agent-protocols 0.11.2__tar.gz → 0.11.3__tar.gz

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-protocols
-Version: 0.11.2
+Version: 0.11.3
 Summary: Python SDK for Agent Identity, Agent Profile, Agent Delegation, Agent Discourse, Agent Knowledge, and Agent Mail protocols
 Author: LDCLabs
 License: MIT
@@ -25,7 +25,7 @@ Python SDK for the draft Agent Identity, Agent Profile, Agent Delegation, Agent
 
 - `agent_protocols.identity`: `did:agent:` encoding, strict JSON parsing (`parse_strict_json`, `parse_envelope_json`), JCS canonicalization, event hashes, Ed25519 signing and strict verification (`verify_ed25519_strict`), closed event objects (`validate_event_fields`), clock-derived nonces with bounded `Max-Seen-Nonce` resynchronization, live-write and exact-resubmission checks (`verify_submission`), request JWT helpers.
 - `agent_protocols.profile`: `profile.update` payload helpers, delegation discovery hints, validation, succession checks, materialization.
-- `agent_protocols.delegation`: principal documents and resolution, Controller records with `supersedes` lineage, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
+- `agent_protocols.delegation`: principal documents and resolution, Controller records, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
 - `agent_protocols.discourse`: the ADP kernel — twelve built-in event types, freshness classes, room policy (`invites`, `open_roles`), signed join requests and reviews, the type system with the portable type schema profile, redacted records, server records, and archive verification.
 - `agent_protocols.knowledge`: signed research contributions, known-set lifecycle views, evidence and profile bindings, in-memory storage, exact queries with checkpoint-bound pagination, single-page ranked search, discovery, and response validation.
 - `agent_protocols.mail` and `agent_protocols.mail_state`: signed mailbox cards, sender-signed PyHPKE packets, historical key retention, card pins, inbox deduplication, and synchronized relay state with snapshots.
@@ -55,11 +55,11 @@ ADP room writes carry a signed `base_seq` / `base_hash`. Message and control wri
 
 ## Delegation
 
-Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. `supersedes` lets a successor key manage its predecessors' credentials. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes `delegation_query_url`.
+Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. A restricted key manages (replaces, revokes, enumerates) only credentials whose scopes and audiences fall within its own ceiling. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes its `delegation_service` origin.
 
 Controller registration (Section 4.3) proves key possession with a fixed-shape challenge: `signer.sign_controller_challenge(challenge)` signs its exact UTF-8 bytes and refuses any other string, and `verify_controller_challenge(agent_id, challenge, signature)` applies the strict Ed25519 rules. Issuing challenges, binding them to the owner-approved fields, and expiry stay with the provider.
 
-Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject` and `owner_controller`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
+Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
 
 The validation layers have different responsibilities:
 
@@ -99,7 +99,7 @@ The suite includes both `unittest.TestCase` classes and pytest functions. Runnin
 `agent_protocols.knowledge` implements Agent Knowledge 1.0: signed publications,
 assessments and retractions; strict payload and dependency validation; deterministic
 known-set lifecycle views; evidence byte verification; and exact query, batch,
-ranked-search and discovery contracts. The JSON Schema ships inside the installed
+ranked-search (with portable lexical matching) and discovery contracts. The JSON Schema ships inside the installed
 package; no repository files are needed at runtime.
 
 ```python
@@ -128,7 +128,7 @@ event = knowledge_publish_event(signer.agent_id(), now, nonces.next_nonce(now),
 envelope = signer.sign_event(event)
 store = KnowledgeStore("https://knowledge.example.com")
 record = store.submit(envelope)
-page = store.query({"q": "cache language", "kind": "observation"})
+page = store.query({"kind": "observation", "tag": "caching"})
 assert page["result"][0]["envelope"]["hash"] == envelope["hash"]
 assert materialize_knowledge(store.known_envelopes())[envelope["hash"]]["status"] == "active"
 ```

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/README.md

@@ -6,7 +6,7 @@ Python SDK for the draft Agent Identity, Agent Profile, Agent Delegation, Agent
 
 - `agent_protocols.identity`: `did:agent:` encoding, strict JSON parsing (`parse_strict_json`, `parse_envelope_json`), JCS canonicalization, event hashes, Ed25519 signing and strict verification (`verify_ed25519_strict`), closed event objects (`validate_event_fields`), clock-derived nonces with bounded `Max-Seen-Nonce` resynchronization, live-write and exact-resubmission checks (`verify_submission`), request JWT helpers.
 - `agent_protocols.profile`: `profile.update` payload helpers, delegation discovery hints, validation, succession checks, materialization.
-- `agent_protocols.delegation`: principal documents and resolution, Controller records with `supersedes` lineage, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
+- `agent_protocols.delegation`: principal documents and resolution, Controller records, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
 - `agent_protocols.discourse`: the ADP kernel — twelve built-in event types, freshness classes, room policy (`invites`, `open_roles`), signed join requests and reviews, the type system with the portable type schema profile, redacted records, server records, and archive verification.
 - `agent_protocols.knowledge`: signed research contributions, known-set lifecycle views, evidence and profile bindings, in-memory storage, exact queries with checkpoint-bound pagination, single-page ranked search, discovery, and response validation.
 - `agent_protocols.mail` and `agent_protocols.mail_state`: signed mailbox cards, sender-signed PyHPKE packets, historical key retention, card pins, inbox deduplication, and synchronized relay state with snapshots.
@@ -36,11 +36,11 @@ ADP room writes carry a signed `base_seq` / `base_hash`. Message and control wri
 
 ## Delegation
 
-Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. `supersedes` lets a successor key manage its predecessors' credentials. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes `delegation_query_url`.
+Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. A restricted key manages (replaces, revokes, enumerates) only credentials whose scopes and audiences fall within its own ceiling. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes its `delegation_service` origin.
 
 Controller registration (Section 4.3) proves key possession with a fixed-shape challenge: `signer.sign_controller_challenge(challenge)` signs its exact UTF-8 bytes and refuses any other string, and `verify_controller_challenge(agent_id, challenge, signature)` applies the strict Ed25519 rules. Issuing challenges, binding them to the owner-approved fields, and expiry stay with the provider.
 
-Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject` and `owner_controller`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
+Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
 
 The validation layers have different responsibilities:
 
@@ -80,7 +80,7 @@ The suite includes both `unittest.TestCase` classes and pytest functions. Runnin
 `agent_protocols.knowledge` implements Agent Knowledge 1.0: signed publications,
 assessments and retractions; strict payload and dependency validation; deterministic
 known-set lifecycle views; evidence byte verification; and exact query, batch,
-ranked-search and discovery contracts. The JSON Schema ships inside the installed
+ranked-search (with portable lexical matching) and discovery contracts. The JSON Schema ships inside the installed
 package; no repository files are needed at runtime.
 
 ```python
@@ -109,7 +109,7 @@ event = knowledge_publish_event(signer.agent_id(), now, nonces.next_nonce(now),
 envelope = signer.sign_event(event)
 store = KnowledgeStore("https://knowledge.example.com")
 record = store.submit(envelope)
-page = store.query({"q": "cache language", "kind": "observation"})
+page = store.query({"kind": "observation", "tag": "caching"})
 assert page["result"][0]["envelope"]["hash"] == envelope["hash"]
 assert materialize_knowledge(store.known_envelopes())[envelope["hash"]]["status"] == "active"
 ```

