CHAP: the protocol that logs the human, not the agent

The Collaborative Human-Agent Protocol (CHAP) is an open spec for recording what a human did to an AI agent's output, and it landed on Hacker News this week to almost no attention. Ten points, one comment. I think that undersells it.

I read the whole repo. The idea is small enough to explain in a sentence and it fixes something I actually have wrong in my own stack.

Source: BrightbeamAI/chap on GitHub, released by Brightbeam AI under CC-BY 4.0 for the spec and Apache 2.0 for the code.

---

🔍 The gap MCP and A2A left open

We now have two widely-adopted protocols for agent plumbing, and both of them log the machine side of the conversation:

Protocol	What it moves	What it records about the human
MCP	Agent → tools	Nothing
A2A	Agent → other agents	Nothing
CHAP	Agent ↔ human decisions	The diff, the reason, the tag

The README's framing is the part that stuck with me: "When a bot drafts something and a human edits it, where does that edit live?"

In my case it lives in a git commit -m "fix", a WhatsApp message, and my memory. Three months later, if a client asks why we approved something, I am reconstructing it from vibes.

Key takeaway: Every team running agents already generates supervision data every single day. Almost nobody stores it in a shape they can query later. That is the entire bet CHAP is making.

---

🧩 The override envelope is the whole product

Strip away the eleven optional profiles and CHAP Core is seven methods and one envelope. The envelope that matters is decide.override:

Field	What it holds	Why it's there
task_id	Link to the decision chain	Ties the edit to what the agent produced
diff	RFC 6902 JSON Patch	The what, machine-readable
rationale	Structured text	The why, which logs never capture
tags	Your controlled vocabulary	The dimension you aggregate on later
intent_preserved	Boolean	Refining vs. substituting the agent's call

intent_preserved is the field I'd have skipped on a first read, and it's the cleverest one. It separates "the agent was right but wrote it badly" from "the agent was wrong." Those are different bugs with different fixes. A pile of refining overrides on one prompt means your retrieval is off. A pile of substituting overrides on the same prompt means your policy or context is wrong.

If you want to eyeball an envelope by hand while wiring this up, our JSON formatter will pretty-print the patch structure faster than squinting at a terminal.

---

📊 What actually ships in 0.2

I checked the claims against the repo rather than the pitch. Here is the honest inventory:

• Spec: Core (7 methods) plus 11 optional profiles
• Reference implementations: two, TypeScript and Python, both covering 39 method handlers
• Conformance harness: 23 test vectors, with two claimable levels (Minimal and Recommended). Full conformance is explicitly not claimable yet, pending interop testing
• Transports: JSON-RPC 2.0 native, plus MCP server and A2A server adapters
• Framework bridges: five, for LangGraph, Pydantic AI, AG2/AutoGen, LlamaIndex Workflows and Google ADK
• Worked scenarios: twelve documented, three implemented

Install is npm install @brightbeamai/chap-coordinator or pip install chap-coordinator.

⚠️ Read the status line before you plan anything around this. The repo states CHAP 0.2 is a public draft and that production deployments needing strict stability should wait for 1.0. Profile surfaces will move faster than Core.

---

💰 Why the cheap-infrastructure story matters here

Most "enterprise AI governance" tooling assumes you have a budget for a governance platform. CHAP's reference path assumes a SQLite file.

const coord = new Coordinator({
  store: new SqliteStore("./chap.db"),
});

That is an embedded coordinator writing to a local file. No cloud tier, no seat licence, no vendor. For a four-person shop in Colombo billing a client in Europe or Australia, that difference is the whole difference between "we could adopt this" and "we'll do it later."

There is a second angle that I think is specifically valuable for Sri Lankan software export teams. A lot of our work is delivered under contracts where the foreign client wants assurance that a human reviewed AI-generated output. Right now the honest answer is usually a process document and a promise. A hash-linked chain you can hand over as a single audit.read response is a different class of answer, and it costs you nothing extra because you were doing the reviews anyway.

---

🤔 Where I'd push back

Three things I'd want a team to understand before adopting.

1. The tags are your problem, not the protocol's. CHAP gives you a tags array and tells you to keep the vocabulary small. That is an organisational discipline question. A team that tags everything "wrong" gets a database of nothing.
2. The sample report is illustrative, not evidence. The README shows an override report totalling 47 overrides with false-positive at 66%. That is a demo output showing the shape of the analysis, not a published study. Don't cite it as a finding.
3. Adoption is the open question. MCP won because the model vendors shipped it. CHAP is a draft from one company with a technical report on arXiv and, as of now, single-digit points on Hacker News. Good design does not guarantee a standard. Write your integration behind a thin interface so you can rip it out.

There is also a genuine cost nobody mentions: someone on your team has to actually type the rationale. An override with an empty reason field is a row in a table. The value only exists if the humans do the small annoying part.

---

🚀 What this means for you

If you are a student or a solo builder, the thing worth stealing here is not the npm package. It is the shape. Start logging your own agent overrides in three columns: what the agent produced, what you changed it to, and why. A CSV is enough to start.

If you run a small team shipping agent features to paying clients:

• Do read core/SPEC.md before the pitch. Seven methods fits on one screen and you'll know within ten minutes whether the model matches your workflow.
• Do try the SQLite reference on a non-critical workflow. The cost of the experiment is an afternoon.
• Don't build a client deliverable on a 0.2 draft. The repo tells you not to and it is right.
• Do agree your tag vocabulary before you write any code. That decision determines whether the data is useful in six months.

The protocol may or may not become a standard. The underlying observation holds either way: the corrections your team makes to AI output are the most valuable dataset you are currently throwing away, and you are throwing it away for free.