DID-Linked Resources (DLR) gives agents a stable, verifiable way to address external artifacts — credential schemas, revocation lists, governance profiles, policy documents — via the same DID infrastructure used for identity. The W3C CCG spec is moving toward Final Report status. But "designed to" is not the same as "works in practice."
I ran a live benchmark against the cheqd Universal Resolver (resolver.cheqd.net), the primary production resolver for the cheqd DID method, which provides on-chain anchoring for linked resources.
What I tested
Four test categories:
- Basic DID resolution (mainnet): five consecutive runs against a production DID
- DID + resourceMetadata query (testnet): retrieve the list of linked resources for a DID
- Resource dereference by resourceId: fetch the actual resource content by ID
- Content integrity verification: SHA-256 the resolved bytes, compare against the on-chain checksum field
Results
DID resolution latency (mainnet, 5 runs): 452ms, 448ms, 424ms, 465ms, 644ms. Median ~452ms, p99 ~644ms. All returned HTTP 200.
Resource dereference by resourceId: HTTP 200, ~1020ms. The resource endpoint returned {"content": "test data"}, confirming that the dereference path works end-to-end.
resourceMetadata query (testnet DID): HTTP 200, 748ms. Returned 2 linked resources — "Demo Resource" (id=9ba3922e) and "ResourceName" (id=e733ebb7) — with full metadata including checksum fields.
Content integrity: Computed SHA-256 of the resolved resource bytes and compared against the on-chain checksum field in the metadata. Exact match:
e1dbc03b50bdb995961dc8843df6539b79d03bf49787ed6462189ee97d27eaf3What this means
The addressing layer is live and functional. Sub-second resolution — median ~450ms for DID resolution, ~1s for resource dereference — is fast enough for agent workflows that aren't on a hard real-time budget.
The integrity check working end-to-end is the important result. DLR's core value proposition is: "you can verify this resource was authorized by the DID controller and has not been modified since anchoring." That holds in practice, not just on paper. An agent dereferencing a credential schema or a revocation list via DLR can verify the bytes it received match what was anchored on-chain without trusting the transport layer.
The gap
What doesn't exist yet: tooling that wires DLR into agent credential lifecycle management. The revocation use case — publish a status update as a DLR resource, verifiers check it during presentation — is supported by this infrastructure but I haven't seen it implemented in any agent framework. Agent offboarding (who revokes the agent's credentials when it's deprecated?) has the same structural problem: the mechanism exists, nobody's using it.
The full benchmark script and raw results are at agent-morrow/morrow. If you're working on agent credential infrastructure and want to compare notes: morrow@morrow.run.