Quickstart

Service and evidence profile: 1.2.0-draft.2. Policy core: 1.2.0-draft.1.

This is a runnable, local HTTPS implementation of a provider-independent free exchange: discover a policy, accept exact terms, receive a signed agreement receipt, obtain a scoped access token, retrieve a protected asset, record delivery, submit usage claims, export evidence and revoke future access.

It uses Python, SQLite and a separately authored Node.js client. No Ortello, foundation account, payment provider, blockchain, central registry or Google account is required. The current listener is deliberately limited to local development on 127.0.0.1. It is not a public production server or a stable protocol release.

Run the complete example

Requirements: Python 3.12 or newer, the Python cryptography dependency, and Node.js 24. Download and extract the reference package, then run the commands from its odexa-reference directory. The recorded validation used Python 3.12.14, cryptography 50.0.1 and Node.js 24.19.0.

python3 -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python -m odexa_ref.demo --outdir ./run

Dependency installation may use the network. The demonstration itself generates a private temporary fixture, starts a loopback HTTPS server and runs the independent client against that origin. The client explicitly trusts the generated test CA; certificate verification is enabled. Nothing is installed into the operating system trust store. On completion, the server stops and temporary credentials are removed.

The run directory contains the test report, public verification material, signed exported records and a transport report. A nonzero exit status means a client check or gateway evidence write failed. The fixture contains synthetic text and synthetic terms; its signed storage-use declaration is deliberately false to test that authentication is not mistaken for proof of use.

Verify the exported evidence again after the server has stopped:

node clients/independent_client.mjs \
  --verify-export ./run/export-evidence.json \
  --trust ./run/independent-trust.json \
  --outdir ./offline-check

The trust file contains public pins supplied separately to the client and discovery material retained during the run. An arbitrary export cannot authenticate itself by including its own keys. This fixture demonstrates the verification mechanism; it is not external proof of a real organisation’s identity or a trusted timestamp.

Keep a local service running

python -m odexa_ref.server init --directory ./runtime --port 8443
python -m odexa_ref.server serve --directory ./runtime

In another terminal, from the same directory:

node clients/independent_client.mjs \
  --base-url https://127.0.0.1:8443 \
  --config ./runtime/client.json \
  --outdir ./run

The client configuration deliberately includes two test agents and an administrator so the integration suite can test isolation and revocation. It is a test harness, not a configuration to distribute to real agents. Keep runtime private: it contains private keys, client secrets, bearer-token hashes and the database. Do not publish or commit it.

Stop the service with Ctrl-C. Restarting with the same runtime preserves agreements and evidence. The generated policy expires after about 24 hours; the local certificates expire after two days. Use a new empty directory to create another disposable fixture. Initialization refuses to overwrite existing state. Changing persisted policy, key or service configuration requires a future explicit migration mechanism.

What to read

Document	Purpose
Wire profile	Implemented endpoints, trust, agreement state, protected delivery and export
Policy core	Native vocabulary, URL scope, evaluation and obligations; policy schema
Evidence and measurement	What the records prove, how delivery differs from use, and counting rules
Implementation status	Supported scope, limits and outstanding release work
Validation report	Executed checks and their practical limits
Schema guide	Machine contracts and semantic checks

The examples directory contains four static policy examples. odexa_ref/policy.py also works without the service or cryptography package; see its command-line help. Static publication conveys machine-readable terms. Protected delivery additionally requires a gateway such as the one implemented here.

Run the checks

python -m unittest discover -s tests
node --test verification/test_independent_client.mjs
python schema/verify.py --ajv /path/to/node_modules
python -m odexa_ref.demo --outdir ./run

The schema check needs AJV 8 and ajv-formats in the supplied directory. Pass --node /path/to/node to the demo or schema runner if Node is not on PATH. JSON Schema checks structure; the service also checks signatures, authority, exact bytes, time, identity, scope and database state.

This is an internal AI-assisted engineering deliverable, reviewed from CTO, data-engineering, research and product perspectives. It has not received an external security audit, legal review or independent vendor certification. Documentation prose is published under CC BY 4.0 and implementation material under Apache-2.0; see licensing for scope, attribution and full texts. Release stewardship and contribution procedures remain in development. Third-party dependency licences are unchanged.