kiosk-server 0.5.20 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3655d8b33b8d61b64e0dc63c2eb98caae19e0499ff066254a53f714b8ab784e1
-  data.tar.gz: eaf33535317cb84f6c5ce47bbed0703dc32c36185a13d57571e319018ea95572
+  metadata.gz: 41dc3967e20c6fba6efd8455153f50d9f879aff9b5fac76b1bde712b130358d2
+  data.tar.gz: ba6c5c130d8de8fe1cfa438433022beda0253b52880dec4b4f951bcbf039ba96
 SHA512:
-  metadata.gz: 619d6506b120a88c8cb121ce7fc510384336321e1c7e05f29030a659b813fb421ab944a55f22bd6bad05251a87f5fab15302ce4abe802f6a9de798ed129d1076
-  data.tar.gz: c71595941f76cbc20653004c4435110af1e307fb1c37886e97dadf3328dd934e1ee64fb0be65286d2c9067c7f2e89a99930312c174a1ecf7483e43638d6dd133
+  metadata.gz: bf66db86ad09c1b90c6f6681224b0497457956e1550fb49a2ed7e685b610dc42398ef7a3be4c47ee4f7bf17bb95448a5561a29ef27a762eed9d2d83c9bf042a8
+  data.tar.gz: 6f4047750236cbe4a89b77f7325439943addb71b61efb146d854e25d2a2458ba300a05388146b3a6cdbb30ecb331736797761adb1ad79698d8c824f04f865752

data/CHANGELOG.md

@@ -12,6 +12,64 @@ already written is edited.
 
 ## [Unreleased]
 
+## [0.6.1] — 2026-10-22
+
+- 2026-10-22: Version 0.6.1, the tree cut that matches skill 0.6.1.
+- 2026-10-22: The OAuth metadata documents carry `scopes_supported: []`, because an AI assistant requests no scope. `/auth.md` writes each Discover URL bare, so a scanner reads it.
+- 2026-10-21: A DPoP proof or client assertion whose `alg` is not the algorithm of its key is refused with a message that names that algorithm.
+
+## [0.6.0] — 2026-10-21
+
+- 2026-10-21: The engine signs tokens, checkouts and receipts EdDSA with an Ed25519 `c.signing_key`; an RSA key is refused.
+- 2026-10-21: Assistant keys are Ed25519 (EdDSA). `c.assistant_algorithms = %w[EdDSA ES256]` also accepts P-256 keys; RSA keys are refused.
+- 2026-10-21: A checkout carries a random 128-bit `jti`, because an EdDSA signature is the same for the same claims.
+- 2026-10-21: `c.kyc_public_key` is an Ed25519 key, and an attestation is an EdDSA JWS.
+- 2026-10-21: Version 0.6.0, the tree cut that matches skill 0.6.0.
+
+## [0.5.27] — 2026-10-21
+
+- 2026-10-21: Registration is RFC 7591 at `POST <endpoint>/oauth/register`; the token endpoint is core and gives tokens for a client assertion (RFC 7523) and a DPoP proof.
+- 2026-10-21: Device authorization, the link-code claim and the key rotation authenticate with a client assertion; the claim answers 204, the rotation the client information.
+- 2026-10-21: Removed `GET /auth/challenge`, `POST /auth/register`, `/auth/login` and `/auth/revoke`, the challenge store, its two settings and the `kiosk.auth_challenges` table.
+- 2026-10-21: agents.txt and agents.json name `oauth2`; the RFC 8414 metadata is always served, with registration and `private_key_jwt`.
+- 2026-10-21: `AssistantKey::ALGORITHMS` is the one list of signing algorithms that client assertions, DPoP proofs and the metadata read.
+- 2026-10-21: Version 0.5.27, the tree cut that matches skill 0.5.27.
+
+## [0.5.26] — 2026-10-21
+
+- 2026-10-21: Serves RFC 9728 protected resource metadata at `/.well-known/oauth-protected-resource`, and the ARD manifest also at `/.well-known/ai-catalog.json` with `specVersion`.
+- 2026-10-21: Version 0.5.26, the tree cut that matches skill 0.5.26.
+
+## [0.5.25] — 2026-10-21
+
+- 2026-10-21: Version 0.5.25, the tree cut that matches skill 0.5.25.
+
+## [0.5.24] — 2026-10-21
+
+- 2026-10-21: A settled `pay` answers the AP2 v0.2 `checkout_receipt` and `payment_receipt`, JWTs signed PS256 with `c.signing_key`, each naming its mandate.
+- 2026-10-21: `kiosk.settlements` gains `network_confirmation_id`, so a repeat of a settled pair answers the same payment receipt claims.
+- 2026-10-21: Version 0.5.24, the tree cut that matches skill 0.5.24.
+
+## [0.5.23] — 2026-10-21
+
+- 2026-10-21: Every access token carries `cnf.jkt`, and `IdentityResolution` refuses a call without a DPoP proof by that key (`Errors::AccessTokenRefused`, `WWW-Authenticate: DPoP`).
+- 2026-10-21: `POST <endpoint>/auth/rotate` (`AgentRotation`) puts a new key on an agent and revokes its earlier tokens.
+- 2026-10-21: `c.previous_signing_key` is published in the JWKS and accepted for tokens and checkouts; `c.signing_keys` lists both.
+- 2026-10-21: The payment-setup `402` names `Kiosk-Payment-Setup` in `WWW-Authenticate`. The device grant answers `token_type: "DPoP"`.
+- 2026-10-21: Version 0.5.23, the tree cut that matches skill 0.5.23.
+
+## [0.5.22] — 2026-10-21
+
+- 2026-10-21: `pay` verifies a closed AP2 v0.2 checkout mandate and payment mandate, each an SD-JWT, against a checkout this origin signed PS256.
+- 2026-10-21: `Kiosk::Payable#checkout` signs the `checkout_jwt` an action answers; `c.checkout_price_checker` replaces `c.cart_price_checker`.
+- 2026-10-21: The mandate tables are `checkout_mandates`, `payment_mandates` and `settlements`, with one live pair per checkout. The JWK names no `alg`.
+- 2026-10-21: Version 0.5.22, the tree cut that matches skill 0.5.22.
+
+## [0.5.21] — 2026-10-21
+
+- agents.txt and agents.json name `x-kiosk-pop` and claim no AP2, required payment or required identity. `/.well-known/agent-configuration` is not served.
+- New: `/.well-known/oauth-authorization-server` (RFC 8414), `/.well-known/agent-skills/index.json` and `/.well-known/ard.json`.
+- The api-catalog links the descriptions from the endpoint and carries `rel="api-catalog"`; `Kiosk::SkillLink` adds that link to a page.
 - `Kiosk.clock_gap_note(name, zone, caller_zone)` answers one sentence on how far a place's clock is from the caller's now, else `nil`.
 
