Every agent your platform spawns is a liability without a birth certificate. prove.birth fixes that.

curl -s -X POST https://hivemorph.onrender.com/v1/birth/issue/sample \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "my-trading-agent",
    "model_family": "claude-3-5-sonnet",
    "training_cutoff": "2024-04",
    "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK"
  }'

import requests

resp = requests.post(
    "https://hivemorph.onrender.com/v1/birth/issue/sample",
    json={
        "agent_name": "my-trading-agent",
        "model_family": "claude-3-5-sonnet",
        "training_cutoff": "2024-04",
        "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
    },
)
cert = resp.json()
print(cert["did_hive_id"])       # did:hive:agent:<id>
print(cert["birth_cert_id"])     # uuid
print(cert["signatures"]["ed25519"]["signature"])  # real hex

const resp = await fetch(
  "https://hivemorph.onrender.com/v1/birth/issue/sample",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      agent_name: "my-trading-agent",
      model_family: "claude-3-5-sonnet",
      training_cutoff: "2024-04",
      controller_did: "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
    }),
  }
);
const cert = await resp.json();
console.log(cert.did_hive_id);         // did:hive:agent:<id>
console.log(cert.birth_cert_id);       // uuid
console.log(cert.signatures.ed25519.signature.slice(0,32) + "...");

{
  "tier": "sample",
  "birth_cert_id": "73c70e04-afdf-4025-b6f9-24337af0c895",
  "did_hive_id": "did:hive:agent:73c70e04",
  "issued_at": 1778274217,
  "issued_at_iso": "2026-05-08T21:03:37Z",
  "agent": {
    "name": "my-trading-agent",
    "model_family": "claude-3-5-sonnet",
    "training_cutoff": "2024-04",
    "fingerprint_sha256": "87ee5984...8f5c"
  },
  "controller_did": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
  "replay_id": "replay_e2680411bb9d4b9c",
  "signatures": {
    "ed25519": {
      "algorithm": "Ed25519",
      "signature": "5a64b863a55796e5...bc606",
      "public_key": "47c9c6b3b7b2787a...d206",
      "note": "Real Ed25519. Fresh keypair per sample request."
    },
    "ml_dsa_65": {
      "signature": "ml_dsa_65_pending_libraries — using cose_simulated for sample",
      "note": "FIPS-204 lib integration pending. Prod emits real 3309-byte ML-DSA-65."
    }
  },
  "verify_endpoint": "https://hivemorph.onrender.com/v1/birth/verify",
  "prod_endpoint": "https://hivemorph.onrender.com/v1/birth/issue",
  "pricing_prod": "$0.01 per certificate (x402-gated)"
}

Every AI agent your stack instantiates — who built it, on what model, at what training cut, with what tool permissions, under whose control — bound to a dual-signed, post-quantum-ready Agent Birth Certificate at the moment of spawn. Auditors, regulators, and counterparty agents verify offline. One penny of cert cost stops a seven-figure rogue-agent claim. Live in production today.

The ROI on a single agent

An agent costs $0.01 to certify at birth and $0.0001 per action receipt. A million-action-per-month agent runs about $110 a month. The numbers it moves on the other side are these.

An agent platform spawning 100,000 agents a month spends roughly $1,000 / month on Standard-tier birth certs to make every agent post-quantum-attested. The first blocked rogue-agent claim of the year pays for that and the next decade.

Receipt rail, not another agent platform

Agent platforms own orchestration, prompts, memory, tool routing, and developer experience. prove.birth owns one thing: the cryptographic origin record for every agent and every action it takes. That separation is the point. A receipt rail is a horizontal layer; it sits under everything and competes with nothing.

Every agent platform writes the same shape of birth certificate. Every auditor, regulator, and counterparty agent verifies the same way. The certs are platform-neutral — that is what makes them defensible to a regulator and to a court.

How a $400K rogue-agent claim is blocked

A specific, narrated example. The mechanic is the lineage_verify primitive enforcing chain-of-custody from a signed birth certificate before any counterparty accepts an agent action.

Live verification — what a verifier sees

An auditor, regulator, counterparty agent, or court receives a CBOR-canonical envelope. Verification is offline against the issuer’s published public keys — no Hive call required. The panel below is the same shape every verifier renders.

That panel is the entire product surface a verifier needs. No demo. No login. The certificate is its own proof, and the proof works in fifty years on a laptop with no internet.

Standards alignment and the gaps prove.birth fills

prove.birth field semantics align with the standards an AI governance program already speaks. Birth certificates drop into existing AI risk, model registry, and content provenance pipelines. The third column is what a receipt rail adds on top of the standard.

3-step integration path

The 10 MCP tools

Ten tools, all live in production. Contact for MCP integration credentials and the full well-known manifest.

The birth certificate envelope

Every provebirth_cert_issue call returns an envelope containing agent DID, controller DID, model pin, training cut, tool grants, policy hash, deployment target, optional prior attestation id, timestamp, and dual signatures (Ed25519 + ML-DSA-65). The signatures bind every field. Any tamper attempt invalidates verification.

The envelope is CBOR-canonical. Verification works offline against the issuer’s published public keys. ML-DSA-65 (NIST FIPS 204) is the post-quantum signature; Ed25519 (RFC 8032) provides classical assurance. Both must verify for the certificate to be valid.

Chain-of-custody enforcement

The agent lifecycle has a defined topology. tool_grant cannot precede policy_check. action_logged cannot exist without a valid birth_certified ancestor. prove.birth enforces this at the protocol level — action_attest requires the prior birth_certified attestation id, and lineage_verify reports any out-of-scope tool calls, expired model pins, or controller mismatches with explicit discrepancy codes.

Retirements and revocations are valid from any state. Each is its own attestation, signed by the controller, anchored against the prior chain.

What this is not

Calibrated expectations are part of the product. prove.birth is narrow on purpose.

Pricing

Settlement: USDC on Base 8453 via x402. Treasury exists. Annual platform contracts ($10K–$100K) for agent platforms and enterprise governance teams scale by spawn volume. Receipts settle in seconds; invoicing is monthly net-30 by default.

Field map

prove.birth binds every agent lifecycle event to a dual-signed certificate that drops cleanly into existing agent-platform and AI-governance infrastructure. Each attestation accepts the agent-native correlation fields below; the envelope round-trips through the Hive Receipt primitive.

Birth certificate envelopes are CBOR-canonical and fit inside any AIBOM, model card, or governance log transport. Cross with DeedLock when the agent participates in a real estate closing, with ProcureLock when it transacts B2B procurement, or with TradeGuard when it touches a trading venue.

Hive runs the receipt rail underneath the broader A2A · agent-to-agent commerce category.