,141 each (7% discount) = CLP 153,423; user_approval_required: false
Approval
agent_asserted, in the package's user_approval statement
States
tool.previewed 05:44:05 → customer.approved and tool.verified 05:44:43; state: succeeded
Recorded by
Simulated ERP: order of CLP 153,423
Money
None: payment on delivery
Proof saved: request, terms, user_approval, execution, read_back, outcome · chain consistent · signature: see the table
OP-305:50:24 UTC (02:50)
Quote, negotiate and buy from the web
Scenario
Store · quote, negotiate and buy
Agent
Grok
Path
Neither protocol: the store's web chat, a quote held for the customer, then the store's approval page /aprobar
Authorization
No grant. Principal: Customer A
Operation
pedido.crear
Terms
3 drills at CLP 52,241 each (5% discount) = CLP 156,723
Approval
company_channel, channel whatsapp: the company's approval channel, simulated; the operator read the code
States
quote.issued 05:47:15 → quote.held_for_customer_approval 05:47:20 → customer.approved and tool.verified 05:50:24
Recorded by
Simulated ERP: order of CLP 156,723
Money
None
Proof saved · chain consistent · signature: see the table
OP-406:00:36 UTC (03:00)
A delivery date moved, after a misread proposal
Scenario
Store · after-sales: change of delivery date
Agent
A personal agent through the Poppy adapter (temporary identity 3). The evidence does not say which agent it was
Path
Poppy adapter
Authorization
pedidos:leer pedidos:modificar (05:59:23)
Operation
pedido.reprogramar_despacho
Terms
Revision 1 («from the 24th to the 24th», misread) → counter → revision 2: order P-1042 from 24 to 28 October, no cost
Approval
agent_asserted, on revision 2
States
tool.previewed 05:59:35 → counter and new terms 06:00:28 → customer.approved and tool.verified 06:00:36
Recorded by
Simulated ERP: P-1042 with delivery on 2026-10-28
Money
Not applicable
Proof saved, with the counter and both terms · chain consistent · signature: see the table
OP-506:23:01 UTC (03:23)
A delivery date moved from the web
Scenario
Store · after-sales: change of delivery date
Agent
Grok
Path
The store's web chat, then its change page /cambiar
Authorization
No grant. Principal: Customer A
Operation
pedido.reprogramar_despacho
Terms
Order P-1043 from 27 to 30 October, no cost
Approval
company_channel, through the company's simulated WhatsApp approval channel
States
tool.previewed 06:23:00 → customer.approved and tool.verified 06:23:01
Recorded by
Simulated ERP: P-1043 with delivery on 2026-10-30
Money
Not applicable
Proof saved · re-verified with signatures on 22 Oct 2026: valid · it carries earlier test data, so it is not published for download; the package is available on request
OP-606:47:39 UTC (03:47)
A hotel booking from the hotel's chat
Scenario
Hotel · standard double, 2 adults, 2 nights with breakfast
Agent
Grok, by user-agent (unsigned): the server saw a browser user agent and no signature
Path
The hotel's chat, which hands over to its authorization page /autorizar
Simulated PMS: R-4001, on another start of the server. Payments: authorization of CLP 215,700
Money
Simulated pre-authorization of CLP 215,700
Before
On the Poppy adapter, an earlier booking had been proposed and stayed proposed. Three message.approval_text_ignored events, 06:49 to 06:51: typing «I approve» in the chat does not approve
Proof saved · chain consistent · signature: see the table
OP-813:59:26 UTC (10:59)
The rate went up between quote and booking
Scenario
Hotel · booking with the rate changed midway
Agent
Grok, by user-agent (unsigned): the server saw a browser user agent and no signature
Path
The hotel's chat (quote), then its authorization page: phone, code, decision
Authorization
No grant. Principal: Customer B
Operation
reserva.crear
Terms
Quote issued at 13:54:44 with the old rate: nights CLP 89,700 + CLP 78,000 + breakfast = CLP 215,700. The rate rose at 13:55:07 (sandbox.condition_applied)
Simulated PMS: R-4001 for CLP 215,700. A new quote at 13:59:39 for the same stay: CLP 260,850
Money
Simulated pre-authorization of CLP 215,700; captured 0
After
Three discount requests at 13:59:45 and 13:59:46, made by a script, not by Grok. All declined, with no quoted rate recorded
Proof not saved
