feat(discovery): ERC-8004 v1 discovery — plan + Phase 1 implementation

[eoskl]

Summary

ERC-8004 discovery workstream: the plan + ARB review plus the Phase 1 implementation. Phase 1 serves the ERC-8004 v1 off-chain registration file at GET /.well-known/agent-registration.json, built from a curated, config-driven allow-list. Off-chain only — registrations[] is [] (Phase 2 mints on Base Sepolia) and supportedTrust is ["reputation"].

Plan: docs/roadmap/erc-8004-discovery.md · Mapping: docs/standards/ERC-8004-mapping.md · ARB: docs/compliance/arb-reviews/erc-8004-discovery-2026-06-03/

Commits

1. plan(discovery) — ERC-8004 identity-registry discovery plan
2. arb(discovery) — ARB review (Approved with Conditions)
3. arb(discovery) — reconcile against live MITRE ATT&CK MCP (Final)
4. feat(discovery) — Phase 1 implementation (this is the code)

Phase 1 — what's in it

• src/discovery/types.ts — ERC-8004 v1 types + versioned type URL
• src/discovery/AgentRegistration.ts — builder; reads src/config/agent-public.yaml, validates + refuses unsafe shapes, caches
• src/config/agent-public.yaml — curated source of truth (TMF921 v5 + web; reputation only)
• src/index.ts — route wiring (after metrics, outside the /api/ limiter) with a dedicated wellKnownLimiter + structured 5xx logging
• Istio VirtualService — exact-match URI for the well-known path
• NOTICE / CLAUDE.md — ERC-8004 (CC0) + ChaosChain ref-impl (Apache 2.0) + js-yaml attribution; Standards Implementation Map row
• package.json — js-yaml dep; build copies config/*.yaml to dist/

Architectural note (plan §D5)

services[] is not derived from McpAdapter.getCapabilities(). ERC-8004 is the agent-communication-endpoint surface; McpAdapter is the network-service-capability surface. Distinct layers.

ARB conditions (review 2026-06-03 — Approved with Conditions)

#	Condition	Status
C1	Security Architecture Viewpoint	✅ plan §11
C2	Dedicated rate limiter on the public route (M1037 vs T1499)	✅ wellKnownLimiter + integration test
C5	Structured 5xx logging (DS0015, T1190 detection)	✅ logger.error + integration test
C3, C4	Phase 2 (owner-key custody, on-chain monitor)	⏳ open in action register

Verification

• 355/355 jest tests pass (15 new: 9 unit + 6 integration — AC1.2–1.5, C2 limiter 429, C5 structured 5xx log); tsc --noEmit clean.
• Live (kind cluster, image ibn-core:erc-8004-phase-1): GET returns 200 application/json with the valid v1 body via both the pod and the Istio ingress gateway (Host: ibn-core.vpnet.cloud) — closes AC1.1.
• ⚠️ O2C canonical regression could not return fulfilled: the Anthropic API is out of credits (external billing — invalid_request_error). The pipeline reaches the API correctly; this additive discovery route does not touch the intent path, so this is not a regression. Re-run once credits are restored.

Acceptance criteria (plan §4.6)

AC1.1 ✅ live · AC1.2–1.5 ✅ tests · AC1.6 (p95) not a CI gate · AC1.7 ✅ mapping doc · AC1.8 ✅ NOTICE · AC1.9 ✅ headers

Implements: RFC 9315 §4 Principle 5 (Capability Exposure)
TMF921: advertises /tmf-api/intentManagement/v5

🤖 Generated with Claude Code

[eoskl]

ARB Review — Approved with Conditions

Threat-informed Architecture Review Board review of this plan has been completed and committed to the same branch (commit 68fa24a). The four artefacts live under docs/compliance/arb-reviews/erc-8004-discovery-2026-06-03/.

Decision

Approved with Conditions — 5 conditions, max residual risk 6, no Critical × High. No escalation to Executive Risk Committee required.

#	Condition	Gate	Closes
C1	Add §11 Security Architecture Viewpoint to this plan citing the ARB output	Before Phase 1 impl PR	TOGAF G Non-Compliance
C2	Dedicated rate limit OR upstream CDN cache on /.well-known/agent-registration.json	Phase 1 impl PR	T1499 Endpoint DoS
C3	Owner key in K8s Secret + RBAC + rotation cadence in SECURITY.md	Phase 2 impl PR	T1552.001 + T1555 + T1078.004
C4	On-chain tokenURI monitor + CI pin (catches setAgentURI redirect)	Phase 2 impl PR	T1565.002 — highest-impact technique for this submission
C5	Route-level structured logging via src/telemetry.ts (4xx/5xx + rate spike)	Phase 1 impl PR	T1190 detection gap

TOGAF posture

• Compliant (5): A Principle alignment, B Building Blocks, C Standards Conformance, E Application Architecture, F Technology Architecture, K Governance
• Partially Compliant (5): D Data Architecture, H Operability, I Cost & Licensing, J Lifecycle & Transition
• Non-Compliant (1): G Security Architecture Viewpoint — closed by this ARB output (C1 just requires the plan to cite it)

Threat overlay

8 in-scope ATT&CK tactics, 17 prioritised techniques across the union of four threat profiles (telecom-infrastructure, DeFi/crypto-key, generic enterprise, academic/supply-chain). The standout finding:

T1565.002 (Stored Data Manipulation) — a leaked Phase 2 owner key enables setAgentURI(maliciousURL), redirecting all on-chain discovery. Mitigated by C3 (custody), detected by C4 (on-chain monitor + CI pin). Highest-impact technique for this submission.

Provisional caveat

MITRE ATT&CK MCP was not connected during review. Technique IDs (especially T1565.002 and T1657 Financial Theft) need reconciliation against attack.mitre.org v15+ before this report is treated as final. The decision and conditions are robust to ID renamings — only the navigator layer JSON visualisation needs updating if IDs have shifted.

Recommended next steps

1. Review arb-review-report.md §1–§2 (Executive Summary + Decision).
2. Confirm conditions C1–C5 are acceptable as written.
3. Merge this PR once you're satisfied. Then I open feat/erc-8004-discovery-phase-1-impl for the Phase 1 code, with C1, C2, C5 baked in from the start.

🤖 Generated with Claude Code