rch0wdhury/terms-txt: terms.txt v0.1: reference implementation and benchmark results

Reference implementation of terms.txt, a consent and compensation protocol for agentic web access. This is the version reported in "terms.txt: A Consent and Compensation Protocol for Agentic Web Access," submitted to IEEE Internet Computing.

A site publishes /.well-known/terms.txt, in the style of robots.txt, stating per path and per purpose whether machine access is allowed, charged, or denied, at what use level and price, and whether a user's delegation is required. The file is paired with an enforcement exchange at the origin: Web Bot Auth signed requests, signed intent, agent-bound delegation tokens, HTTP 402 negotiation, and origin-signed receipts in a hash-chained log.

Contents: lib.js (signature base, thumbprints, tokens, terms.txt parser), origin.js (enforcement point), operator.js (sandbox key resolver), bench.js (24 checks, microbenchmarks, load scenarios), testvector.js (Web Bot Auth draft vector E.2.1), runs.sh and aggregate.js, the ten raw result files and aggregate.json behind Table 2, and figure.py.

Reproduce: Node.js 22, no dependencies. node testvector.js, then ./runs.sh && node aggregate.js. Published numbers are from one Xeon vCPU over loopback without TLS. Yours will differ, the relative costs should not.

Limitations: local key resolver instead of TLS discovery, legacy Signature-Agent form not accepted, directory signatures unchecked, vouchers in place of a settlement rail, local rather than anchored receipt log. Grammar, delegation token, and receipt format are proposed for standardization.

License: MIT