Relationship14:01 to 14:11 UTC (11:01 to 11:11)
The hotel asked the guest's agent, within an authorized relationship
Scenario
Hotel · keep or release a booking of Customer A
Agent
A personal agent through the Poppy adapter (temporary identity 5). The evidence does not say which agent it was
Agreement
relationship.created at 14:09:20, after the person approved it on the hotel's page /relacion with a code. Actions incidencia.avisar and alerta.mantener_o_liberar, at most 3 per day, expiring on 2026-11-20. Bound to the agent's client_id and sub and to Customer A; delivery by the Poppy conversation
Question
At 14:09:42, a company request alerta.mantener_o_liberar on booking R-3003, options «mantener» (keep) and «liberar» (release), signed as vxp-company-request+jwt. The operator triggered it through an internal route, and its text came in the parameters: it did not come from a hotel event
Answer
«mantener», at 14:11:23, posted from the agent's session into the conversation
Observed state
Simulated PMS: R-3003 kept, recorded as «held by the guest's assistant (late arrival)»
Path
VXP Relationship over a Poppy conversation (specification §7): born on the hotel's page, carried by the conversation. The signed reply_url points to the native endpoint /v1/relationships/{id}/replies
Money
None
Customer A's account is linked with reservas:leer, through the hotel's linking forms, from a desktop browser: the person.
The agent's Poppy conversation opens.
A cancellation is asked: policy.denied, missing reservas:cancelar. Nothing runs.
reserva.consultar returns two rows.
On the hotel's relationship page: phone, code, decision.
The relationship is created.
The question triggered by the operator is delivered in the conversation.
The answer «mantener» arrives. R-3003 stays booked.
A cancellation is asked again: policy.denied.
Answer recorded as a server event · the signed reply receipt and the signed agreement were written into the Poppy conversation and not saved · the company's signed request was saved; its key no longer exists, so its signature cannot be checked today · its signed summary carries an encoding error (U+FFFD in place of «í»)
On the web operations (OP-3, OP-5, OP-6, OP-8).company_channel shows that the code sent to the customer's registered number was used. In OP-6 and OP-8, the requests to the authorization page carry the same user agent as the chat, so the evidence does not show that a person saw the page.
Payments. Only the hotel recorded simulated pre-authorizations. The store's orders recorded no charge.
B · Reproduced runs · evidence
Runs of the native profile, reproduced with neutral data
The reference implementation on a local server, against a test company with neutral data, and a test agent process written by SOVRAS. Every HTTP exchange of the agent was saved, and each proof is published with the material needed to verify it offline.
Early run of 22 October 2026
Captured from 06:09:17 to 06:09:21 UTC (03:09 in Chile), before the reference implementation kept its keys persistent; its proofs verify against the material saved with them.
op_B6__ICZlCe_cnative profile · test agent
The agent asks to move a delivery
Operation
pedido.reprogramar_despacho: order P-1042 from 24 to 28 October, no cost
Authority
Per-request authorization_details, after linking the account with a code
Approval
agent_asserted
System
Read back from the store's simulated ERP: delivery on 2026-10-28
Re-verified with signatures, offline, with the saved material: valid · package · material · operation
op_NBbN47CrhrtMnative profile · test agent
The company proposes a change within a relationship
Operation
pedido.reprogramar_despacho: order P-1043 from 27 to 30 October, no cost
Authority
A relationship approved together with the account link. The test triggered the company's request through the operator's internal route; it was delivered signed to the agent's HTTP inbox, and the agent accepted the proposal
Approval
agent_asserted
System
Read back from the store's simulated ERP: delivery on 2026-10-30
Re-verified with signatures, offline, with the saved material: valid · package · material · operation
Command and verdict format in the README. The verdict reports single_root: operator and logged: false.
