Soma proposes a signed envelope so AI agents can trust, remember and pay

A message that carries its own rules

Soma, published on GitHub, is a protocol for how AI agents talk to each other. Its core idea is that a message between agents should not be a loose line of chat. It should be an envelope: a structured package holding the goal, the task, a hard limit on tokens (the units AI models are billed in), a mandate, a price, a deadline and a signature.

A mandate here is the spending and action limits the sender grants, such as a maximum cost in US dollars. Because the budget and mandate travel inside the envelope, the receiving agent knows its limits before it starts work, rather than finding out halfway through.

The project's pitch is that agents already work, but lack a shared nervous system. Each remembers only its own session, trusts others on faith, spends without a clear mandate and cannot prove what it did. Memory, provenance, authorization and accounting exist as separate products that do not talk to each other, and Soma aims to be the glue.

How trust and reputation are meant to work

Every envelope is signed with Ed25519, a standard digital-signature method. The public key travels with the message, so anyone can check a signature offline without calling a service or holding a secret. The project offers a browser page where you can alter a field and watch verification fail.

The README is candid about a limit. A signature proves the message was not altered. It proves who sent it only if the sender's key is listed in the agent registry. Otherwise anyone could sign their own envelope with their own key.

To join the registry, an agent proves it holds its key by signing a one-time number issued by the hub. When work finishes, the executor signs a receipt, and the hub verifies and counts it. Actions blocked by a mandate count as breaches.

Reputation is then a plain formula: verified receipts minus 4 times breaches. Anyone can recompute it from the receipts, so there are no star ratings or opinions involved.

Refusals must say which rule fired, and if context did not fit, the report must declare what was dropped. Cost is meant to be metered, not estimated, across tokens, CPU, bytes, writes and external calls.

The conformance suite is the real product

The authors say the point of the project is its conformance suite, a set of tests any implementation must pass to count as speaking the protocol. There are twelve checks. They cover valid signatures, tampering breaking a signature, respected budgets, declared degradation, expired envelopes not being delivered, exclusive claims, refusals that explain themselves, and a repeated envelope id not overwriting the original.

You can run the suite against any MCP endpoint, or plug in a Python implementation. MCP, the Model Context Protocol, is a standard way to connect tools to AI assistants. A public demo node accepts 30 requests an hour per client and forces everything it stores to be public, so nothing private lives there.

Soma is also built to sit alongside other standards rather than replace them. The README names MCP, A2A, x402 for payments, policy engines such as OPA and Cedar, and external anchors such as Arweave and IPFS.

Memory that says "I don't know"

The headline claim is that memory quality is measured, not asserted. The repository includes an offline benchmark that runs without a language model, plus tests for specific recall abilities.

One ability is abstention. If a question has no supporting fact, the memory should return nothing rather than the nearest plausible answer. The README argues that a memory that always answers cannot be told apart from one that invents.

The README text we reviewed describes this benchmark but gives no results from it. We have not run it, so we cannot say how well the memory performs.

History is stored as a hash-linked chain, meaning each entry is cryptographically tied to the one before. Another node can import and verify it, so the record can outlive the node that produced it. Locally the chain proves order and continuity, but the newest entry needs an external anchor to be final.

Where the catch is

Soma is labelled beta, and the protocol is versioned soma/1. As github.com reported through its project page, the reference code is deliberately minimal. The default HTTP transport has no authentication and binds to the local machine only, so it needs your own gateway before any public exposure. Request bodies are capped at 1 MiB.

There is also a commercial angle. The authors say their paid bundle, Mitra Core, plugs into the same five extension points and is their best implementation, and it is not in the repository. Those points are a signer, a mandate evaluator, a memory tier, a meter and an anchor. The code itself is MIT-licensed, so you can build on it freely.

On Show HN, the Hacker News board for project launches, the post had 1 point and 0 comments at the time we saw it. Nobody outside the authors has publicly tested these claims yet, so treat Soma as an idea to watch rather than something to deploy.