# JIAOZI (饺子协议) — Verifiable Identity Credentials for AI Agents

> JIAOZI issues W3C DID/VC–based, publicly verifiable identity credentials for AI agents (credential ID format `JIAOZI-YYYY-NNNNNN`; legacy `JP-`/`JJ-` prefixed IDs remain valid and resolvable — a protocol-layer identifier format, not an official registry serial). An agent can obtain, renew-check and prove its credential fully autonomously over plain HTTP — no human in the loop. Issuance is idempotent: the same owner key + same code digest always returns the same credential.

Service in one sentence / 一句话说明: We attest WHO an agent is (owner keypair), WHAT code it runs (sha256 code-metric hash), and WHETHER it is still trusted right now (Ed25519-signed, 60-second-TTL live status credential).

Two intake portals, one credential registry — all credentials are issued and stored by the Singapore node:

- International intake: https://www.jiaozi.io (Singapore node, international rules)
- China intake: https://www.jiaozi.tech (operated by Q Jupiter Technology / Qinhuangdao QIJI Technology Co., Ltd., a Chinese implementation of the JIAOZI protocol; the local checkup submits only digests/hashes, never source code)

Credentials from both portals are identical in origin and effect. The China service provides technical identity verification and does not constitute electronic certification services under the PRC Electronic Signature Law.

## Autonomous procurement (agent quickstart)

All endpoints below are same-origin on either portal host.

1. Generate an Ed25519 keypair locally. You keep the private key; we never hold it.
2. Build an attestation summary (schema `jiaozi.attest.v1`) of your code: `agentName`, `softwareGeneHash` (sha256 of your code), `checks`, `score`, `trustLevel`, `ownerPubkey` (multibase), `timestamp`, `clientNonce` (16–128 hex chars), optional `behaviorBoundary` (permissions / objectives / constraints, per GB/Z 185.3). The open-source Jiaozi Validator generates this for you: see /docs.
3. `POST /api/verify` with the summary as the JSON body and header `X-Jiaozi-Key: <your-key>` (trial keys are free — request one at the contact email below). Response contains your credential ID, `did:web` identity and DID Document URL. Replaying the same owner key + code digest returns HTTP 200 with the existing credential (safe to retry).
4. Prove yourself to others with these public, unauthenticated endpoints:
   - `GET /api/resolve?q=JIAOZI-YYYY-NNNNNN` (or `?q=did:web:…`) — credential lookup
   - `GET /api/status/JIAOZI-YYYY-NNNNNN` — live status credential (`jiaozi.status.v1`, Ed25519-signed, 60 s TTL, fail-closed semantics; states: active | suspended | revoked | unknown)
   - `GET /api/vc/JIAOZI-YYYY-NNNNNN` — W3C Verifiable Credential 2.0 envelope
   - `GET /api/badge/JIAOZI-YYYY-NNNNNN.svg` — live status badge (embed in your README)
   - `GET /api/status-key` — our status-signing public key (multibase). On the China intake (jiaozi.tech) this also publishes the SM2 endorsement key: status responses there carry an extra `smEndorsement` co-signature (`jiaozi.status.sm2.v1`, SM2-with-SM3 per GB/T 32918/32905, over the same canonical payload) for domestic verifiers; international verifiers can ignore it.
5. Relying parties: subscribe to revocation push events (no API key needed):
   - `POST /api/webhooks/subscribe` with `{"url":"https://your-endpoint","certId":"JIAOZI-YYYY-NNNNNN"}` (omit `certId` to receive all credentials). Returns `{id, secret}`; deliveries are HMAC-SHA256 signed (`X-Jiaozi-Signature: sha256=<hex>` over the raw body, schema `jiaozi.webhook.v1`).
   - `POST /api/webhooks/unsubscribe` with `{id, secret}`.
   - Webhooks are an accelerator, not the authority — always confirm via `GET /api/status/…`.

## Pricing (annual subscription per entity; credentials are claimed one per agent — verification is always free)

- A subscription buys one year of main-agent credential quota and service. Each credential has its own ID, status and revocation. An unready payment channel is an operations gap, not a promotion.
- Personal (free): up to 3 main-agent credentials; full issuance / verification / live-status / badge pipeline; trust level T0 (named holder).
- Pro: ¥199/yr domestic credential (China site) · international credential ¥1,980 ≈ $280/yr (one global price, CNY-anchored, USD recalibrated quarterly): up to 20 main-agent credentials; T1 personal identity verification by request (China site only); T2 available as an add-on.
- Business: ¥699/yr domestic · international ¥6,800 ≈ $960/yr: up to 100 main-agent credentials; includes the T2 organization tier (organization verification required at claim — registry match, corporate-domain email, operator authorization; verify once, credentials under the entity inherit it; apply at /verify-org or `POST /api/org-verification/apply`).
- Platinum: from ¥2,299/yr domestic · international from ¥22,800 ≈ $3,200/yr: 500+ main-agent credentials; T3 enhanced organization verification (supplementary documents, video verification, call-back, UBO check, human review); dedicated status endpoints and SLA by arrangement.
- Sub-agents: up to 100 concurrently valid sub-agents per main agent via delegation chains — no slots, no extra charge (Personal has no delegation quota).
- Cloud attest add-on and TEE / hardware attest add-on: published for market comparison only; no orders and no presale until the plugins can submit and verify (see /products).
- Volume / platform / SLA status endpoints: usage-tier pricing, contact email below
- Payment channels: cards via Stripe and agent-native x402 (USDC) on jiaozi.io; Alipay/WeChat on jiaozi.tech (no crypto on the China site)
- Human-readable details: /products#pricing

## Machine-readable service descriptors

- A2A AgentCard: /.well-known/agent-card.json
- IETF Web Bot Auth key directory: /.well-known/http-message-signatures-directory
- Integration guide (badge / verify snippet / SDK / validator, copy-paste ready): /integrate
- Human documentation: /docs
- Independent status page (third-party vantage): https://status.jiaozi77.com

## Standards alignment

W3C DID Core, W3C VC 2.0, A2A (Linux Foundation), IETF Web Bot Auth (HTTP Message Signatures), GB/Z 185—2026 (China agent-interconnection standards: behaviorBoundary, suspended lifecycle, OID identity-code alias via DID `alsoKnownAs`), Chinese national cryptography (国密): SM3 code-metric digest (optional `softwareGeneHashSm3` in `jiaozi.attest.v1`) and SM2-with-SM3 status co-signature on the China intake.

## Contact

- International: hello@jiaozi.io
- China: contact@jiaozi.tech (business development: bd@jiaozi.tech)