The sm-* libraries (sm = Stellarminds) are small, dependency-light
reference implementations, one per primitive. The Verifiable Agent Feed is one of them. It owns
the feed format and its verification, and nothing on either side.
The primitive
The Verifiable Agent Feed
Build, sign and chain entries; emit a signed head; serve a page on pull or push; verify one as a subscriber. Compaction via state checkpoints, and equivocation proofs from two conflicting heads. A language-agnostic conformance corpus, positive and negative, is what a second implementation replays to demonstrate interoperability.
One runtime dependency; the core is a few hundred executable statements. A format whose reference implementation can be read in an afternoon is one a second implementer can reimplement.
Reuse
Ed25519 · RFC 8785 (JCS) · did:key
Signing, canonicalisation and DID-based identity are the Agency Receipt Protocol's, so a receipt and a feed entry cannot diverge on how bytes are canonicalised or how a key becomes an identifier. See Agency Receipts.
Boundaries
The publisher's own state
Whatever the agent or service publishes about: its capabilities, its registry, its lifecycle. The feed layer receives a JSON object with a type and does not learn what it means. What to publish, and whether it is accurate, sits upstream of this primitive.
Transport, storage, subscription state
How a page moves, how the log is persisted, who is subscribed and what happens on a failed delivery belong to the consumer's stack. The reference implementation holds entries in memory so persistence is a choice: back it with an existing store and reuse the same page and verification on either side.
Discovery
Locating the feed endpoint for a given agent DID is a resolver's function and a registry's. Verification begins once the subscriber knows whose feed it is reading.
Consumers. A registry can project its incremental delta endpoint as a feed, so a puller asking what changed since cursor N can establish that it received every change. This is the registry change-log profile in deployment, running alongside an existing unsigned endpoint.