Repository navigation

feat(dotnet-agent-identity): add the authority library - #2125

Merged

Benoît Cortier (CBenoit) merged 93 commits into

masterfrom

cbenoit-agent-identity-authority-library

Oct 26, 2026

Merged

feat(dotnet-agent-identity): add the authority library#2125
Benoît Cortier (CBenoit) merged 93 commits into
masterfrom
cbenoit-agent-identity-authority-library

Commits on Oct 26, 2026
- docs(dotnet-agent-identity): add the authority library intent
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1cf8643
- build(dotnet-agent-identity): scaffold the authority library
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  49ac927
- feat(dotnet-agent-identity): add strict base64 codecs
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  11119ff
- feat(dotnet-agent-identity): add the protocol error model
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  fd67d75
- ci(dotnet-agent-identity): test and publish the authority library
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  82c7bff
- build(dotnet-agent-identity): keep NuGet advisories as warnings
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f97f80c
- feat(dotnet-agent-identity): add the certificate registry and nonce store
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  385b89e
- feat(dotnet-agent-identity): authenticate signed agent requests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  82219c1
- feat(dotnet-agent-identity): validate agent metadata
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  26b5459
- feat(dotnet-agent-identity): validate certificate signing requests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b146c24
- feat(dotnet-agent-identity): parse enroll, renew and check-in bodies
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  be73911
- feat(dotnet-agent-identity): issue identity certificates
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c46d178
- feat(dotnet-agent-identity): create enrollment tokens
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6f4376e
- feat(dotnet-agent-identity): read the enroll bearer token
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f244737
- feat(dotnet-agent-identity): decide enrollments by token and key
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3789a7a
- feat(dotnet-agent-identity): evaluate friendly-name formats
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  eaeabf6
- fix(dotnet-agent-identity): start certificate statuses at 1
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  474a957
- fix(dotnet-agent-identity): keep format text out of logs
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5273548
- test(dotnet-agent-identity): refuse the default certificate status
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8638587
- fix(dotnet-agent-identity): name identities from validated metadata
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1bbe991
- docs(dotnet-agent-identity): qualify the format text guarantee
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  fa13c07
- test(dotnet-agent-identity): accept an empty extensionRequest
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c78c61c
- feat(dotnet-agent-identity): verify the agent channel handshake
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6b36803
- feat(dotnet-agent-identity): enforce handshake deadlines
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6409683
- feat(dotnet-agent-identity): re-check the registry in the handshake
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  91e234e
- test(dotnet-agent-identity): read the new vector file members
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d909f6d
- refactor(dotnet-agent-identity): share the base URL rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1966cd6
- feat(dotnet-agent-identity): add the identity config
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  52c6ca3
- docs(dotnet-agent-identity): clarify two error outcomes
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8f8e0b7
- feat(dotnet-agent-identity): write the response bodies
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  88ee3e6
- feat(dotnet-agent-identity): build the channel push messages
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  76f8a7d
- feat(dotnet-agent-identity): issue renewals for the proved identity
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9ac06ef
- feat(dotnet-agent-identity): decide renewals by the CSR key
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e1e3354
- refactor(dotnet-agent-identity): simplify the body writer checks
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  54743ee
- test(dotnet-agent-identity): pin the copies of configs and chains
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2ab5936
- test(dotnet-agent-identity): verify test handshakes asynchronously
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9895c30
- fix(dotnet-agent-identity): apply the JSON rules inside config values
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  518d37e
- docs(dotnet-agent-identity): add the package README
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c01363b
- build(dotnet-agent-identity): pack the README
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b7612f8
- docs(dotnet-agent-identity): cover responses, renewals and pushes
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  362fb7d
- docs(dotnet-agent-identity): reconcile every authenticated stream
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3ed4614
- docs(dotnet-agent-identity): link the contract by absolute URL
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9550ada
- feat(dotnet-agent-identity): apply stream closures to the Hello timeout
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  aff64b8
- docs(dotnet-agent-identity): document the async Hello timeout
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0627e52
- refactor(dotnet-agent-identity): group the sources by contract area
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  503d4a0
- test(dotnet-agent-identity): consolidate tests that check one rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  942049c
- test(dotnet-agent-identity): strengthen tests and cover untested rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  45eb76d