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agent-protocols"
-version = "0.11.2"
+version = "0.11.3"
 description = "Python SDK for Agent Identity, Agent Profile, Agent Delegation, Agent Discourse, Agent Knowledge, and Agent Mail protocols"
 readme = "README.md"
 requires-python = ">=3.10"

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/__init__.py

@@ -67,7 +67,7 @@ from .delegation import (
     DelegationRecord,
     DelegationVerdict,
     audit_delegation_history,
-    controller_lineage,
+    controller_covers_credential,
     delegation_grant_event,
     delegation_revoke_event,
     is_principal_alias,
@@ -115,7 +115,7 @@ __all__ = [
     "agent_id_from_public_key",
     "audit_delegation_history",
     "canonical_event_bytes",
-    "controller_lineage",
+    "controller_covers_credential",
     "create_event",
     "create_request_jwt_claims",
     "delegation_grant_event",

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/delegation.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from typing import Any, TypedDict, Literal
+from typing import Any, Mapping, TypedDict, Literal
 from copy import deepcopy
 from urllib.parse import urlparse
 import re
@@ -34,7 +34,6 @@ DELEGATION_ERROR_CODES = (
     "controller_not_current",
     "delegation_not_permitted",
     "delegation_ceiling_exceeded",
-    "not_owner_controller",
     "credential_not_found",
     "credential_identity_mismatch",
     "grant_expired",
@@ -59,8 +58,6 @@ class _ControllerBinding(TypedDict):
 class Controller(_ControllerBinding, total=False):
     name: str
     delegation: Literal["*"] | DelegationPolicy
-    # Earlier controllers of this principal whose credentials this key may manage.
-    supersedes: list[AgentId]
     retired_at: int
     invalid_from: int
 
@@ -122,10 +119,6 @@ def validate_controller(controller: Controller, retired: bool = False) -> None:
         _strings(policy["audiences"], "audiences")
         for audience in policy["audiences"]:
             validate_audience(audience)
-    if "supersedes" in controller:
-        _strings(controller["supersedes"], "supersedes")
-        for agent_id in controller["supersedes"]:
-            validate_agent_id(agent_id)
     if retired:
         _timestamp(controller.get("retired_at"), "retired_at")
         if controller["retired_at"] < controller["valid_from"]:
@@ -158,22 +151,16 @@ def validate_principal_document(document: PrincipalDocument) -> None:
             delegates = delegates or "delegation" in record
             if record["valid_from"] > document["updated_at"] or record.get("retired_at", 0) > document["updated_at"]:
                 _fail("controller timestamp exceeds document update")
-    # Succession (Section 5.1): each entry names another, earlier record.
-    for record in records.values():
-        for agent_id in record.get("supersedes", []):
-            predecessor = records.get(agent_id)
-            if predecessor is None or agent_id == record["id"] or predecessor["valid_from"] >= record["valid_from"]:
-                _fail("invalid supersedes entry")
     if "aliases" in document:
         _strings(document["aliases"], "aliases", empty=True)
         for alias in document["aliases"]:
             _validate_https_url(alias, "alias")
     if "avatar_url" in document:
         _validate_https_url(document["avatar_url"], "avatar_url")
-    if "delegation_query_url" in document:
-        _validate_https_url(document["delegation_query_url"], "delegation_query_url")
+    if "delegation_service" in document:
+        validate_origin(document["delegation_service"])
     elif delegates:
-        _fail("delegation_query_url is required when a controller carries delegation")
+        _fail("delegation_service is required when a controller carries delegation")
 
 
 def validate_principal_resolution(document: PrincipalDocument, resolved_url: str) -> None:
@@ -196,23 +183,17 @@ def is_principal_alias(document: PrincipalDocument, url: str) -> bool:
     return isinstance(aliases, list) and url in aliases
 
 
-def controller_lineage(document: PrincipalDocument, controller_id: AgentId) -> set[AgentId]:
-    """The lineage of a controller (Section 5.1): its own ID plus, transitively,
-    every record it supersedes. A restricted controller owns a credential whose
-    `owner_controller` is in its lineage."""
-    records = {
-        record["id"]: record
-        for record in [*document.get("controllers", []), *document.get("retired_controllers", [])]
-    }
-    lineage: set[AgentId] = set()
-    pending = [controller_id]
-    while pending:
-        agent_id = pending.pop()
-        if agent_id in lineage:
-            continue
-        lineage.add(agent_id)
-        pending.extend(records.get(agent_id, {}).get("supersedes", []))
-    return lineage
+def controller_covers_credential(controller: Controller, credential: Mapping[str, Any]) -> bool:
+    """The Section 5 management rule: a restricted controller may replace, revoke,
+    or enumerate a credential only when every scope and audience of its latest
+    grant is within the controller's ceiling; an unrestricted controller covers
+    every credential of the principal."""
+    policy = controller.get("delegation")
+    if policy is None:
+        return False
+    if policy == "*":
+        return True
+    return set(credential["scopes"]) <= set(policy["scopes"]) and set(credential["audiences"]) <= set(policy["audiences"])
 
 
 def validate_delegation_grant_payload(
@@ -352,7 +333,6 @@ def materialize_delegation_credential(
         **deepcopy(payload),
         "protocol": DELEGATION_PROTOCOL,
         "controller": event["actor"],
-        "owner_controller": previous["owner_controller"] if previous else event["actor"],
         "status": status,
         "event_id": envelope["hash"],
         "grant_event_id": envelope["hash"],
@@ -386,18 +366,20 @@ def validate_historical_delegation(record: DelegationRecord, document: Principal
     _authority(record["envelope"]["event"], document, record.get("accepted_at"), previous, True)
 
 
-def validate_controller_enumeration(document: PrincipalDocument, actor: AgentId, now: int, owner: AgentId) -> None:
+def validate_controller_enumeration(document: PrincipalDocument, actor: AgentId, now: int,
+                                    credential: Mapping[str, Any]) -> None:
     """Per-result authorization; caller authenticates actor and resolves document."""
     validate_principal_document(document)
     _timestamp(now, "now")
-    validate_agent_id(owner)
+    _strings(credential.get("scopes"), "scopes")
+    _strings(credential.get("audiences"), "audiences")
     controller = next((c for c in document["controllers"] if c["id"] == actor), None)
     if not controller or now < controller["valid_from"]:
         raise AgentProtocolError("controller_not_current", "controller cannot enumerate")
     if "delegation" not in controller:
         raise AgentProtocolError("delegation_not_permitted", "controller cannot enumerate")
-    if controller["delegation"] != "*" and owner not in controller_lineage(document, actor):
-        raise AgentProtocolError("not_owner_controller", "controller does not own credential")
+    if not controller_covers_credential(controller, credential):
+        raise AgentProtocolError("delegation_ceiling_exceeded", "credential is outside the controller's ceiling")
 