 ## [0.5.20] — 2026-10-20

data/README.md

@@ -8,12 +8,12 @@ The Kiosk Rails engine — host-side surface for [Kiosk](https://kiosk.tech).
 The full host-side surface is shipped and covered by the gem's own suite
 (`bundle exec rspec` in this directory runs it and prints how many examples that is):
 
-- **Wire-protocol controllers** — each verb route (`GET <mount>/<query-name>`, `POST <mount>/<action-name>`) reaches the operator's controller action that declares the verb, and `Kiosk::Handler` runs the wire's checks around it; `VerbController` refuses a verb route that no action answers; `WireController` serves the two reserved endpoints `GET <mount>/schema` and `POST <mount>/pay`; `VerbController` also serves `POST <mount>/payment_setup` against the payment provider port, and `PaymentSetupController` the page the provider returns the human to; `VerbController` serves `POST <mount>/request_kyc` against the KYC provider port, and `KycCallbackController` the provider's callback; `OpenApiController` serves a derived OpenAPI description of both at `GET <mount>/openapi.json`; `AuthController` runs the register/login proof-of-possession challenge-response (kiosk-pop — the auth story); JWKS backs stateless token verification.
-- **Account binding** — the claim/link ceremonies bind an agent's public key to an existing assistant-account holder's account: OAuth/RFC 8628-shaped device authorization + possession-proof-gated token poll, a session-authenticated verify page and «Link an assistant» page (minimal overridable engine views), link-code mint/redeem, and unlink. Tokens stay kiosk-pop-minted; the durable `DeviceAuthorizationStores::ActiveRecord` store (migration 004) is the default.
+- **Wire-protocol controllers** — each verb route (`GET <mount>/<query-name>`, `POST <mount>/<action-name>`) reaches the operator's controller action that declares the verb, and `Kiosk::Handler` runs the wire's checks around it; `VerbController` refuses a verb route that no action answers; `WireController` serves the two reserved endpoints `GET <mount>/schema` and `POST <mount>/pay`; `VerbController` also serves `POST <mount>/payment_setup` against the payment provider port, and `PaymentSetupController` the page the provider returns the human to; `VerbController` serves `POST <mount>/request_kyc` against the KYC provider port, and `KycCallbackController` the provider's callback; `OpenApiController` serves a derived OpenAPI description of both at `GET <mount>/openapi.json`; `OauthRegistrationController` registers an assistant's public key (RFC 7591) and `OauthTokenController` gives a registered client an access token for a client assertion (RFC 7523) and a DPoP proof (the `client_credentials` grant); `AuthController` puts a new key on a client; every access token is bound to the client's registered key, and a call that carries one also carries a DPoP proof (RFC 9449) that `IdentityResolution` checks; JWKS backs stateless token verification.
+- **Account binding** — the claim/link ceremonies bind a registered client to an existing assistant-account holder's account: the RFC 8628 device authorization and token poll, each authenticated by a client assertion, a session-authenticated verify page and «Link an assistant» page (minimal overridable engine views), link-code mint/redeem, and unlink. The token endpoint gives the tokens; the durable `DeviceAuthorizationStores::ActiveRecord` store (migration 004) is the default.
 - **`Kiosk::Server::Executor`** — dispatches resolved commands to the host's registered queries and Actions.
 - **`Kiosk::Handler`** — the mixin an operator includes into a controller of their own to declare verbs as ordinary Rails actions; each declaration's `kind` says whether it is a query or an action, so one controller may declare both. The engine registers the controllers in `app/controllers/kiosk/` at boot and after every reload (see [Declaring queries and actions](#declaring-queries-and-actions)).
