RTTP and IQA.

The problem

Machine-to-machine communication inherits the web's trust model in exactly two places: who you are depends on a name registry you must query, and what you signed depends on an issuer you must trust. In constrained, air-gapped or adversarial environments those two dependencies are precisely the parts that are unavailable, seized or untrustworthy - so verification either fails open or fails entirely, where it matters most.

What the two specifications do

RTTP - intent addressing. A URI of the form rttp://<authority>/<action> names a claim of intent directed at an identified subject. The subject address is derived by computation from the authority, so no registry, resolver or lookup service is consulted. Agent-to-agent messages use a fixed 128-byte PulseHeader128 frame; extension space sits in bytes that were already zero, so older readers keep working. Specification: rttp.com/RFC-002/.

IQA - subject-attestation addressing. A URI of the form iqa://<subject>.<organ>.<root>[/<action>] names the attestation standing of a subject, as reported by one of three named authority organs. The organ set and the four actions are closed sets; the URI carries no proof and no credential. Specification: iqa.org/RFC-009/.

Common design rules. Malformed input is rejected, never normalised. There is no userinfo, no port, no query and no fragment, so there is no field in which to place a credential. Neither specification defines a reporting endpoint, a resolver or an account.

Status as of 21 September 2026

You can check the "not registered" claim directly: there is no rttp or iqa row in the IANA URI scheme registry.

What we are not claiming

• Not registered, not standardised, no RFC yet - both schemes are submitted and under review.
• Specifications with reference implementations, not a product; there are no commercial customers.
• No transport layer and no client library.
• Post-quantum and staking/economics mechanisms are out of scope and not implemented, and the specifications say so in writing.
• Package downloads are not presented as adoption: today they are dominated by automated infrastructure traffic.
• An iqa URI names the subject being attested, so the scheme cannot be used for anonymous reference - stated in the draft's privacy section.

About five minutes, no account, no network trust. The conformance vectors ship inside each package, so the self-test replays them offline, from the installed package, without a repository checkout. An implementation that disagrees with the vectors fails on your machine, not ours.

Every entry below is dated and carries the evidence needed to check it. Entries are listed newest first. The record is kept for milestones, not for routine site maintenance; nothing here is a projection or a plan.

1. Follow the link. Where a row names a document, a registry or a package, the link goes to the authoritative source, not to a copy on our own site.
2. Run the command. Where a row concerns DNS or the packages, there is an exact command. The DNS records can be checked from any resolver: nslookup -type=txt iqa.org, nslookup -type=txt _dmarc.iqa.org.
3. Replay the vectors. The strongest check is the one that runs on your machine: the four self-tests in section 2, which fail if an implementation disagrees with the published vectors.
4. Cross-check the mirrors. The same specification is published as plain text and as HTML (IQA text, RTTP text) and as Internet-Drafts; they are intended to be identical in substance.

ShaoBao Li - independent maintainer; the project is hosted at the GitHub organization Aicent-Stack. Email: lee@iqa.org (IQA) or lee@rttp.com (RTTP).

Corrections and negative results are welcome, including corrections to this page.