PEAC Protocol
An open protocol for portable signed interaction records. PEAC defines a bounded record format, verification model, conformance requirements, and carrier mappings. It can be implemented and used independently of Originary.
PEAC Protocol is published by Originary and distributed through GitHub and package registries under Apache-2.0.
A record that survives the boundary.
PEAC defines how a system issues a signed record for an automated action so another party can verify what the issuer recorded, without trusting the original system or its dashboard.
One artifact, many signers
Every record is signed with Ed25519. Issuers publish their public key once. Verifiers check the signature offline against that key.
Travels across systems
Records are carried as compact JWS strings or exported as bundles. They do not depend on the issuer's dashboard, database, or API to stay verifiable.
Apache-2.0
Originary publishes the protocol specification, reference implementations, and core tooling publicly on GitHub. Anyone can self-host, issue, and verify records without an Originary account or managed service.
v0.16.3 on npm latest.
Released 2026-07-21. Reference implementation, conformance fixtures, and signed-record adapters published in the open.
One signed artifact. Six fields.
Every record carries the same skeleton: facts, policy, result, time, issuer, signature. The issuer asserts the first four; the last two prove who said so and let anyone check it.
What happened
The boundary action. An API call, MCP tool run, gateway decision, provisioning event, or payment-related machine action, captured as a typed signed record with its selected facts.
Under what terms
A digest of the policy or terms that applied at issue time. Verifiers can prove a record was issued under a specific version of peac.txt or another published policy document.
What returned
Status, digests, observed outcome. The record commits to what the issuer says happened, so a later review does not depend on log retention.
When it happened
Issue time and, where relevant, the observed event time. A record is datable evidence: a later review can place the action on a timeline without trusting anyone's clock retroactively.
Who issued it
The system that observed the action and signed the record, identified by its issuer URL. Keys resolve from the issuer's published configuration, so identity is checkable, not asserted.
Who asserted it
Ed25519 signature over the canonical JWS signing input. Verification is offline with a public key you supply.
One primitive, many record workflows.
PEAC composes with the systems your stack already uses. Each profile maps an existing surface to a portable signed record without replacing the runtime that produced it.
What a verified record does and does not establish.
Verification checks the record's structure, signature, issuer information, and bound digests against the supplied verification material.
Verification does not independently prove that every relevant real-world event was captured, that the issuer's statements were truthful, or that an underlying system correctly enforced its policy.
Self-host the protocol or use it with Originary.
Anyone can self-host PEAC Protocol, issue records, and verify them without an Originary account or managed service. Originary publishes and maintains PEAC Protocol and also offers commercial tools and implementation support for teams running it in production.
Apache-2.0
- Full protocol specification
- Reference TypeScript implementation
- CLI for issuance and verification
- MCP server for tool-call records
- No Originary account or managed service required
Originary Verify
- Supported self-hosted issuance and verification
- Bring-your-own-key signing (local or your KMS)
- Audit bundle export
- Implementation and rollout support
- Procurement-ready record artifacts
Two lines to a verifier.
Install the public packages from the npm latest dist-tag and verify a signed record locally.
npx -y @peac/cli@0.16.3 verify ./record.jws --public-key ./jwks.json
Or install the libraries: @peac/protocol @peac/crypto @peac/schema @peac/mcp-server