 
 def validate_delegation_use(credential: DelegationCredential, audience: str, now: int) -> None:
@@ -425,8 +407,8 @@ def verify_delegation_credential(
     service-trusting evidence policy: checks the accepted record of its latest
     grant — signature, Controller binding, ceiling, and authority interval —
     confirms that the grant matches the credential, and then checks use for
-    `audience` at `now`. Ownership and `supersedes` lineage govern management,
-    which the service enforced at acceptance; auditors replay them with
+    `audience` at `now`. The Section 5 management rule governs management,
+    which the service enforced at acceptance; auditors replay it with
     :func:`audit_delegation_history`. Relying parties still enforce scopes and
     constraints and authenticate the subject."""
     reasons: list[str] = []
@@ -473,7 +455,8 @@ def _previous(event: Event, previous: DelegationCredential | None) -> None:
         if event["type"] == DELEGATION_REVOKE:
             raise AgentProtocolError("credential_not_found", "revocation requires previous credential")
         return
-    validate_agent_id(previous.get("owner_controller"))
+    _strings(previous.get("scopes"), "previous.scopes")
+    _strings(previous.get("audiences"), "previous.audiences")
     _timestamp(previous.get("accepted_at"), "previous.accepted_at")
     delegation_id, principal_id = _event_identity(event)
     same_subject = event["type"] != DELEGATION_GRANT or event["payload"]["subject"] == previous.get("subject")
@@ -515,15 +498,12 @@ def _authority(event: Event, document: PrincipalDocument, accepted_at: int,
     _previous(event, previous)
     if previous and accepted_at < previous["accepted_at"]:
         _fail("acceptance order reversed")
-    if (previous and controller["delegation"] != "*"
-            and previous["owner_controller"] not in controller_lineage(document, event["actor"])):
-        raise AgentProtocolError("not_owner_controller", "controller does not own credential")
+    if previous and not controller_covers_credential(controller, previous):
+        raise AgentProtocolError("delegation_ceiling_exceeded", "credential is outside the controller's ceiling")
     if grant:
         if "expires_at" in payload and payload["expires_at"] <= accepted_at:
             raise AgentProtocolError("grant_expired", "grant expired at acceptance")
-        policy = controller["delegation"]
-        if policy != "*" and (not set(payload["scopes"]) <= set(policy["scopes"])
-                              or not set(payload["audiences"]) <= set(policy["audiences"])):
+        if not controller_covers_credential(controller, payload):
             raise AgentProtocolError("delegation_ceiling_exceeded", "grant exceeds controller delegation policy")
 
 
@@ -542,7 +522,7 @@ def audit_delegation_history(
 ) -> None:
     """Auditor check (Section 8): replays every accepted record of a credential
     against the authoritative principal document — signatures, controller
-    intervals, ceilings, and ownership lineage — and confirms that the replay
+    intervals, and ceilings — and confirms that the replay
     matches the credential. Relying parties use :func:`verify_delegation_credential`."""
     if not records:
         _fail("no accepted records")
@@ -554,7 +534,7 @@ def audit_delegation_history(
         )
     assert replayed is not None
     # Only status and the service's check time may differ from event replay.
-    fields = (*_GRANT_FIELDS, "protocol", "event_id", "grant_event_id", "owner_controller", "controller", "accepted_at")
+    fields = (*_GRANT_FIELDS, "protocol", "event_id", "grant_event_id", "controller", "accepted_at")
     expected = {field: replayed[field] for field in fields if field in replayed}
     actual = {field: credential[field] for field in fields if field in credential}
     if rfc8785.dumps(expected) != rfc8785.dumps(actual) or (

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/discourse.py

@@ -89,7 +89,6 @@ DISCOURSE_ERROR_CODES = (
     "join_request_not_found",
     "join_request_not_pending",
     "member_banned",
-    "role_not_allowed",
     "max_speakers_exceeded",
     "membership_required",
     "room_head_mismatch",
@@ -109,8 +108,8 @@ MAX_MENTIONS = 32
 # Room IDs are host-assigned and URL-safe (Section 6.1).
 ROOM_ID_PATTERN = re.compile(r"[A-Za-z0-9_-]{1,64}")
 
-# `<algorithm>:<base64url-digest>` content digests (Section 12.5).
-CONTENT_DIGEST_PATTERN = re.compile(r"(sha256|sha3-256):[A-Za-z0-9_-]{43}")
+# Content digests (Section 12.5): the SHA3-256 of the bytes, encoded like an event hash.
+CONTENT_DIGEST_PATTERN = re.compile(r"[A-Za-z0-9_-]{43}")
 
 # Custom event types must not use these prefixes.
 RESERVED_TYPE_PREFIXES = ("room.", "type.", "message.")
@@ -457,7 +456,7 @@ def validate_pack_import(declaration: dict[str, Any]) -> None:
             raise AgentProtocolError("invalid_event", "external pack must be an HTTPS URL")
         if not isinstance(declaration["digest"], str) or not CONTENT_DIGEST_PATTERN.fullmatch(declaration["digest"]):
             raise AgentProtocolError(
-                "invalid_event", "external pack digest must be <sha256|sha3-256>:<base64url-digest>"
+                "invalid_event", "external pack digest must be the base64url SHA3-256 of the pack bytes"
             )
     else:
         raise AgentProtocolError("invalid_event", "pack import requires either use, or pack with digest")
@@ -658,7 +657,7 @@ def _strip_annotations(schema: dict[str, Any]) -> dict[str, Any]:
     return stripped
 
 
-_ROOM_POLICY_FIELDS = frozenset({"invites", "open_roles", "max_speakers", "observer_allowed", "extra"})
+_ROOM_POLICY_FIELDS = frozenset({"invites", "open_roles", "max_speakers", "extra"})
 
 
 def validate_room_policy(policy: dict[str, Any] | None) -> None:
@@ -673,7 +672,6 @@ def validate_room_policy(policy: dict[str, Any] | None) -> None:
     max_speakers = policy.get("max_speakers")
     if max_speakers is not None and (type(max_speakers) is not int or max_speakers < 1):
         raise AgentProtocolError("invalid_event", "max_speakers must be a positive integer")
-    observer_allowed = policy.get("observer_allowed", True)
     invites = policy.get("invites")
     if invites is not None:
         if not isinstance(invites, dict):
@@ -682,8 +680,6 @@ def validate_room_policy(policy: dict[str, Any] | None) -> None:
             validate_agent_id(agent_id)
             if role not in ROLES:
                 raise AgentProtocolError("invalid_event", f"invalid invited role: {role}")
-            if role == "observer" and not observer_allowed:
-                raise AgentProtocolError("role_not_allowed", "observers are not allowed")
     open_roles = policy.get("open_roles")
     if open_roles is not None:
         if not isinstance(open_roles, list) or len(set(open_roles)) != len(open_roles):
@@ -691,8 +687,6 @@ def validate_room_policy(policy: dict[str, Any] | None) -> None:
         for role in open_roles:
             if role not in ("speaker", "observer"):
                 raise AgentProtocolError("invalid_event", f"open_roles cannot contain {role}")
-            if role == "observer" and not observer_allowed:
-                raise AgentProtocolError("role_not_allowed", "observers are not allowed")
 
 
 def validate_room_visibility_policy(visibility: Visibility, policy: dict[str, Any] | None) -> None:
@@ -705,11 +699,11 @@ def validate_room_visibility_policy(visibility: Visibility, policy: dict[str, An
 
 def effective_open_roles(visibility: Visibility, policy: dict[str, Any] | None) -> list[Role]:
     """The roles any agent may take by direct `room.join` (Section 8.3): the
-    explicit `open_roles`, or by default `observer` in a public room when
-    observers are allowed, and none otherwise."""
+    explicit `open_roles`, or by default `observer` in a public room and none
+    otherwise."""
     if policy is not None and policy.get("open_roles") is not None:
         return list(policy["open_roles"])
-    if visibility == "public" and (policy is None or policy.get("observer_allowed") is not False):
+    if visibility == "public":
         return ["observer"]
     return []
 
