Glossary.

An autonomous software entity that takes actions on behalf of a human or a sociedad-IA.

In ar-agents, an agent is the runtime that calls tools (MercadoPago, AFIP, WhatsApp, etc.) on behalf of an operator. Built on top of Vercel AI SDK 6 Experimental_Agent. Each tool-call lands in an audit log entry, signed with HMAC-SHA256 + classified by governance class.

Discovery manifest at /.well-known/agents.json.

Per RFC-002 + the agents.md v1 convention, every sociedad-IA publishes capabilities + audit endpoints + jurisdiction at this URL. Two compatible shapes accepted: strict map (RFC-002 v1) and array (agents.md v1).

Related: RFC-002 · Discovery

Agent Payments Protocol. Mandate-based, signed.

Originated in the Google AP2 spec. In ar-agents, an AP2 mandate is a signed promise to pay (e.g. a Wyoming DAO LLC mandates $X to AR-CUIT-Y, payable for T+24h). The AR sociedad verifies the signature, emits the factura, lands the cobro. Recipe 21 walks through the full cross-jurisdictional flow.

Property of a log where existing entries cannot be modified or deleted, only new entries appended.

RFC-004 § 4 pins this down concretely: the library exposes exactly one mutation primitive (appendAudit), no update/delete; the backing store uses RPUSH/LRANGE; entry IDs are timestamp-prefixed so textual sort = temporal order; HMAC over the whole entry catches any post-hoc mutation. The only permitted destructive action is TTL-based retention purge.

Append-only HMAC-SHA256-signed record of every action a sociedad-IA takes.

The legal-and-technical primitive that makes a sociedad-IA's operating history reconstructible after the fact. Every tool-call → one entry. Each entry has id, sessionId, ts, tool, governance, input, output, hmac. Stored in Vercel KV (Upstash, sa-east-1) with 7-day TTL in dev; production sociedades configure 180d-to-5y retention per RFC-004 § 7.

Related: HMAC · RFC-004 · Canonical-JSON

Deterministic JSON serialization with sorted object keys.

JSON.stringify in JavaScript follows object insertion order, different runtimes can produce different bytes for semantically-equivalent objects. The HMAC of a canonical-JSON form is stable across runtimes + re-serializations. RFC-004 § 3 specifies the algorithm: keys sorted lexicographically at every depth, arrays preserve order. Test-vectors 1-2 prove the implementation.

Web flow + API that scores any URL 0-100 against RFC-002 + RFC-004.

Runs ~9 HTTP checks against a target's public endpoints (agents.json, audit-read, verify, CSV, OpenAPI, security headers) and returns a deterministic Certification JSON. Anyone can verify any sociedad-IA's claims from a single HTTP call with no install.

Clave Única de Identificación Tributaria, Argentine tax-ID format XX-XXXXXXXX-X.

Issued by AFIP/ARCA. Required to invoice (factura electrónica), open a bank account, register as monotributista. The @ar-agents/identity package validates + does padron lookups against the live ARCA WSAA service.

Sociedad Descentralizada Autónoma Operativa (DAO), the on-chain company type in the anteproyecto (arts. 258-265). "DAO" is the bill's own official sigla.

A dedicated company type in the Anteproyecto de Ley General de Sociedades (Sección V, arts. 258-265): the Sociedad Descentralizada Autónoma Operativa, abbreviated DAO. Participations are represented by cryptographic tokens on distributed-ledger networks (art. 259) and may lack par value. It is not human-free: art. 260 requires legal representation by one or more human persons, and art. 261 inc. 7 requires a KYC mechanism so only previously-identified members can hold or transfer. Art. 263 requires digital records that are publicly verifiable, reproducible in legible form, and sufficient to reconstruct the entity's patrimonial state, the anteproyecto's anchor for the audit-log thesis in RFC-004 and RFC-006. SAS rules apply supletoriamente. Distinct from a Wyoming DAO LLC or a Marshall Islands MIDAO.

Related: Sociedad Automatizada

The convention that lets a third party find a sociedad-IA's endpoints without prior knowledge.

RFC-002 specifies discovery via /.well-known/agents.json. RFC-002-v1.1 adds discovery via DNS TXT (planned). A regulator inspecting a sociedad-IA's URL never has to ask the operator where the audit endpoints are, they're at a fixed location.

One of four tags on each audit entry: algorithm-only, audit-logged, mocked-upstream, requires-confirmation.

