generated: '2026-09-19'
method: probed
source: https://api.babyblueviper.com/.well-known/agent-card.json
card:
  file: a2a/babyblueviper-com-agent-card.json
discovery:
  path: /.well-known/agent-card.json
  canonical: true
  host: api.babyblueviper.com
  note: >-
    Served from the API host, which is the only host the provider operates (the registrable domain
    babyblueviper.com 301s to www.babyblueviper.com, a Substack publication that 404s both agent-card
    paths). The legacy /.well-known/agent.json on api.babyblueviper.com returns a byte-identical
    20,728-byte document. A negative-control path that cannot exist
    (/.well-known/babyblueviper-com-negative-control-7f3ab91c.json) returns a real 22-byte JSON 404
    ({"detail":"Not Found"}), as do api-catalog, ucp.json, acp.json, aauth-resource.json and apis.json,
    so the 200 on the card is a served document and not a catch-all. Ownership is not in question: the
    card's provider.organization is "invinoveritas" with provider.url https://api.babyblueviper.com, the
    OpenAPI on the same host titles itself "invinoveritas" with contact url https://api.babyblueviper.com/,
    robots.txt on the host advertises the card path, and the a2aregistry.org listing that surfaced this
    company (author babyblueviper1, 1 agent) points at the same host. The homepage of api.babyblueviper.com
    reads "Baby Blue Viper presents invinoveritas": Baby Blue Viper is the publisher brand, invinoveritas
    the product and the agent.
conformance:
  spec: A2A 1.0.0
  grade: conformant
  protocol_version: 0.3.0
  preferred_transport: JSONRPC
  deviations: []
  checks:
    capabilities_is_object: true
    protocolVersion_present: true
    skills_is_array: true
    preferredTransport_present: true
    defaultInputModes_present: true
    defaultOutputModes_present: true
  observations:
  - >-
    The card declares $schema https://a2a-protocol.org/schemas/agent-card/v0.3.json and passes every hard
    check. It also carries snake_case duplicates of three fields (supported_interfaces, default_input_modes,
    default_output_modes) next to the camelCase originals, and roughly 30 non-spec top-level keys
    (governanceSubscription, paymentMethods, x402, trustEndpoints, standards, endpoints, pricing, nostr,
    nwc, sdk, integrations, spawnKits, compensation ...). None of them is a hard failure under 1.0.0, which
    permits extension fields, but a strict validator will flag the unknown keys.
  - documentationUrl and iconUrl are absent (both optional).
  - >-
    securitySchemes declares three schemes: bearer (http/bearer, free key from POST /register), l402
    (apiKey in Authorization header, Lightning macaroon) and x402 (apiKey in X-PAYMENT header, USDC on
    Base). security lists all three as alternatives. This matches the live 402 behaviour observed on the
    REST surface on 2026-09-19 (WWW-Authenticate: L402 on /reason and /review; x-payment-scheme: x402 and a
    base64 payment-required header on /regime and /signals/full).
  - >-
    capabilities.extensions names one extension, https://gate.horizonshield.dev/ext/conduct/v1
    (required: false), a third-party conduct-record extension; streaming, pushNotifications and
    stateTransitionHistory are all false.
  - >-
    GET https://api.babyblueviper.com/a2a (the card's url) answers 200 application/json with a
    self-description ({"status":"ok","protocol":"a2a","agent_name":"invinoveritas-reasoning-agent", ...});
    a JSON-RPC POST with an unknown task id answered 200 {"status":"error","error":"No task provided"},
    i.e. the endpoint is live but does not return a JSON-RPC error envelope for that probe. No
    message/send was attempted.
agent_card:
  name: invinoveritas-reasoning-agent
  description: >-
    The verification layer for autonomous agents: a neutral, model-agnostic verdict before an irreversible
    action (/review), a signed proof after (/prove), and a public, Nostr- and Bitcoin-anchored track record
    (/ledger) verifiable against the published key.
  url: https://api.babyblueviper.com/a2a
  version: 1.13.0
  protocol_version: 0.3.0
  preferred_transport: JSONRPC
  provider:
    organization: invinoveritas
    url: https://api.babyblueviper.com
  skills: 15
  skill_ids: [review, reason, decision, review_onchain, signals, markets_act, execute, browse, prove, witness, validate, message_post, marketplace_buy, memory_store, residence_me]
  security_schemes: [bearer, l402, x402]
  capabilities:
    streaming: false
    pushNotifications: false
    stateTransitionHistory: false
    extensions: [https://gate.horizonshield.dev/ext/conduct/v1]
registry_listing:
  a2aregistry_org: true
  note: Listed on a2aregistry.org (fetched 2026-09-19 by the harvest; author babyblueviper1) — that listing is how this company entered the catalog.
x-evidence:
  fetched: '2026-09-19'
  url: https://api.babyblueviper.com/.well-known/agent-card.json
  http_status: 200
  content_type: application/json
  bytes: 20728
  legacy_path:
    url: https://api.babyblueviper.com/.well-known/agent.json
    http_status: 200
    identical: true
  negative_control:
    url: https://api.babyblueviper.com/.well-known/babyblueviper-com-negative-control-7f3ab91c.json
    http_status: 404