@@ -953,14 +947,11 @@ def _compile_schema(schema: dict[str, Any]) -> Draft202012Validator:
 
 
 def verify_pack_digest(data: bytes, digest: str) -> None:
-    """Verifies a `<algorithm>:<base64url-digest>` content digest over raw
-    bytes. Supports `sha256` and `sha3-256`."""
+    """Verifies a content digest (the base64url SHA3-256 of the bytes) over raw bytes."""
     if not isinstance(digest, str) or not CONTENT_DIGEST_PATTERN.fullmatch(digest):
         raise AgentProtocolError("pack_unavailable", f"invalid digest format: {digest}")
-    algorithm, _, expected = digest.partition(":")
-    raw = hashlib.sha256(data).digest() if algorithm == "sha256" else hashlib.sha3_256(data).digest()
-    actual = base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
-    if actual != expected:
+    actual = base64.urlsafe_b64encode(hashlib.sha3_256(data).digest()).rstrip(b"=").decode()
+    if actual != digest:
         raise AgentProtocolError("pack_unavailable", "pack digest mismatch")
 
 

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/http_client.py

@@ -297,10 +297,10 @@ class DelegationClient:
         request: dict[str, Any],
         jwt: str | None = None,
     ) -> dict[str, Any]:
-        """Queries the endpoint a principal document names in its
-        `delegation_query_url`. That is how a relying party reaches the
-        authoritative service for a principal without trusting a URL supplied
-        by whoever presented the credential."""
+        """Queries an explicit endpoint, such as the `query` endpoint discovered
+        at a principal's `delegation_service` origin. A relying party reaches a
+        principal's authoritative service through that origin, never through a
+        URL supplied by whoever presented the credential."""
         validate_delegation_query_request(request, allow_enumeration=jwt is not None)
         return _read_json(self.session.post(query_url, json=request, headers=_auth_headers(jwt)))
 

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/knowledge.py

@@ -46,7 +46,7 @@ SCHEMA = parse_strict_json(files(__package__).joinpath("knowledge.schema.json").
 ASCII_FOLD = str.maketrans('ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz')
 # Relationships that may point at an assessment as well as a publication.
 _ASSESSMENT_RELATIONS = ("derived_from", "supports", "contradicts")
-_READ_ONLY = ("q", "cursor", "limit", "after_seq")
+_READ_ONLY = ("cursor", "limit", "after_seq")
 _VALIDATORS = {name: Draft202012Validator({"$ref": "#/$defs/" + name, "$defs": SCHEMA["$defs"]}, format_checker=FormatChecker()) for name in SCHEMA["$defs"]}
 
 
@@ -145,7 +145,8 @@ def validate_knowledge_envelope(item: Envelope) -> None:
     verify_envelope(_identity_envelope(item))
     payload = item["event"]["payload"]
     validate_knowledge_id(item["hash"])
-    _https_url(payload["license"])
+    if item["event"]["type"] != KNOWLEDGE_RETRACT:
+        _https_url(payload["license"])
     for evidence in payload.get("evidence", []):
         _https_url(evidence["url"])
         if "digest" in evidence:
@@ -293,8 +294,6 @@ def validate_knowledge_query(value: Mapping[str, Any]) -> dict[str, Any]:
     """Validate a parsed query and return a normalized copy."""
     validate_knowledge_schema(value, 'queryRequest', 'invalid_request')
     _validate_filters({k: v for k, v in value.items() if k not in _READ_ONLY})
-    if 'q' in value:
-        knowledge_text_terms(value['q'])
     return _normalize_read_numbers(value)
 
 
@@ -317,14 +316,12 @@ def parse_knowledge_query(parameters: Iterable[tuple[str, str]]) -> dict[str, An
 
 
 def knowledge_query_matches(item: Envelope, filters: Mapping[str, Any]) -> bool:
-    """Exact filter and text predicate; `after_seq`, `limit` and `cursor` are not payload filters."""
+    """Exact filter predicate; `after_seq`, `limit` and `cursor` are not payload filters."""
     event, payload = item['event'], item['event']['payload']
     is_publication = event['type'] == KNOWLEDGE_PUBLISH
     for key in ('actor', 'type'):
         if key in filters and event[key] != filters[key]:
             return False
-    if 'q' in filters and not knowledge_text_matches(item, filters['q']):
-        return False
     if 'language' in filters and (not is_publication or _ascii_fold(payload['language']) != _ascii_fold(filters['language'])):
         return False
     if 'verdict' in filters and (event['type'] != KNOWLEDGE_ASSESS or payload['verdict'] != filters['verdict']):
@@ -779,7 +776,6 @@ class KnowledgeAssessPayload(KnowledgeAssessRequired, total=False):
 
 
 class KnowledgeRetractRequired(TypedDict):
-    license: str
     target: str
     reason: str
 

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/knowledge.schema.json

@@ -473,14 +473,10 @@
     "retractPayload": {
       "type": "object",
       "required": [
-        "license",
         "target",
         "reason"
       ],
       "properties": {
-        "license": {
-          "$ref": "#/$defs/httpsUrl"
-        },
         "target": {
           "$ref": "#/$defs/eventHash"
         },
@@ -893,9 +889,6 @@
         "after_seq": {
           "$ref": "#/$defs/nonNegativeInteger"
         },
-        "q": {
-          "$ref": "#/$defs/queryText"
-        },
         "limit": {
           "type": "integer",
           "minimum": 1,

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/mail.py

@@ -227,11 +227,11 @@ def validate_mail_envelope(envelope: Envelope, definition: str = 'envelope', *,
             validate_origin(route)
         _public_key(payload['public_key'])
     else:
-        _decode(payload['enc'], 32, 'invalid_packet')
-        ct = _decode(payload['ciphertext'], code='invalid_packet')
-        _require(len(ct) >= 1040 and len(ct) % 1024 == 16, 'invalid_packet', 'invalid ciphertext block length')
+        _decode(payload['enc'], 32, 'invalid_event')
+        ct = _decode(payload['ciphertext'], code='invalid_event')
+        _require(len(ct) >= 1040 and len(ct) % 1024 == 16, 'invalid_event', 'invalid ciphertext block length')
         _require(event['created_at'] < payload['header']['expires_at'] <= event['created_at'] + MAIL_MAX_TTL_MS + MAIL_FUTURE_SKEW_MS,
-                 'invalid_packet', 'invalid packet lifetime')
+                 'invalid_event', 'invalid packet lifetime')
 
 
 def parse_mail_envelope(raw: str | bytes, *, max_bytes: int = MAIL_MAX_PACKET_BYTES) -> Envelope:
@@ -284,14 +284,14 @@ def encode_mail_plaintext(message: dict[str, Any]) -> bytes:
 