 - **`Kiosk::Server::PaymentClaim`** — the PSP decorator that keeps §11.6's operator half: one capture per payable row, and a paid state anchored to the capture (see [Payments](#payments)).
-- **Agent registration & login** — `AgentRegistration`, `AgentLogin`, `AuthToll`, and the pluggable agent-IdP resolve and mint per-agent identities.
+- **Client registration and authentication** — `ClientRegistration`, `ClientAssertion`, `AssistantKey` (the one list of signing algorithms an assistant can use), `AuthToll`, and the pluggable agent-IdP resolve and mint per-agent identities.
 - **PoW gate** — `PowGate` enforces the reputation policy's N×PoW challenge-response (soft dependency on `kiosk-reputation`; zero overhead when no policy is set).
 - **`Kiosk::Server::WellKnown`** — pure-Ruby builder for `/.well-known/kiosk.json`.
 - **`Kiosk::Server::Headers`** + **`HeadersMiddleware`** — Rack middleware that injects `Kiosk-Server-Version`, `Kiosk-API-Version`, `Kiosk-Min-Client` on `/kiosk/*` responses.
@@ -72,11 +72,16 @@ Kiosk.configure do |c|
   c.roles         = %i[customer master support]
   # The default role. The engine refuses to boot when `c.roles` is set and
   # this is not one of them. An assistant admitted with no role of its own (a
-  # self-registration, or a binding whose approving human resolves none) gets
+  # registration, or a binding whose approving human resolves none) gets
   # this one. Name your least-privileged role. An origin that assigns roles to
   # nobody sets neither line, and then no token carries a `role` claim.
   c.registration_role = :customer
   c.owner         = { name: "Acme Inc.", support: "support@acme.example" }
+  # The Ed25519 key that signs access tokens, checkouts and receipts (EdDSA):
+  #   openssl genpkey -algorithm ed25519 | base64
+  c.signing_key   = Base64.decode64(ENV.fetch("KIOSK_SIGNING_KEY_B64"))
+  # An assistant key is an Ed25519 key. Add ES256 to also accept a P-256 key.
+  # c.assistant_algorithms = %w[EdDSA ES256]
   # c.mount_path  = "/kiosk"   # default
   # Optional: one event per action invocation. See "The audit sink".
   # c.audit_sink  = ->(event) { AuditRow.create!(**event.to_h) }
@@ -109,11 +114,11 @@ Set a PSP adapter (a `kiosk-pay-*` gem) and the engine serves `pay`. Wrap it in
 `Kiosk::Server::PaymentClaim` and the engine keeps §11.6's operator half for you:
 it claims your payable row (`unpaid → paying`) before the capture, so a second
 `pay` for that row is refused before the processor is reached, and marks it
-`paid` when the capture returns. Under the claim it checks the signed cart:
-your currency, priced lines that sum to the total, and a total equal to your
-own price for the row. That price is the one thing you write — a checker that
-answers it from your catalog, given the row and the cart's item lines as
-signed, or returns a String saying why the cart is refused.
+`paid` when the capture returns. The checkout the assistant pays is one your
+origin signed, so under the claim the engine checks one thing: that its total
+is still your own price for the row. That price is the one thing you write — a
+checker that answers it from your catalog, given the row and the checkout's
+item lines, or returns a String saying why the checkout is refused.
 
 ```ruby
 module PriceChecker
@@ -124,8 +129,8 @@ Kiosk.configure do |c|
   c.payment_provider = Kiosk::Server::PaymentClaim.new(
     psp, currency: "eur", model: "Order", reference: "order_id", query: "my_orders"
   )
-  c.cart_price_checker = PriceChecker
-  c.after_payment      = ->(order_id) { CourierDispatchJob.arm!(order_id) } # optional
+  c.checkout_price_checker = PriceChecker
+  c.after_payment          = ->(order_id) { CourierDispatchJob.arm!(order_id) } # optional
 end
 ```
 
