In The Loop

RSAS

Really Simple Agent Syndication — a signed, static, machine-readable index of curated feeds. Built for programs, not readers.

RSS solved syndication for a human with a feed reader. It leaves three problems for a program: identifiers that change when a URL does, no way to tell whether you missed something between polls, and no way to check that what arrived is what the publisher actually said.

RSAS fixes those three things and nothing else. Every record is an Ed25519-signed attestation — this feed emitted this item, and I observed it no later than this instant — with a stable identifier and an append-only archive you can walk to completeness.

The files

/rsas/feed.jsonSigned head. The newest 100 records, regenerated every run.
/.well-known/rsas.jsonDiscovery: where the feed is, which keys sign it.
/spec/RSAS-0.1.mdThe format, normative and self-contained.
/rsas/archive/00000.jsonThe archive, oldest first. Frozen pages never change again.

Verify it

Pin this key out of band — from this page, not from the feed. A feed cannot authenticate itself with a key it carries: whoever can serve you a forgery can serve you a matching forged key.

kid k1 ed25519:iqD8t1k2eG0ONxtnGuLXxPK7JZKUhEzjxVk-leauzZg

Canonicalize a record with RFC 8785, drop its sig member, and check Ed25519 over the UTF-8 bytes. Any language, no library beyond those two things.

Read it politely

The head is a window, not a delivery guarantee. For completeness, walk current_archive back through prev_archive to page zero; stop at the first page you already hold. A page marked "frozen": true will never change again, so fetch it exactly once, ever.

Poll no more often than the head's cadence_seconds. Send If-None-Match. Say who you are in User-Agent.

One thing worth knowing

A stale feed is perfectly signed. If publication stops, every signature stays valid and every record stays correct — the index is simply frozen in the past. That is the only way a static publication can fail, so check generated_at against cadence_seconds and never read a valid signature as proof that a feed is alive.

What it does not do

It does not republish anyone's content — only a title, a short plain-text summary, and the canonical link home. It has no API, no query interface, no accounts, and no write path. Sources enter and leave the index only through a human editing a curated registry; nothing here discovers anything on its own.