 def decode_mail_plaintext(plaintext: bytes) -> dict[str, Any]:
     _require(isinstance(plaintext, bytes) and 1024 <= len(plaintext) <= MAIL_MAX_PACKET_BYTES
-             and len(plaintext) % 1024 == 0, 'invalid_packet', 'invalid plaintext block length')
+             and len(plaintext) % 1024 == 0, 'invalid_event', 'invalid plaintext block length')
     n = int.from_bytes(plaintext[:4], 'big')
-    _require(0 < n <= len(plaintext) - 4, 'invalid_packet', 'invalid plaintext JSON length')
-    _require(len(plaintext) == 1024 * ((4 + n + 1023) // 1024), 'invalid_packet', 'nonminimal padding')
-    _require(not any(plaintext[4+n:]), 'invalid_packet', 'nonzero padding')
+    _require(0 < n <= len(plaintext) - 4, 'invalid_event', 'invalid plaintext JSON length')
+    _require(len(plaintext) == 1024 * ((4 + n + 1023) // 1024), 'invalid_event', 'nonminimal padding')
+    _require(not any(plaintext[4+n:]), 'invalid_event', 'nonzero padding')
     data = plaintext[4:4+n]
-    message = _parse_bounded(data, MAIL_MAX_PACKET_BYTES, 'invalid_packet')
-    _require(_jcs(message) == data, 'invalid_packet', 'plaintext JSON is not JCS')
+    message = _parse_bounded(data, MAIL_MAX_PACKET_BYTES, 'invalid_event')
+    _require(_jcs(message) == data, 'invalid_event', 'plaintext JSON is not JCS')
     validate_mail_message(message)
     return message
 
@@ -307,7 +307,7 @@ def _packet_bytes(packet: dict[str, Any], packet_id: str | None = None) -> bytes
     raw = _jcs(packet)
     _require(len(raw) <= MAIL_MAX_PACKET_BYTES, 'payload_too_large', 'packet exceeds limit')
     if packet_id is not None:
-        _require(packet['hash'] == packet_id, 'invalid_packet', 'packet ID mismatch')
+        _require(packet['hash'] == packet_id, 'invalid_event', 'packet ID mismatch')
     return raw
 
 
@@ -322,7 +322,7 @@ def validate_mail_packet(packet: dict[str, Any], *, packet_id: str | None = None
 
 
 def parse_mail_packet(raw: str | bytes, *, max_body_bytes: int = MAIL_MAX_PACKET_BYTES + 65536) -> dict[str, Any]:
-    packet = _parse_bounded(raw, max_body_bytes, 'invalid_packet')
+    packet = _parse_bounded(raw, max_body_bytes, 'invalid_event')
     validate_mail_packet(packet)
     return packet
 
@@ -342,7 +342,7 @@ def encrypt_mail(message: dict[str, Any], card: Envelope, signer: AgentSigner, n
     c = card['event']['payload']
     _require(message['created_at'] <= now + MAIL_FUTURE_SKEW_MS and now < message['expires_at'],
              'packet_expired', 'message is expired or future-dated')
-    _require(message['expires_at'] <= c['receive_until'], 'invalid_packet', 'message exceeds receive_until')
+    _require(message['expires_at'] <= c['receive_until'], 'invalid_event', 'message exceeds receive_until')
     header = {'mailbox_id': c['mailbox_id'], 'card_hash': card['hash'], 'expires_at': message['expires_at']}
     event = create_event(MAIL_PROTOCOL, MAIL_SUBMIT, signer.agent_id(), now, nonce, {'header': header})
     plaintext = encode_mail_plaintext(message)
@@ -356,7 +356,7 @@ def encrypt_mail(message: dict[str, Any], card: Envelope, signer: AgentSigner, n
         finally:
             del context
     except (PyHPKEError, ValueError) as exc:
-        raise AgentProtocolError('invalid_packet', 'HPKE encryption failed') from exc
+        raise AgentProtocolError('invalid_event', 'HPKE encryption failed') from exc
     event['payload'].update(enc=_b64(enc), ciphertext=_b64(ciphertext))
     packet = signer.sign_event(event)
     _require(len(_packet_bytes(packet)) <= c['max_packet_bytes'], 'payload_too_large', 'packet exceeds card limit')
@@ -378,9 +378,9 @@ def _open_verified(packet: dict[str, Any], raw: bytes, card: Envelope, key: Mail
     c, h = card['event']['payload'], packet['event']['payload']['header']
     _require(packet['event']['created_at'] <= now + MAIL_FUTURE_SKEW_MS, 'timestamp_out_of_window', 'packet is future-dated')
     _require(h['card_hash'] == card['hash'] and h['mailbox_id'] == c['mailbox_id'],
-             'invalid_packet', 'packet/card binding mismatch')
+             'invalid_event', 'packet/card binding mismatch')
     _require(len(raw) <= c['max_packet_bytes'], 'payload_too_large', 'packet exceeds card limit')
-    _require(h['expires_at'] <= c['receive_until'], 'invalid_packet', 'packet exceeds key retention deadline')
+    _require(h['expires_at'] <= c['receive_until'], 'invalid_event', 'packet exceeds key retention deadline')
     _require(isinstance(key, MailEncryptionKey) and key.public_key() == c['public_key'],
              'invalid_private_key', 'recipient secret does not match card')
     try:
@@ -390,11 +390,11 @@ def _open_verified(packet: dict[str, Any], raw: bytes, card: Envelope, key: Mail
         finally:
             del context
     except (PyHPKEError, ValueError) as exc:
-        raise AgentProtocolError('invalid_packet', 'HPKE decryption failed') from exc
+        raise AgentProtocolError('invalid_event', 'HPKE decryption failed') from exc
     message = decode_mail_plaintext(plaintext)
     e = packet['event']
     _require(message['from'] == e['actor'] and message['to'] == owner and message['expires_at'] == h['expires_at'],
-             'invalid_packet', 'sender, recipient or expiration mismatch')
+             'invalid_event', 'sender, recipient or expiration mismatch')
     _require(message['created_at'] <= min(now, e['created_at']) + MAIL_FUTURE_SKEW_MS,
              'timestamp_out_of_window', 'message timestamp too far in future')
     return message

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols/mail_state.py

@@ -102,7 +102,7 @@ class MailKeyring:
         """Open a packet already checked by ``_packet_bytes``; used by MailInbox."""
         with self._lock:
             entry = self._entries.get(packet['event']['payload']['header']['card_hash'])
-        _require(entry is not None, 'invalid_packet', 'unknown retained mailbox card')
+        _require(entry is not None, 'invalid_event', 'unknown retained mailbox card')
         return _open_verified(packet, raw, entry[0], entry[1], self.owner, now)
 
     def prune(self, *, now_ms: int | None = None) -> int:
@@ -269,10 +269,10 @@ class MailRelayStore:
         """Packets are asynchronous signed objects: no live-write window or nonce maximum applies."""
         now = _now(now_ms)
         validate_mail_id(mailbox_id, size=16)
-        packet = _parse_bounded(packet, self.max_body_bytes, 'invalid_packet') if isinstance(packet, (str, bytes)) else copy.deepcopy(packet)
+        packet = _parse_bounded(packet, self.max_body_bytes, 'invalid_event') if isinstance(packet, (str, bytes)) else copy.deepcopy(packet)
         raw = _packet_bytes(packet)
         h = packet['event']['payload']['header']
-        _require(h['mailbox_id'] == mailbox_id, 'invalid_packet', 'path/header mailbox mismatch')
+        _require(h['mailbox_id'] == mailbox_id, 'invalid_event', 'path/header mailbox mismatch')
         pid, size = packet['hash'], len(raw)
         with self._lock:
             box = self._boxes.get(mailbox_id)
@@ -286,7 +286,7 @@ class MailRelayStore:
             _require(card['hash'] == h['card_hash'] and now < c['expires_at'], 'stale_card', 'packet needs the current unexpired card')
             _require(now < h['expires_at'], 'packet_expired', 'packet expired')
             _require(h['expires_at'] <= min(c['receive_until'], now + MAIL_MAX_TTL_MS + MAIL_FUTURE_SKEW_MS),
-                     'invalid_packet', 'packet exceeds accepted lifetime')
+                     'invalid_event', 'packet exceeds accepted lifetime')
             _require(packet['event']['created_at'] <= now + MAIL_FUTURE_SKEW_MS, 'timestamp_out_of_window', 'packet is future-dated')
             _require(size <= c['max_packet_bytes'], 'payload_too_large', 'packet exceeds card limit')
             box.drop_expired(now)

