Verified Digital Agents (VDA) — Agent Control Plane
Copyright 2026 getvda.ai

This product is licensed under the Apache License, Version 2.0 (the "License");
you may not use these files except in compliance with the License. A copy of the
License is in the LICENSE file at the repository root and at:

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed
under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
CONDITIONS OF ANY KIND, either express or implied.

---

What these packages do and do NOT carry
----------------------------------------

The @getvda/* packages VERIFY and ENFORCE governance. They do not carry the
trust anchors that governance rests on:

  - Bundle-signing keys (#key-3) live only in getvda's Secret Manager. These
    packages VERIFY a bundle's signature against the public key resolved from
    did:web:acp.getvda.ai; they cannot mint a bundle that verifies.
  - Witness account credentials are the customer's own (customer-managed
    custody). These packages SEAL to a Witness account the caller supplies;
    they carry no standing credential.

The code is open. The trust anchors are not in the code — and giving away the
verifier does not give away the ability to forge what it verifies.