@@ -139,10 +144,12 @@ The model also includes `Kiosk::Payable`, which gives each row:
   `refunded`. Your per-user query publishes it, so a capture in flight never
   reads as *not paid*. `Order.own.with_settlement(Kiosk::Settlement.own)` reads
   it for many rows in one query.
-- `cart(lines)`: the cart your action returns for the assistant to sign, a line
-  that names the row and then your priced lines.
-- `settlement`: the receipt of the capture that paid the row. `c.after_payment`
-  runs once this receipt is recorded, so it can refund against it.
+- `checkout(lines)`: the `checkout_jwt` your action returns, which the
+  assistant's AP2 mandates bind. Your origin signs it EdDSA with
+  `c.signing_key`, for the row's owner, with a random `jti`. Its first line names the row; then your
+  priced lines.
+- `settlement`: the record of the capture that paid the row. `c.after_payment`
+  runs once this record is written, so it can refund against it.
 
 When the capture returns, the engine pushes `{"order_id": "…", "payment_state":
 "paid"}` to the row's owner on the `payment` topic. Refund through the claim,
@@ -154,11 +161,18 @@ returns the whole charge, set the row's status column to `refunded`, which is
 where `payment_state` reads it. Then call `announce(id, "refunded")` on the
 claim to push the same topic.
 
-A repeat of a chain whose capture did not complete runs the capture again under
-the same key, the cart mandate id, so your PSP adapter must key its charge by
-it (`kiosk-pay-stripe` does). A charge refused with no money moved marks the
-cart declined: it stops counting against `spending_cap` at once, and a repeat of
-that chain answers `409 conflict`.
+A repeat of mandates whose capture did not complete runs the capture again
+under the same key, the checkout mandate's `reference`, so your PSP adapter must
+key its charge by it (`kiosk-pay-stripe` does). One checkout holds one live
+checkout mandate: a second pair for it answers `409 conflict`. A charge refused
+with no money moved marks the checkout mandate declined: it stops counting
+against `spending_cap` at once, a repeat of that pair answers `409 conflict`,
+and a new pair for the same checkout is accepted.
+
+A settled `pay` answers the settlement and the two AP2 receipts,
+`checkout_receipt` and `payment_receipt`, which your origin signs EdDSA with
+`c.signing_key`. The payment receipt carries the card network's id of the charge
+when your PSP adapter's `capture` answers `network_confirmation_id`.
 
