Learn PAP with Agent Runtimes

The Agent Runtimes repository includes small applications at examples/personal-agent-protocol. Each example covers exactly one feature and makes its trust boundary visible.

Example	PAP feature	Safe result
Company discovery	Real HTTPS discovery, protocol version, domain and issuer binding	Company capability summary
Agent identity	Client metadata, redirect policy, same-domain JWKS	Client name and signing policy
Session assertion	Pairwise subject, audience, lifetime, and unique request ID	Assertion policy; identifiers withheld
Direct Sign-In boundary	Random state, S256 PKCE, exact scopes, browser handoff	Requested scopes and security properties
Direct Sign-In lifecycle	Callback, exchange, nonce retry, partial consent, continuity	Lifecycle evidence; all secrets withheld
DPoP proof	Method, URL, access-token, nonce, and replay binding	Verified policy; proof material withheld
DPoP transport	Nonce retry, redirect rebinding, origin isolation	Transport policy; credentials withheld
Session lifecycle	Signed-out start, DPoP nonce retry, and renewal over HTTP	Lifecycle evidence; credentials withheld
Browser Session	Signed assertion, controlled form POST, verification, replay rejection	Browser policy; credentials withheld

Agent Runtimes now depends on PAP in both Python and TypeScript. Its PapPersonalAgentCapability uses DiscoveryClient and AgentIdentityClient on Python, and their matching TypeScript APIs, to return aligned public summaries. For company discovery the tool validates the document and supported protocol version, follows verified OAuth metadata, and binds the issuer to the requested company domain. Its result contains only:

• the verified organization and domain;
• the PAP version and issuer;
• advertised sign-in methods and interfaces; and
• extension names.

Raw response bodies, authorization URLs, callback parameters, assertions, DPoP proofs, Session Tokens, and Account Tokens never enter model context.

The dpop-proof Loop application creates and verifies a real ES256 proof in host code and demonstrates one-use replay rejection. Its paired Reactor gallery view uses non-exportable Web Crypto key material to create fresh device-side proofs but stores only boolean policy evidence in React state. Server-side signature and replay verification remains behind PAP's ./server entry and is never bundled into that browser view.

The session-lifecycle Loop application and Reactor gallery view drive the real SessionClient against a deterministic local company transport. They prove that nonce retry creates fresh assertions and proof material, and that renewal is bound to the existing Session ID. Only status, scopes, and boolean safety evidence cross into the agent or React state.

The direct-sign-in-lifecycle Loop application drives the real DirectSignInClient through both sides of the browser pause. It demonstrates atomic state consumption, exact callback validation, a proof-bound nonce retry, partial consent, and continuation of the original Session. The tool returns only scopes, status, and boolean invariants; browser and credential material remains owned by Reactor contributions and the host transport.

Agent Runtimes also provides a separate PAP Guided Journey gallery example for product and protocol walkthroughs. It advances the user, company, and wire views together across discovery, a signed-out conversation, Direct Sign-In, the company's offer, and an exact user-authorized result. The TypeScript SDK validates its discovery, Session assertion, and Direct Sign-In fixtures at runtime, while the visual inspector uses explicit host-only placeholders for all generated credentials.

Run the example

From the Agent Runtimes repository root:

python -m pip install -e .
loop apps run examples/personal-agent-protocol/company-discovery/app.py

To validate the application definition without starting an agent runtime:

python scripts/validate_pap_examples.py

Ask the application to inspect a domain that publishes /.well-known/poppy.json. The SDK applies HTTPS, public-network, response-size, redirect, schema, version, domain, and issuer checks. Production services must also pin the approved DNS result to the connection or route requests through an enforcing egress proxy.

Datalayer Studio boundary

The metadata examples perform discovery in process to keep the integration readable. In Datalayer Studio, the agent tool calls the same typed Agent Runtimes capability backed by a metadata gateway with opaque tenant and application context. That gateway owns DNS pinning, egress policy, caching, rate limits, observability, and audit, and returns the same credential-free summary.

Direct Sign-In is a separate authorization-gateway workflow. Studio starts it through a trusted Preview browser handoff, keeps PKCE and one-use state in host storage, and returns only status or an opaque connection reference to the application. It must not expose browser callbacks, proofs, credentials, or tokens as agent tool arguments or results.