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/src/agent_protocols.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-protocols
-Version: 0.11.2
+Version: 0.11.3
 Summary: Python SDK for Agent Identity, Agent Profile, Agent Delegation, Agent Discourse, Agent Knowledge, and Agent Mail protocols
 Author: LDCLabs
 License: MIT
@@ -25,7 +25,7 @@ Python SDK for the draft Agent Identity, Agent Profile, Agent Delegation, Agent
 
 - `agent_protocols.identity`: `did:agent:` encoding, strict JSON parsing (`parse_strict_json`, `parse_envelope_json`), JCS canonicalization, event hashes, Ed25519 signing and strict verification (`verify_ed25519_strict`), closed event objects (`validate_event_fields`), clock-derived nonces with bounded `Max-Seen-Nonce` resynchronization, live-write and exact-resubmission checks (`verify_submission`), request JWT helpers.
 - `agent_protocols.profile`: `profile.update` payload helpers, delegation discovery hints, validation, succession checks, materialization.
-- `agent_protocols.delegation`: principal documents and resolution, Controller records with `supersedes` lineage, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
+- `agent_protocols.delegation`: principal documents and resolution, Controller records, grant/revoke payloads, credentials, authority, acceptance, historical, and use checks, `verify_delegation_credential` over the latest grant record, and `audit_delegation_history` for auditors.
 - `agent_protocols.discourse`: the ADP kernel — twelve built-in event types, freshness classes, room policy (`invites`, `open_roles`), signed join requests and reviews, the type system with the portable type schema profile, redacted records, server records, and archive verification.
 - `agent_protocols.knowledge`: signed research contributions, known-set lifecycle views, evidence and profile bindings, in-memory storage, exact queries with checkpoint-bound pagination, single-page ranked search, discovery, and response validation.
 - `agent_protocols.mail` and `agent_protocols.mail_state`: signed mailbox cards, sender-signed PyHPKE packets, historical key retention, card pins, inbox deduplication, and synchronized relay state with snapshots.
@@ -55,11 +55,11 @@ ADP room writes carry a signed `base_seq` / `base_hash`. Message and control wri
 
 ## Delegation
 
-Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. `supersedes` lets a successor key manage its predecessors' credentials. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes `delegation_query_url`.
+Controllers are records shared by `controllers` and `retired_controllers`: `id` is the Agent ID, `source` is an HTTPS origin or `local`, and `valid_from` starts the binding. Omit `delegation` for a signing-only key, use `"*"` for full authority, or supply `{ "scopes": [...], "audiences": [...] }` for restricted authority. A restricted key manages (replaces, revokes, enumerates) only credentials whose scopes and audiences fall within its own ceiling. Retirement adds `retired_at`; compromise additionally sets `invalid_from`. A principal that grants delegations publishes its `delegation_service` origin.
 
 Controller registration (Section 4.3) proves key possession with a fixed-shape challenge: `signer.sign_controller_challenge(challenge)` signs its exact UTF-8 bytes and refuses any other string, and `verify_controller_challenge(agent_id, challenge, signature)` applies the strict Ed25519 rules. Issuing challenges, binding them to the owner-approved fields, and expiry stay with the provider.
 
-Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject` and `owner_controller`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
+Grants name the canonical `principal_id`. Credentials carry `principal_id`, an immutable `subject`, the latest `grant_event_id`, the service `accepted_at`, and `checked_at`. Materialization requires an explicit acceptance time and trusted previous state; it never derives acceptance time from `created_at`.
 
 The validation layers have different responsibilities:
 
@@ -99,7 +99,7 @@ The suite includes both `unittest.TestCase` classes and pytest functions. Runnin
 `agent_protocols.knowledge` implements Agent Knowledge 1.0: signed publications,
 assessments and retractions; strict payload and dependency validation; deterministic
 known-set lifecycle views; evidence byte verification; and exact query, batch,
-ranked-search and discovery contracts. The JSON Schema ships inside the installed
+ranked-search (with portable lexical matching) and discovery contracts. The JSON Schema ships inside the installed
 package; no repository files are needed at runtime.
 
 ```python
@@ -128,7 +128,7 @@ event = knowledge_publish_event(signer.agent_id(), now, nonces.next_nonce(now),
 envelope = signer.sign_event(event)
 store = KnowledgeStore("https://knowledge.example.com")
 record = store.submit(envelope)
-page = store.query({"q": "cache language", "kind": "observation"})
+page = store.query({"kind": "observation", "tag": "caching"})
 assert page["result"][0]["envelope"]["hash"] == envelope["hash"]
 assert materialize_knowledge(store.known_envelopes())[envelope["hash"]]["status"] == "active"
 ```

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_delegation.py

@@ -78,7 +78,7 @@ class DelegationTests(unittest.TestCase):
                 "id": "https://profiles.example.com/org/acme",
                 "protocol": DELEGATION_PROTOCOL, "updated_at": 1000, "controllers": [{"id": controller.agent_id(), "source": "local", "valid_from": 0}],
                 "aliases": ["https://profiles.example.com/acme"],
-                "delegation_query_url": "https://profiles.example.com/v1/delegations/query",
+                "delegation_service": "https://profiles.example.com",
             }
         )
         with self.assertRaises(Exception):