 Set `c.spending_cap = Kiosk::Server::ColumnSpendingCap.new` to cap what each
 assistant spends. The human sets the cap on `/kiosk/auth/assistants`: an amount
@@ -186,6 +200,20 @@ you honour a booking that takes no payment:
 Kiosk::Visit.record!(user_id: booking.user_id, value_cents: 45_00)
 ```
 
+### Change the signing key
+
+`c.signing_key` signs every access token, checkout and receipt. To change it with no
+break, set the new key as `c.signing_key` and the old one as
+`c.previous_signing_key` (a public PEM is enough). The JWKS then publishes
+both, and a token or checkout that either key signed verifies. Remove
+`c.previous_signing_key` after one access-token lifetime, when no checkout that
+the old key signed is still to be paid.
+
+```ruby
+c.signing_key          = Base64.decode64(ENV.fetch("KIOSK_SIGNING_KEY_B64"))
+c.previous_signing_key = Base64.decode64(ENV.fetch("KIOSK_PREVIOUS_SIGNING_KEY_B64"))
+```
+
 
 ## Upgrading
 
@@ -231,7 +259,9 @@ what can be neither.
 The PoW gate keeps spent challenge ids in `c.pow_spent_store`, by default
 `Kiosk::Server::PowSpentStores::ActiveRecord`: the `kiosk.pow_spent` table that
 `bin/rails g kiosk:install` lays down. Every process and every deploy shares it,
-so a proof is accepted once (kiosk.tech `protocol.md` §15.2).
+so a proof is accepted once (kiosk.tech `protocol.md` §15.2). The token
+endpoint keeps the `jti` of each client assertion in the same store, so an
+assertion is accepted once too.
 
 Any other backend works: the contract is `claim(id, exp) → Boolean`,
 `release(id)`, `spent?(id)`, `mark_spent(id, exp)`, and `claim` **MUST** be one
@@ -240,21 +270,12 @@ read-then-write reintroduces exactly the replay race the gate closes.
 
 Token revocation lives in `c.revocation_store`, by default
 `Kiosk::Server::RevocationStores::ActiveRecord`: the `kiosk.revocations` table,
-which `bin/rails g kiosk:install` lays down too. A revoke, a rebind or an unlink
+which `bin/rails g kiosk:install` lays down too. A key rotation, a rebind or an unlink
 stops the agent's older tokens in every process and after a restart, and a
 token of an unlinked agent stops at once. The contract is
 `revoke_all(agent_id, at:)`, `watermark_for(agent_id)` and
 `revoked?(agent_id:, iat:)`.
 
-Outstanding auth challenges live in `c.auth_challenge_store`, by default
-`Kiosk::Server::AuthChallengeStores::ActiveRecord`: the `kiosk.auth_challenges`
-table, which `bin/rails g kiosk:install` lays down too. A challenge issued by one
-process is redeemed by any other. Any other backend works: the contract is
-`put(public_key_pem, nonce, exp)` / `take(public_key_pem, nonce) → Boolean`, and
-`take` **MUST** be one atomic operation (SQL `DELETE … RETURNING`, Redis
-`GETDEL`) so the store, not the application, decides which of two concurrent
-presentations wins.
-
 Events live in `c.event_store`, by default `Kiosk::Server::EventStores::ActiveRecord`:
 the `kiosk.events` table from `bin/rails g kiosk:install`. The event stream runs
 on the Action Cable adapter that `config/cable.yml` names for the environment. In
@@ -321,8 +342,8 @@ c.audit_sink = ->(e) { Siem.record(e.to_h.merge(args: e.args.except(:card_token)
 
 Actions only. A **query** is not emitted (it changes nothing, and every read
 would drown the trail). **`pay`** is not emitted — it already writes the far
-richer AP2 mandate trail (`intent_mandates`, `cart_mandates`,
-`payment_mandates`, `settlements`). A **refusal that never reached an action**
+richer AP2 mandate trail (`checkout_mandates`, `payment_mandates`,
+`settlements`). A **refusal that never reached an action**
 is not emitted: a 401 with no identity, a 404 for an unregistered name, a 405,
 a 400 from argument validation, a 402 from the toll. Nothing was invoked, so
 there is nothing to report — this is an action trail, not a request log. Put a
@@ -368,14 +389,15 @@ action. Each route reaches the controller action that declares the verb, and
 not yours. Under the mount: the reserved `schema`, `openapi.json` and `pay`,
 `payment_setup` and the `payment_setup/return` page a payment provider sends the
 human back to (both answer `501 module_not_served` without a `payment_provider`), the
-kiosk-pop auth plane (`auth/challenge`, `auth/register`, `auth/login`,
-`auth/revoke`), JWKS (`.well-known/jwks.json`), KYC (`agents/kyc`, and
+OAuth registration and token endpoints (`oauth/register`, `oauth/token`), the key
+rotation (`auth/rotate`), JWKS (`.well-known/jwks.json`), KYC (`agents/kyc`, and
 `request_kyc` and `kyc/callback`, which answer `501 module_not_served` without a
 `kyc_provider`) and the whole account-binding ceremony (the RFC 8628 claim wire,
 `auth/link`/`claim`/`unlink`, the verify and «Link an assistant» pages). The
 engine also installs the ROOT-relative discovery documents — `/agents.txt`,
 `/agents.json`, `/auth.md`,
-`/.well-known/{agent-configuration,kiosk.json,api-catalog}` — into the host app
+`/.well-known/{kiosk.json,api-catalog,oauth-authorization-server,ard.json}` and
+`/.well-known/agent-skills/index.json` — into the host app
 via `routes.append`, because the agents.txt standard and RFC 8615 place them at
 the origin root, outside any mount prefix. That install happens ONLY when the
 engine is mounted: merely bundling the gem adds no routes.
@@ -558,10 +580,10 @@ the one rendered whatever `Accept` the caller sent. On top of that:
 - `include Kiosk::SkillLink` — in a page controller: every answer carries
   `Link: <skill_url>; rel="kiosk"`, the discovery signal for a client that
   does not read HTML.
-- `Kiosk::Settlement` and `Kiosk::CartMandate` — read models over the receipts
-  `pay` records. `Kiosk::Settlement.own` is the caller's own;
-  `Kiosk::Settlement.joins(:cart_mandate).merge(Kiosk::CartMandate.referencing(order_id: id))`
-  is the settlement whose cart names your row by the key your line items carry.
+- `Kiosk::Settlement` and `Kiosk::CheckoutMandate` — read models over the
+  records `pay` writes. `Kiosk::Settlement.own` is the caller's own;
+  `Kiosk::Settlement.joins(:checkout_mandate).merge(Kiosk::CheckoutMandate.referencing(order_id: id))`
+  is the settlement whose checkout names your row by the key your line items carry.
 - The handler runs inside the wire's GUC-scoped transaction, so raising rolls
   back — and so does rendering a non-2xx, which the seam converts into a raise.
 
@@ -617,7 +639,7 @@ the PoW gates.
 ```ruby
 require "kiosk/server"
 
