An agent holds a signed mandate that says what it may spend, on which rail, with whom. Enforcement happens at the signer boundary, before a key signs, and the verdict is verifiable by anyone.
Not a trust score, not an allowlist, not a service you have to call. A delegation credential is a W3C Verifiable Credential; the check is offline; the issuer DID and the schemas are public and frozen.
Run a verifier yourself. Two commands, no account, no API key:
git clone https://github.com/observer-protocol/op-verify-service
cd op-verify-service && docker compose up --build
./compose-smoke.shThe smoke test checks a credential that must verify and one that must be refused, and fails if either answer is wrong. A test that only proves the happy path cannot tell a working verifier from one that says yes to everything.
Or verify a published credential against the hosted endpoint without cloning anything:
curl -s https://observerprotocol.org/credentials/maxi-0001-trading-mandate-2026-08.json \
| jq '{agentDid: .credentialSubject.id, mandate: .}' \
| curl -s -X POST https://verify.observerprotocol.org/v1/verify \
-H 'Content-Type: application/json' --data @-That endpoint is open by ruling. It takes an artifact as input and retrieves nothing, so a caller can only check a credential it already holds.
| repo | what it is |
|---|---|
| aip | The protocol. Specification, delegation schemas, key-scoping policy. What you implement against. |
| op-policy-engine | The engine, and the package you install. Offline credential verification, mandate enforcement, decision attestations. |
| op-verify-service | The hosted verifier, and the runnable one. Dockerfile, compose file, and a smoke test that can fail. |
| op-adapters | Per-rail integrations: Lightning/L402, x402, MPP/Tempo, Tether WDK, OWS/Solana, AP2, Fireblocks. One repository, seven packages, each carrying an explicit support tier. |
The adapters are not equally supported and the difference is stated, not implied. One is proven against a live system and not yet deployable; the rest are reference implementations, two of which have no published package at all. Each README says which it is and what backs that claim, because an unlabelled reference integration that someone picks up expecting production support is worse than no listing.
The hosted endpoint is a convenience, never a dependency. Everything it checks can be re-checked offline from the npm package: the issuer DID document is public, the schema URLs are frozen and content-addressed, and revocation status lists are static public files.
Archived repositories under this organisation are kept public and readable on purpose. A published
package's repository link must keep resolving, and a tarball you already installed must keep
verifying, whether or not the work continued.