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_delegation_conformance.py

@@ -74,7 +74,7 @@ ORIGIN = "https://dmsg.net"
 
 
 def document():
-    return {"protocol": d.DELEGATION_PROTOCOL, "id": ID, "updated_at": 2000, "delegation_query_url": f"{ID}/query", "controllers": [
+    return {"protocol": d.DELEGATION_PROTOCOL, "id": ID, "updated_at": 2000, "delegation_service": "https://example.com", "controllers": [
         {"id": SIGNER.agent_id(), "source": ORIGIN, "valid_from": 100, "delegation": {"scopes": ["draft"], "audiences": [ORIGIN]}},
         {"id": ROOT.agent_id(), "source": "local", "valid_from": 100, "delegation": "*"},
     ]}
@@ -98,7 +98,6 @@ def test_authority_ownership_and_materialization():
     assert credential["accepted_at"] == 250
     assert credential["checked_at"] == 250
     assert credential["principal_id"] == ID
-    assert credential["owner_controller"] == SIGNER.agent_id()
     assert credential["grant_event_id"] == envelope["hash"]
     d.validate_delegation_use(credential, ORIGIN, 300)
     with pytest.raises(AgentProtocolError):
@@ -120,18 +119,21 @@ def test_authority_ownership_and_materialization():
     with pytest.raises(AgentProtocolError) as not_permitted:
         d.validate_delegation_acceptance(envelope, only, ID, 250)
     assert not_permitted.value.code == "delegation_not_permitted"
+    # A restricted key manages another key's credential only within its ceiling.
     root_credential = d.materialize_delegation_credential(grant(ROOT), accepted_at=250)
-    with pytest.raises(AgentProtocolError) as not_owner:
-        d.validate_delegation_acceptance(envelope, doc, ID, 300, root_credential)
-    assert not_owner.value.code == "not_owner_controller"
+    d.validate_delegation_acceptance(envelope, doc, ID, 300, root_credential)
+    wide = d.materialize_delegation_credential(grant(ROOT, 2, scopes=["draft", "admin"]), accepted_at=250)
+    with pytest.raises(AgentProtocolError) as outside:
+        d.validate_delegation_acceptance(envelope, doc, ID, 300, wide)
+    assert outside.value.code == "delegation_ceiling_exceeded"
     with pytest.raises(AgentProtocolError):
-        d.validate_controller_enumeration(doc, SIGNER.agent_id(), 300, ROOT.agent_id())
-    d.validate_controller_enumeration(doc, ROOT.agent_id(), 300, SIGNER.agent_id())
+        d.validate_controller_enumeration(doc, SIGNER.agent_id(), 300, wide)
+    d.validate_controller_enumeration(doc, SIGNER.agent_id(), 300, credential)
+    d.validate_controller_enumeration(doc, ROOT.agent_id(), 300, wide)
     revocation = revoke()
     d.validate_delegation_acceptance(revocation, doc, ID, 450, credential)
     revoked = d.materialize_delegation_credential(revocation, accepted_at=450, previous=credential)
     assert revoked["status"] == "revoked"
-    assert revoked["owner_controller"] == SIGNER.agent_id()
     assert revoked["controller"] == ROOT.agent_id()
     assert revoked["grant_event_id"] == envelope["hash"]
     assert revoked["audiences"] == credential["audiences"]
@@ -140,7 +142,7 @@ def test_authority_ownership_and_materialization():
     assert missing.value.code == "credential_not_found"
     replacement = grant(ROOT, 3)
     d.validate_delegation_acceptance(replacement, doc, ID, 500, revoked)
-    assert d.materialize_delegation_credential(replacement, accepted_at=500, previous=revoked)["owner_controller"] == SIGNER.agent_id()
+    assert d.materialize_delegation_credential(replacement, accepted_at=500, previous=revoked)["controller"] == ROOT.agent_id()
 
 
 def test_a_replacement_cannot_move_a_credential_to_another_subject():
@@ -172,32 +174,34 @@ def test_retired_history_needs_accepted_records_and_the_original_ceiling():
         d.validate_historical_delegation({"envelope": grant(nonce=2, scopes=["admin"]), "accepted_at": 250}, doc, ID)
 
 
-def test_a_restricted_successor_manages_its_predecessors_credentials():
+def test_a_restricted_controller_manages_credentials_within_its_ceiling():
     doc = document()
     retired = doc["controllers"].pop(0)
     retired["retired_at"] = 600
     doc["retired_controllers"] = [retired]
     doc["controllers"].append({
         "id": SUCCESSOR.agent_id(), "source": ORIGIN, "valid_from": 600,
-        "delegation": {"scopes": ["draft", "inbox"], "audiences": [ORIGIN]}, "supersedes": [SIGNER.agent_id()],
+        "delegation": {"scopes": ["draft", "inbox"], "audiences": [ORIGIN]},
     })
     d.validate_principal_document(doc)
-    assert d.controller_lineage(doc, SUCCESSOR.agent_id()) == {SIGNER.agent_id(), SUCCESSOR.agent_id()}
     credential = d.materialize_delegation_credential(grant(), accepted_at=250)
+    assert d.controller_covers_credential(doc["controllers"][1], credential)
     revocation = revoke(SUCCESSOR, 700, 1)
     d.validate_delegation_acceptance(revocation, doc, ID, 700, credential)
-    d.validate_controller_enumeration(doc, SUCCESSOR.agent_id(), 700, SIGNER.agent_id())
+    d.validate_controller_enumeration(doc, SUCCESSOR.agent_id(), 700, credential)
     widened = SUCCESSOR.sign_event(d.delegation_grant_event(SUCCESSOR.agent_id(), 700, 2, {
         "id": "del", "principal_id": ID, "subject": ROOT.agent_id(), "scopes": ["draft", "inbox"],
         "audiences": [ORIGIN], "expires_at": 1900,
     }))
     d.validate_delegation_acceptance(widened, doc, ID, 700, credential)
-    assert d.materialize_delegation_credential(widened, accepted_at=700, previous=credential)["owner_controller"] == SIGNER.agent_id()
-    # Without the supersedes link the successor owns nothing.
-    unlinked = deepcopy(doc)
-    del unlinked["controllers"][1]["supersedes"]
-    with pytest.raises(AgentProtocolError, match="own"):
-        d.validate_delegation_acceptance(revocation, unlinked, ID, 700, credential)
+    assert d.materialize_delegation_credential(widened, accepted_at=700, previous=credential)["controller"] == SUCCESSOR.agent_id()
+    # A credential outside the ceiling cannot be revoked, replaced, or enumerated by the restricted key.
+    wide = d.materialize_delegation_credential(grant(ROOT, 3, scopes=["draft", "admin"]), accepted_at=250)
+    assert not d.controller_covers_credential(doc["controllers"][1], wide)
+    with pytest.raises(AgentProtocolError, match="ceiling"):
+        d.validate_delegation_acceptance(revocation, doc, ID, 700, wide)
+    with pytest.raises(AgentProtocolError, match="ceiling"):
+        d.validate_controller_enumeration(doc, SUCCESSOR.agent_id(), 700, wide)
 
 
 def test_verify_delegation_credential_checks_the_latest_grant():

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_discourse.py

@@ -1,7 +1,7 @@
 import json
 from base64 import urlsafe_b64encode
 from copy import deepcopy
-from hashlib import sha256, sha3_256
+from hashlib import sha3_256
 from pathlib import Path
 
 import pytest
@@ -240,10 +240,8 @@ def test_direct_join_follows_invites_and_open_roles():
     assert not d.can_join_directly("private", None, stranger, "observer")
     assert d.effective_open_roles("public", None) == ["observer"]
     assert d.effective_open_roles("restricted", None) == []
-    assert d.effective_open_roles("public", {"observer_allowed": False}) == []
     for bad in (
         {"open_roles": ["moderator"]},
-        {"observer_allowed": False, "open_roles": ["observer"]},
         {"moderator_agent_ids": []},
         {"invites": {invited: "owner"}},
         {"max_speakers": 0},
@@ -314,11 +312,12 @@ def test_registry_imports_packs_and_rejects_conflicts():
 
 def test_verifies_pack_digests():
     data = b"pack document bytes"
-    for algorithm, digest in (("sha256", sha256(data).digest()), ("sha3-256", sha3_256(data).digest())):
-        value = f"{algorithm}:" + urlsafe_b64encode(digest).rstrip(b"=").decode()
-        d.verify_pack_digest(data, value)
-        with pytest.raises(AgentProtocolError):
-            d.verify_pack_digest(b"tampered", value)
+    value = urlsafe_b64encode(sha3_256(data).digest()).rstrip(b"=").decode()
+    d.verify_pack_digest(data, value)
+    with pytest.raises(AgentProtocolError):
+        d.verify_pack_digest(b"tampered", value)
+    with pytest.raises(AgentProtocolError):
+        d.verify_pack_digest(data, f"sha3-256:{value}")
     with pytest.raises(AgentProtocolError):
         d.verify_pack_digest(data, "md5:abc")
 

