Answer the question using only the passages.

Question: What notice is required to terminate the agreement early?

[1] Companion to the ten-record diagram and to the sample package of 11 September.
 The Internet-Draft, draft-saha-stage-receipts-00, was posted on 8 September; this page is the
 implementer's reference beside it, and will be superseded in place, carrying its prior
 digest, rather than edited quietly.
Page views on this site are counted by GoatCounter, an open-source counter that sets no cookies and stores no personal data; the tools themselves report to no one.© 2026 oneproof · Apache-2.0 across the suite · Digests shown on this site are illustrative
 worked examples from the public design fixtures, not customer data.

[2] TitleThe Agent Action Decision Protocol (AADP): Per-Action Authorization for AI Agents
StatusInternet-Draft, individual submission · −01 posted; −02 in preparation
FixtureCDX-AADP-INPUT-PROVENANCE-001 interoperability fixture (public)
Referencedatatracker.ietf.org/doc/draft-saha-aadp

House rules for claims
What this site will not do

No aspiration dressed as capability

 If a feature is planned, it is labeled planned. If a number comes from a
 worked example, it is labeled a worked example. Nothing on this site
 describes what we hope the tools will do as if they already do it.

Cryptography is opt-in, off by default

 Receipt chaining, signing, and anchoring exist as options you turn on
 deliberately — and every claim about them travels with that sentence. A default
 you didn't choose is not a guarantee you hold.

Three outcomes, honestly reported

[3] 4
Can the answer be re-derived, or only re-run?
Ask what happens when someone tries to reproduce a result a year later, after the model is deprecated and the pipeline rebuilt. Re-running is a new measurement with a new instrument; it can disagree with the original for reasons unrelated to what actually happened. Evidence is re-derivable from the sealed record; it does not depend on the live system still existing in its original form. The tell "we'd just run it again."

5
Does absence mean something definite?
Ask what a missing record proves. If a gap might mean the action never happened, or might mean logging failed, or might mean something filtered it downstream, then the presence of records proves little either. The good answer the system can say, of a given action, that its silence is itself a recorded fact. The tell "we'd have to look into why it's not there."

[4] | # | Requirement | Battery coverage |
|---|---|---|
| 1 | Merkle corpus manifest | **Testable** — manifest construction, inclusion proofs, and a tampered-member rejection vector |
| 2 | **Epoch anchoring** | **Partial, and this is the honest limit.** The battery can test that a record *declares* its anchor target, its cadence, and the unanchored state. It **cannot** test that the anchor is unrewritable — that is a property of an external witness, not of our code. **The battery measures tamper-evidence; it does not and cannot measure tamper-resistance.** |
| 3 | Tenant isolation | **Partial** — format-level separation is testable; deployment isolation is not |
| 4 | Signature envelope | **Not yet** — sequenced behind actor identity; vectors are reserved, not written |
| 5 | Dependency record | **Testable** — presence, structure, and the three-state network-access declaration |