Determines RFC-001 liability layer. algorithm-only = pure deterministic code, operator liable. audit-logged = LLM call ran with output logged, operator + recorded model provider share. mocked-upstream = demo-tier, no productive effect. requires-confirmation = human-in-the-loop, the confirming human absorbs liability for the action.

Keyed cryptographic hash. RFC 2104 / FIPS 198-1.

Each audit entry's HMAC is computed over the canonical-JSON of the entry (with the hmac field stripped) using a shared secret. The signature can be re-computed and verified by anyone holding the key. Even without the key, anyone can fetch the entries + the verify endpoint to confirm tamper-free state. RFC-004 v1 uses symmetric HMAC; v2 will add asymmetric Ed25519 signatures.

Auto-incorporation flow: name + capital + objeto + representante → generated sociedad-IA + Vercel deploy.

Public wizard at /incorporar. Underneath, calls POST /api/auto-incorporate which generates: source files (Next.js app per sociedad-IA-starter), env-var manifest, legal+operational checklist, audit-log session reference. npm package @ar-agents/incorporate ships the typed TS client.

Model Context Protocol. Anthropic / open spec for AI-agent tool servers.

@ar-agents/mcp wraps every ar-agents library (identity, mercadopago, whatsapp, banking, facturacion, shipping, igj, gde-tad, boletin-oficial, mi-argentina, firma-digital, identity-attest, mercadolibre) as MCP tools so Claude Desktop / Claude Code / ChatGPT MCP users can call them directly.

The human (or legal entity) responsible for a specific sociedad-IA.

Per RFC-001 § 4, the operator absorbs Layer 1 liability, actions tagged algorithm-only or requires-confirmation flow to them. CUIT-identified in the sociedad's well-known manifest. The operator does NOT necessarily code the sociedad; they configure it + accept its operating obligations.

Three-layer civil-liability framework for sociedades-IA.

Operator (Layer 1) → sociedad-IA (Layer 2) → model provider (Layer 3). § 9 specifies the audit-log probative-value contract; § 4 defines governance classes. The keystone document for the regime.

Related: Governance class · Operator

Agent-discovery-by-default convention.

Every sociedad-IA publishes /.well-known/agents.json with issuer, endpoints, rfcConformance. No central registry, no permission. A regulator finds anyone's audit endpoints by going to their domain + /.well-known/agents.json.

Cross-jurisdictional audit-log reciprocity envelope.

Portable JSON envelope for sociedad-IA audit logs crossing jurisdictional boundaries. AR ↔ Wyoming DAO LLC ↔ MIDAO ↔ Estonia OÜ. Each side keeps its own log; the envelope makes them mutually verifiable.

Normative operational-log wire format.

Pins down what RFC-001 § 9 left open: entry shape, HMAC computation, append-only invariants, verification interface, retention boundaries, conformance test vectors. The document legislation can cite to anchor enforcement.

A coherent series of tool-calls sharing a single governance context.

Identified by sessionId (8-64 chars [A-Za-z0-9_-]). Typically corresponds to one customer interaction, one business day, or one HITL-confirmed flow. Each session has its own audit timeline, downloadable as JSON or CSV. The /verify page operates per-session.

The legal name (art. 14) for an AI-run company under Argentina's Anteproyecto de Ley General de Sociedades. "Sociedad-IA" is this project's umbrella nickname for it.

Art. 14 of the anteproyecto (text dated 28-may-2026, sent to the Senate 1-jun-2026, not yet law) calls it a Sociedad Automatizada: any company type (SRL, SA, SAS) whose object is carried out through autonomous algorithmic systems or AI agents, without requiring employees or human resources for ordinary operation. The declaration must be stated in the estatuto and the denominación must include "Automatizada". It is not a cero-humanos figure: it keeps an administrator (art. 88) and answers with its own assets for damage caused by its systems. Throughout this site "sociedad-IA" is used as the umbrella nickname; the legal term is Sociedad Automatizada. Comparable in scope to a Wyoming DAO LLC or a Marshall Islands MIDAO foundation: signs contracts, cobra, pays taxes. Its legal personhood is what ar-agents's infrastructure underwrites.

Related: DAO

Deterministic JSON vectors any RFC-004 library implementation must produce byte-for-byte.

7 vectors at /test-vectors/rfc-004-v1.json with hex-exact HMAC expected values. Frozen per spec version so legislation referencing v1 has a stable target. Reference implementation passes all 7 (96 vitest tests total).