- test(dotnet-agent-identity): delete self-derived assertions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cfb17f2
- test(dotnet-agent-identity): accept CSR attributes out of DER order
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  747b239
- test(dotnet-agent-identity): delete unspecified single-read checks
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  95af4da
- test(dotnet-agent-identity): select the registry fixture by case data
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  22820b1
- docs(dotnet-agent-identity): cite the contract by its new name
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  12aec06
- docs(dotnet-agent-identity): give the intent a citable section
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  03686c3
- docs(dotnet-agent-identity): state the failure-detail and token rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0a8965c
- test(dotnet-agent-identity): mark the source of every test
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a3bec94
- test(dotnet-agent-identity): drop assertions that no source decides
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ca9fddf
- feat(dotnet-agent-identity): reject a non-empty confirm body
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d51eba0
- fix(dotnet-agent-identity): keep metadata keys out of failure details
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2132373
- test(dotnet-agent-identity): narrow assertions to what their sources decide
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  4a42ad1
- feat(dotnet-agent-identity): end the handshake on an undecodable first message
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f9c5b7b
- feat(dotnet-agent-identity): keep every config within one channel envelope
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  23057af
- test(dotnet-agent-identity): mark the theories whose rows carry the markers
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  24021f7
- test(dotnet-agent-identity): pin the channel URL slash rule and revocation over expiry
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f80dbb0
- test(dotnet-agent-identity): cite contract sections by their anchors
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d54ddea
- docs(dotnet-agent-identity): link contract sections by their anchors
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d766d85
- fix(dotnet-agent-identity): accept any encoding of the CSR subject
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  4392418
- test(dotnet-agent-identity): build the specified-curve key by hand
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8ae6f69
- feat(dotnet-agent-identity)!: issue a new identity's certificate only from its enrollment decision
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cf46488
- docs(dotnet-agent-identity): guide hosts on handshake races, last_seen_at and load
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5657a80
- test(dotnet-agent-identity): pin the handshake's registry read inside the call
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ce4d20a
- refactor(dotnet-agent-identity): share one base among the result types
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  537b31b
- test(dotnet-agent-identity): reuse the shared clock and generator doubles
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  789d086
- test(dotnet-agent-identity): merge the CSR rejection tests into one theory
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5b8bbd5
- test(dotnet-agent-identity): share the table of unacceptable base URLs
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  22b8b57
- test(dotnet-agent-identity): merge the handshake failure tests into theories
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9423204
- test(dotnet-agent-identity): share the channel opening setup
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  28fe38f
- test(dotnet-agent-identity): remove unused vector theory data
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  fa63390
- test(dotnet-agent-identity): tighten the shared test setup
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  221041f
- fix(dotnet-agent-identity)!: hash the bytes an enrollment secret encodes
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  5d70eb1
- test(dotnet-agent-identity): pin the refusal of a token URL password
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  4c57ab4
- fix(dotnet-agent-identity)!: call an enrollment token revoked, not deleted
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  21df0f0
- fix(dotnet-agent-identity): refuse any @ in a token or channel URL
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  8fb95b7
- docs(dotnet-agent-identity): mark the untested UTC reading of validity
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  a400c56
- fix(dotnet-agent-identity): refuse a token URL that is not ASCII
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  3148d35
- fix(dotnet-agent-identity)!: issue only under a root of the chain profile
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  f63a6ff
- feat(dotnet-agent-identity): add the token_url_mismatch error code
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  b0434a2
- feat(dotnet-agent-identity): read the enrollment URL a CSR requests
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  6877876
- feat(dotnet-agent-identity)!: refuse an enrollment at another URL
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  b8d76bf
- feat(dotnet-agent-identity)!: name the enrollment URL in every certificate
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  6f35c21
- fix(dotnet-agent-identity): tighten the enrollment URL and issuer checks
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  71072e8
- docs(dotnet-agent-identity): say where the enrollment URL OID sits
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  b293e68
- test(dotnet-agent-identity): pin each CSR vector's outcome per endpoint
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  796ccbd
- docs(dotnet-agent-identity): say that a token's URL may differ from the entry
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  83e18b7

Commits

Commits on Oct 26, 2026