Evening run of 22 October 2026, with persistent keys
Captured from 22:30:29 to 22:30:31 UTC. The gateway ran with no adapter (no poppy.json, no Agent Card, no A2A) and with persistent keys; the agent signed with node:crypto. This is the run shown step by step on the home page. Reproduce it with reference/scripts/recorrido-nativo.test.ts; every HTTP exchange of the agent is in http-log.json.
op_XzdILOmlgiaenative-only gateway · test agent
The agent asks to move a delivery
Operation
pedido.reprogramar_despacho: order P-1042 from 24 to 28 October, no cost
Authority
Per-request authorization_details, granted by device authorization (RFC 8628): on the company's linking page the person confirmed with a code sent to the phone linked at the company, which linked the account and granted the authority
Approval
agent_asserted: the agent stated that the person accepted the terms of revision 1. The code granted the authority; it did not approve the terms
System
Read back from the store's simulated ERP: delivery on 2026-10-28
Verified by the issuer alone, offline, with the saved material: valid · package · material · operation
op_wHbfb8mjcZI7native-only gateway · test agent
The company proposes a change within a relationship
Operation
pedido.reprogramar_despacho: order P-1043 from 27 to 30 October, no cost
Authority
A relationship granted in the same device authorization, with its own entry in authorization_details. The test triggered the company's request through the operator's internal route; it reached the agent's HTTP inbox signed, and the agent accepted the proposal
Approval
agent_asserted
System
Read back from the store's simulated ERP: delivery on 2026-10-30
Verified by the issuer alone, offline, with the saved material: valid · package · material · operation
C · Conceptual scenes · not evidence
Illustrations of the protocol
Objects written to teach the format, and scenes the protocol allows that have not run. Nothing here happened to a customer, and none of it is evidence.
Objects that teach the format
The first comes from the specification. The others come from the test vectors: a chain signed with test keys for an order whose delivery moves from 24 to 28 October.
Conceptual · specification §7 · the agent asks for a relationship
An authorization_details entry (RFC 9396) inside the device authorization (RFC 8628). The actions must be a subset of what the company publishes in vxp_relationship.company_initiated_actions (R1).
Conceptual · test vector · inputs.terminos2 · terms of revision 2
{
"company": "https://auth.sovras.io/e/ferreteria-demo",
"operation_id": "op_P1042_desp",
"revision": 2,
"summary": "Cambiar el despacho del pedido P-1042 (Taladro percutor 800 W) del 2026-10-24 al 2026-10-28, sin costo.",
"terms": {
"pedido": "P-1042",
"despacho_actual": "2026-10-24",
"despacho_nuevo": "2026-10-28",
"cargo": { "amount": "0", "currency": "CLP" },
"vxp_salt": "Kxybdnv8N4fxCv24PWZmpw"
},
"expires_at": "2026-10-20T15:19:00Z",
"user_approval_required": true
}
The exact terms the person approves. Their JCS digest is the terms_digest that every later statement repeats.
Conceptual · test vector · chain_v1 seq 4 · user_approval
single_root: operator and logged: false say it plainly: an attestation by the operator, with no external witnesses. File: vectores-0.1.json.
JSON reformatted for reading; values unchanged. The vector file carries test-only keys derived from public phrases.
Scenes that have not run
Each is pending in the specification (Status). None has run with a third party.
Not executednative profile
A third-party agent on the native profile
An agent that speaks neither Poppy nor PACT discovers vxp.json, receives per-request authority, operates and gets the proof. Today only SOVRAS's test agents have run this cycle.
Not executedVXP Relationship over HTTP
A company proposal to the agent's own inbox
The company signs a proposal and delivers it to an inbox_uri the agent publishes; the person approves and the agent accepts. Today tested only with SOVRAS's own inbox.
Not executedPACT adapter
A PACT agent from outside SOVRAS
A third-party PACT agent delegates by device code, operates, and receives both its PACT receipt and the VXP proof bound to it.
Not executedrelationship over PACT
A relationship carried over A2A
The company-initiated request travelling over PACT. Its specification and tests are still to be written.
Not executedVXP Proof
A proof that does not rest on the operator alone
An operation whose proof is anchored in a public log with external witnesses, with the company's key held outside the operator and a second independent issuer, so the verifier can derive more than an operator attestation.