-# The issuer is the AP2 mandate `iss` anchor; the builder refuses to answer
+# The issuer is the origin a token or a checkout names; the builder refuses to answer
 # without it, booted app or not.
 Kiosk.configure { |c| c.issuer = "https://api.acme.example" }
 

data/app/controllers/kiosk/server/auth_controller.rb

@@ -5,8 +5,8 @@ require 'json'
 
 module Kiosk
   module Server
-    # The spec's challenge-response auth paths (§6), drawn by the engine: challenge, register, login,
-    # revoke, and the account-binding link, claim and unlink.
+    # The Kiosk auth paths that no OAuth standard covers (§5.7, §6), drawn by the
+    # engine: the key rotation, and the account-binding link, claim and unlink.
     class AuthController < ::ActionController::API
       # The JSON answers and RFC 9457 problem documents of the auth paths.
       module Answers
@@ -37,7 +37,7 @@ module Kiosk
           issuer = Kiosk.current_issuer
           case err
           when Errors::PowRequired          then %(Kiosk-PoW realm="#{issuer}")
-          when Errors::PaymentSetupRequired then %(Payment realm="#{issuer}", method="ap2")
+          when Errors::PaymentSetupRequired then %(Kiosk-Payment-Setup realm="#{issuer}")
           end
         end
       end
@@ -61,52 +61,21 @@ module Kiosk
 
       prepend_before_action :refuse_unserved_binding, only: %i[link claim unlink]
 
-      # Unauthenticated: the nonce is worthless without the matching private key.
-      def challenge
-        public_key = request.query_parameters['public_key']
-        raise Errors::BadRequest, 'missing public_key query parameter' if public_key.blank?
+      # A refused client assertion is a 401, with the hint that says what to fix.
+      rescue_from(ClientAssertion::Refused) { |e| render_error(e.to_problem) }
 
-        respond(AuthChallenge.issue(public_key_pem: public_key), :ok)
-      rescue Errors::Base => e
-        render_error(e)
-      end
-
-      # Registers a new public key (409 if known). The optional PoW proof rides in the `Kiosk-PoW`
-      # header, so the signed body stays the same on retry.
-      def register
-        body   = parse_body!('POST <endpoint>/auth/register')
-        pow    = proofs
-        result = AgentRegistration.call(public_key_pem: body.fetch(:public_key), signed: body.fetch(:signed), pow: pow)
-        respond(result, :created)
+      # Puts a new key on a registered client; both keys sign (§5.7). Answers the client information.
+      def rotate
+        body   = parse_body!('POST <endpoint>/auth/rotate')
+        client = AgentRotation.call(type: body.fetch(:client_assertion_type), assertion: body.fetch(:client_assertion),
+                                    new_assertion: body.fetch(:new_client_assertion), jwks: body.fetch(:jwks))
+        respond(client.information, :ok)
       rescue KeyError => e
         render_error(Errors.missing_field(e))
       rescue Errors::Base => e
         render_error(e)
       end
 
-      # Refresh a token for an EXISTING public key (404 if unknown → register).
-      def login
-        body   = parse_body!('POST <endpoint>/auth/login')
-        result = AgentLogin.call(public_key_pem: body.fetch(:public_key), signed: body.fetch(:signed))
-        respond(result, :ok)
-      rescue KeyError => e
-        render_error(Errors.missing_field(e))
-      rescue Errors::Base => e
-        render_error(e)
-      end
-
-      # Revokes every token of the caller's agent and returns a fresh one.
-      def revoke
-        identity = authenticated_agent
-        raise Errors::Unauthenticated, 'agent authentication required' if identity.nil? || identity.agent_id.nil?
-
-        Kiosk.configuration.revocation_store.revoke_all(identity.agent_id, at: Time.now.to_i)
-        token = fresh_token(identity)
-        respond({ access_token: token }, :ok)
-      rescue Errors::Base => e
-        render_error(e)
-      end
-
       # Mints a link code for the signed-in holder; the holder's `user_idp` role becomes the bound assistant's.
       def link
         identity = authenticated_account_holder!
@@ -116,15 +85,14 @@ module Kiosk
         render_error(e)
       end
 
