Cedulon: An Audit Layer for Agent-to-Agent Commerce — Reference Implementation and Internet-Draft Source

Reference implementation and Internet-Draft sources for the Cedulon Protocol, an audit layer for agent-to-agent commerce. Cedulon detects off-book agent spend by reconciling a payment rail's settlement extract against a signed receipt ledger: given an authenticated extract, a settlement with no matching receipt is a named audit finding. This version corresponds to repository commit f74464ded1830dc559aace3dc9f128e53f605f82 and the posted draft-dogru-cedulon-09 (Datatracker submission 168693, posted 6 September 2026; the archive text is byte-identical to spec/draft-dogru-cedulon-09.txt in this archive, SHA-256 f128e06e9bbdfea1eea7665acf935f61bf3cf5d2a06e57c811cbc312eec18c33), alongside the companion drafts (reattestation, streaming, and the decision profile through -02). -09 changes no requirement: the abstract is two paragraphs, the note that opened the Introduction is removed and its one statement moved to the Evolution section, and the adjacent-protocols section adds the two documents behind the AUDIT BoF request. The packages are published on npm as 0.10.0 with build provenance, and the MCP Registry serves the same release. Verification instructions: docs/RUN_AS_VERIFIER.md. At this commit CI runs the whole pre-release suite on Linux, macOS and Windows: 548 of 548 cases pass on each, none skipped. Four symlink cases are written to return early with a stated reason on a host that refuses symlinks; a fourth job runs the lock and I/O cases on Linux as a non-root user, 3 of 3. idnits for the -09 render: no nits found (spec/idnits-09.txt). idnits 3.1.0 in submission mode reports one error, the submissionType attribute naming the IETF stream for a document that has no stream on the Datatracker, and one warning, line processing instructions in the XML; neither affects the posting and both are addressed in the next revision.