Building open identity and trust infrastructure for autonomous agents.
ANS gives agents a portable way to establish identity, prove control, publish capabilities, discover endpoints, and verify authoritative state across organizational boundaries. My role spans the protocol, the public reference implementation, production architecture, and the open-source effort moving the work toward vendor-neutral governance.
The work I lead and own
Open-source engineering
I run the ANS open-source engineering effort, coordinating the reference implementation, SDKs, protocol work, and the technical preparation for Linux Foundation stewardship.
Separately, I participate directly in AAIF technical meetings and working groups across the broader open-agent infrastructure ecosystem.
Specification and reference architecture
I own major parts of the public protocol contract and keep the normative specification aligned with real, interoperable behavior across identity, registration, naming, PKI, discovery, and transparency.
GoDaddy Registration Authority
I lead development of GoDaddy's ANS Registration Authority, turning the public protocol into registration, control-proof, certificate, DNS, and authoritative lifecycle workflows.
Professional implementation · details proprietaryGoDaddy transparency log
I designed and wrote the transparency-log implementation for GoDaddy's ANS instance, including the append-only evidence model and its integration with registration lifecycle state.
Professional implementation · details proprietaryPublic authored pull requests · August 2026
Architecture across the full trust path
ANS is not a single registry service. The architecture has to stay coherent from normative protocol language through registration and discovery to independent verification.
Protocol and specification
Identity model, versioned naming, registration lifecycle, discovery profiles, PKI, and transparency contracts.
Registration and evidence
Control proof, certificate orders, DNS verification, lifecycle state, append-only events, receipts, and checkpoints.
Discovery and verification
DNS and Web resolution, SDK integration, offline-capable verification, and production RA / transparency-log operation.
Architecture decisions with durable value
Turned the specification into an implementation-backed contract
Audited and rewrote the foundational ANS identity, registration, and versioned-naming specifications against shipped behavior. The work removed unimplemented promises, corrected lifecycle and certificate semantics, and made deliberate protocol decisions where the implementation and normative text had diverged.
Separated who controls an agent from what the agent is
Designed and implemented first-class verified identities with challenge-bound proof of control for did:web and did:key. An identity can be proven once, linked across an agent fleet, and rotated or revoked through a single transparency-log event rather than mutating every agent record.
Verified identities implementationMade authoritative state depend on durable evidence
Established the seal-before-success invariant: registration cannot become authoritative until its terminal event is accepted by the transparency log. Extended that trust model into offline-capable verification with signed status tokens, COSE receipts, and Merkle inclusion proofs, and corrected checkpoint signature encoding to match the C2SP wire contract.
Moved discovery to DNS-AID without breaking deployed behavior
Changed the V2 default from the legacy TXT profile to DNS-AID-aligned SVCB records while preserving the V1 lane and every stored agent profile. Carried the same contract into the Rust SDK so clients can select the V2 lane and work with both discovery profiles.
Designed certificate issuance as a provider-independent lifecycle
Replaced a synchronous local-signing assumption with a certificate-order abstraction that supports self-managed and external RFC 8555 issuers. The lifecycle carries DNS-01 and HTTP-01 challenges through asynchronous issuance while preserving a consistent registration contract.
Certificate-order architectureThe architectural throughline
Specifications must describe enforceable behavior
Unimplemented guarantees were removed from the public contract; real invariants were made explicit and testable.
Identity requires control proof
Resolution alone is not identity. A trustworthy system binds claims to authoritative keys and replay-resistant proof.
Authoritative state cannot outrun evidence
If evidence is part of the guarantee, success must be conditional on that evidence actually existing.
Trust should remain independently verifiable
Signed receipts, checkpoints, and inclusion proofs reduce dependence on a continuously available central authority.
Inspect the work directly
The public repositories show the protocol decisions, implementation changes, review history, interoperability work, and specification ownership behind this case study.