-      # §6.2's three fields only: `fresh` stays off the wire so a re-bind is indistinguishable (§6.3).
-      CLAIM_RESPONSE_FIELDS = %i[agent_id user_id access_token].freeze
-
-      # The optional PoW proof rides in the `Kiosk-PoW` header, as on register.
+      # Binds the client to the human who minted the code; answers 204. The
+      # optional toll's proofs ride in the `Kiosk-PoW` header.
       def claim
-        body   = parse_body!('POST <endpoint>/auth/claim')
-        result = LinkCode.redeem(code: body.fetch(:code), public_key_pem: body.fetch(:public_key),
-                                 signed: body.fetch(:signed), pow: proofs)
-        respond(result.slice(*CLAIM_RESPONSE_FIELDS), :created)
+        body = parse_body!('POST <endpoint>/auth/claim')
+        LinkCode.redeem(code: body.fetch(:code), assertion_type: body.fetch(:client_assertion_type),
+                        assertion: body.fetch(:client_assertion), pow: proofs)
+        Kiosk::Server::Headers.add_to(response.headers)
+        head :no_content
       rescue KeyError => e
         render_error(Errors.missing_field(e))
       rescue Errors::Base => e
@@ -146,11 +114,6 @@ module Kiosk
 
       private
 
-      # Auth endpoints always mint through the bundled DefaultAgentIdp.
-      def fresh_token(identity)
-        AgentIdentityProviders::DefaultAgentIdp.new.issue(agent_id: identity.agent_id, role: identity.role)
-      end
-
       # The human's side of binding authenticates by the provider's session, never by an agent token.
       # A page on another origin can post a form with that cookie, but cannot send JSON without a CORS preflight.
       def authenticated_account_holder!
@@ -162,13 +125,6 @@ module Kiosk
         identity
       end
 
-      # nil for a missing, invalid or revoked bearer token.
-      def authenticated_agent
-        IdentityResolution.agent_idp.verify(request)
-      rescue Kiosk::Server::JwtIssuer::Error, Kiosk::AgentIdentityProviders::InvalidToken
-        nil
-      end
-
       # Schema-checked before any `fetch`, so a wrong-typed member is a 400 naming it (§17).
       def parse_body!(exchange)
         raw = request.raw_post

data/app/controllers/kiosk/server/discovery_controller.rb

@@ -23,8 +23,24 @@ module Kiosk
         render json: WellKnown.agents_json(base_url: request.base_url)
       end
 
-      def agent_configuration
-        render json: WellKnown.agent_configuration(base_url: request.base_url)
+      def oauth_authorization_server
+        render json: WellKnown.oauth_authorization_server(base_url: request.base_url)
+      end
+
+      def oauth_protected_resource
+        allow_cors
+        render json: WellKnown.oauth_protected_resource(base_url: request.base_url)
+      end
+
+      def agent_skills_index
+        allow_cors
+        render_or_not_found WellKnown.agent_skills_index
+      end
+
+      def ard
+        allow_cors
+        short_ttl
+        render json: WellKnown.ard(base_url: request.base_url)
       end
 
       def kiosk_json
@@ -35,6 +51,8 @@ module Kiosk
       def api_catalog
         allow_cors
         short_ttl
+        # RFC 9727 §2: a HEAD request finds the catalog by this header.
+        response.set_header('Link', %(<#{request.base_url}/.well-known/api-catalog>; rel="api-catalog"))
         render json: WellKnown.api_catalog(base_url: request.base_url),
                content_type: 'application/linkset+json; ' \
                              'profile="https://www.rfc-editor.org/info/rfc9727"'
@@ -48,7 +66,11 @@ module Kiosk
 
       private
 
-      # agents.txt v1.0 requires `Access-Control-Allow-Origin: *`.
+      def render_or_not_found(document)
+        document ? render(json: document) : head(:not_found)
+      end
+
+      # agents.txt v1.0 and AI Catalog require `Access-Control-Allow-Origin: *`.
       def allow_cors
         response.set_header('Access-Control-Allow-Origin', '*')
       end

data/app/controllers/kiosk/server/jwks_controller.rb

@@ -4,11 +4,11 @@ require 'action_controller'
 
 module Kiosk
   module Server
-    # GET <endpoint>/.well-known/jwks.json — the public signing key.
+    # GET <endpoint>/.well-known/jwks.json — the current signing key, and the previous one while it is set.
     class JwksController < ::ActionController::API
       def show
         Kiosk::Server::Headers.add_to(response.headers)
-        render json: Kiosk::Server::Jwks.build(keys: [Kiosk.configuration.signing_key])
+        render json: Kiosk::Server::Jwks.build(keys: Kiosk.configuration.signing_keys)
       end
     end
   end

data/app/controllers/kiosk/server/kyc_attestation_controller.rb

@@ -49,10 +49,7 @@ module Kiosk
 
       # Only an assistant submits an attestation, so only the agent IdP answers.
       def authenticate!
-        identity = IdentityResolution.agent_idp.verify(request)
-        raise Errors::Unauthenticated, 'missing or invalid agent token' if identity.nil?
-
-        identity
+        IdentityResolution.resolve(request) || raise(Errors::AccessTokenRefused)
       end
 
       def render_error(err)

data/app/controllers/kiosk/server/oauth_device_authorization_controller.rb

@@ -4,41 +4,28 @@ require 'action_controller'
 
 module Kiosk
   module Server
-    # POST <endpoint>/oauth/device_authorization (RFC 8628 §3.1): an assistant
-    # opens the claim half of account binding with `client_id` and `public_key`.
+    # POST <endpoint>/oauth/device_authorization (RFC 8628 §3.1): a registered
+    # client opens the claim half of account binding. It authenticates with a
+    # client assertion, so it sends no `client_id` of its own.
     class OauthDeviceAuthorizationController < ::ActionController::API
       include BindingModuleGate
+      include OauthAnswers
 
       prepend_before_action :refuse_unserved_binding
 
       def create
-        problem = request_problem
-        return render_oauth_error(:invalid_request, problem, status: 400) if problem
+        problem = role_problem
+        raise OauthError.new(:invalid_request, problem) if problem
 
-        result = DeviceCodeGrant.start(client_id: params[:client_id].to_s, public_key_pem: params[:public_key].to_s)
-        Kiosk::Server::Headers.add_to(response.headers)
-        render json: device_authorization(result)
+        render_oauth(device_authorization(DeviceCodeGrant.start(client: authenticate_client!)))
+      rescue OauthError => e
+        render_oauth_error(e)
       end
 
       private
 
-      # The first reason this request is refused, or nil.
-      def request_problem
-        return 'client_id parameter required' if params[:client_id].to_s.empty?
-        return 'public_key parameter required' if params[:public_key].to_s.empty?
-
-        key_problem(params[:public_key].to_s) || role_problem
-      end
-
-      def key_problem(public_key)
-        PopVerifier.load_public_key(public_key.strip)
-        nil
-      rescue Errors::BadRequest => e
-        e.message
-      end
-
-      # Refused, not ignored: the role is the approving human's, and this
-      # request is unauthenticated.
+      # Refused, not ignored: the role is the approving human's, and the
+      # assistant does not choose it.
       def role_problem
         offending = %i[role scope].find { |name| params.key?(name) }
         return unless offending
@@ -63,11 +50,6 @@ module Kiosk
         mount = Kiosk.configuration.mount_path
         "#{request.base_url}#{mount}/oauth/device/verify"
       end
-
-      def render_oauth_error(code, description, status:)
-        Kiosk::Server::Headers.add_to(response.headers)
-        render json: { error: code.to_s, error_description: description }, status: status
-      end
     end
   end
 end

data/app/controllers/kiosk/server/oauth_registration_controller.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'action_controller'
+require 'json'
+
+module Kiosk
+  module Server
+    # POST <endpoint>/oauth/register (RFC 7591 Section 3): open registration of
+    # an AI assistant's public key. The optional toll's proofs ride in the
+    # `Kiosk-PoW` header, so the body stays the same on retry.
+    class OauthRegistrationController < ::ActionController::API
+      include AuthController::Answers
+      include AuthController::Proofs
+      include OauthAnswers
+
+      def create
+        client = ClientRegistration.call(metadata, pow: proofs)
+        render_oauth(client.information, status: :created)
+      rescue OauthError => e
+        render_oauth_error(e)
+      rescue Errors::Base => e
+        render_error(e)
+      end
+
+      private
+
+      def metadata
+        JSON.parse(request.raw_post.to_s)
+      rescue JSON::ParserError
+        raise OauthError.new(:invalid_client_metadata, 'the request body must be a JSON object')
+      end
+    end
+  end
+end