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_discourse_coverage.py

@@ -90,11 +90,11 @@ class ValidationTests(unittest.TestCase):
 
     def test_validate_pack_import_covers_each_arm(self):
         validate_pack_import({"use": PACK_REACTIONS})
-        validate_pack_import({"pack": "https://example.com/p.json", "digest": "sha256:" + "A" * 43})
+        validate_pack_import({"pack": "https://example.com/p.json", "digest": "A" * 43})
         with self.assertRaises(AgentProtocolError):
             validate_pack_import({"pack": "https://example.com/p.json", "digest": "sha256:abc"})
         with self.assertRaises(AgentProtocolError):
-            validate_pack_import({"pack": "http://example.com/p.json", "digest": "sha256:" + "A" * 43})
+            validate_pack_import({"pack": "http://example.com/p.json", "digest": "A" * 43})
         with self.assertRaises(AgentProtocolError):
             validate_pack_import({"pack": "https://example.com/p.json", "digest": "  "})
         with self.assertRaises(AgentProtocolError):
@@ -117,9 +117,9 @@ class ValidationTests(unittest.TestCase):
         with self.assertRaises(AgentProtocolError):
             validate_message_create_payload({"content_type": " ", "content": "hi"})
 
-    def test_verify_pack_digest_supports_sha3_256(self):
+    def test_verify_pack_digest_is_sha3_256(self):
         data = b"pack document bytes"
-        digest = "sha3-256:" + urlsafe_b64encode(sha3_256(data).digest()).rstrip(b"=").decode()
+        digest = urlsafe_b64encode(sha3_256(data).digest()).rstrip(b"=").decode()
         verify_pack_digest(data, digest)
         with self.assertRaises(AgentProtocolError):
             verify_pack_digest(b"tampered", digest)

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_knowledge.py

@@ -98,7 +98,7 @@ def test_withheld_dependencies_resolve_and_exact_receipts_bypass_admission():
     second = signed(2, relations=[{'relation': 'derived_from', 'target': first['hash']}])
     record = store.submit(second)
     retraction = SIGNER.sign_event(k.knowledge_retract_event(SIGNER.agent_id(), NOW, 3, {
-        'license': 'https://example.com/license', 'target': first['hash'], 'reason': 'mistake'}))
+        'target': first['hash'], 'reason': 'mistake'}))
     assert store.submit(retraction)['seq'] == 3
     store.admit = lambda _: (_ for _ in ()).throw(AgentProtocolError('permission_denied', 'closed'))
     assert store.submit(second) == record
@@ -122,7 +122,7 @@ def test_relationships_may_cite_or_dispute_assessments():
 def test_known_set_validation_rejects_unresolved_forged_and_wrong_keys():
     item = signed()
     withdrawal = SIGNER.sign_event(k.knowledge_retract_event(SIGNER.agent_id(), NOW, 2, {
-        'license': 'https://example.com/license', 'target': item['hash'], 'reason': 'mistake'}))
+        'target': item['hash'], 'reason': 'mistake'}))
     assert code(lambda: k.materialize_knowledge({withdrawal['hash']: withdrawal})) == 'missing_dependency'
     with pytest.raises(AgentProtocolError):
         k.materialize_knowledge({'wrong': item})
@@ -162,7 +162,7 @@ def test_page_tracker_rejects_cross_page_drift(mutation):
     store = k.KnowledgeStore(ORIGIN, clock=lambda: NOW)
     for n in range(1, 4):
         store.submit(signed(n))
-    request = {'q': 'cache', 'limit': 1}
+    request = {'type': 'knowledge.publish', 'limit': 1}
     first = store.query(request)
     tracker = k.KnowledgePageTracker(ORIGIN)
     tracker.accept(request, first)
@@ -173,7 +173,7 @@ def test_page_tracker_rejects_cross_page_drift(mutation):
     elif mutation == 'duplicate':
         second['result'] = first['result']
     elif mutation == 'request':
-        request['q'] = 'Cache'
+        request['type'] = 'knowledge.assess'
     elif mutation == 'cursor':
         request['cursor'] = 'other'
     with pytest.raises(AgentProtocolError) as exc:

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_knowledge_http.py

@@ -155,13 +155,13 @@ def test_http_verifies_read_envelopes_ids_scope_filters_and_order(mutation):
 
 def test_query_pages_check_scope_and_repeat_parameters():
     store, _, _, _, _ = populated()
-    request = {'q': 'cache', 'limit': 1}
+    request = {'type': 'knowledge.publish', 'limit': 1}
     first = store.query(request)
     second = store.query({**request, 'cursor': first['next_cursor']})
     session = Session(Response(first), Response(second))
     assert len(list(KnowledgeClient(ORIGIN, session).query_pages(request))) == 2
     params = parse_qs(urlsplit(session.calls[1][1]).query)
-    assert params == {'q': ['cache'], 'limit': ['1'], 'cursor': [first['next_cursor']]}
+    assert params == {'type': ['knowledge.publish'], 'limit': ['1'], 'cursor': [first['next_cursor']]}
     second['as_of'] += 1
     with pytest.raises(AgentProtocolError) as exc:
         list(KnowledgeClient(ORIGIN, Session(Response(first), Response(second))).query_pages(request))

{agent_protocols-0.11.2 → agent_protocols-0.11.3}/tests/test_mail.py

@@ -86,7 +86,7 @@ def test_encryption_checks_happen_before_hpke(monkeypatch):
     large = signed_change(ENVS['message'], SENDER, parts=[mail_part('application/octet-stream', bytes(5000))])
     assert code_of(lambda: encrypt_mail(large, ENVS['small_limit_card'], now_ms=NOW)) == 'payload_too_large'
     long = signed_change(ENVS['message'], SENDER, expires_at=NOW+3*DAY)
-    assert code_of(lambda: encrypt_mail(long, ENVS['card'], now_ms=NOW)) == 'invalid_packet'
+    assert code_of(lambda: encrypt_mail(long, ENVS['card'], now_ms=NOW)) == 'invalid_event'
     assert code_of(lambda: encrypt_mail(ENVS['message'], ENVS['card'], now_ms=NOW+DAY+1000)) == 'stale_card'
 
 
@@ -122,7 +122,7 @@ def test_keyring_old_secret_retention_and_prune():
     assert keys.open(packet('original'), now_ms=NOW+DAY+500) == ENVS['message']
     restored = MailKeyring.from_snapshot(keys.snapshot())
     assert restored.prune(now_ms=NOW+2*DAY) == 3
-    assert code_of(lambda: restored.open(packet('original'), now_ms=NOW)) == 'invalid_packet'
+    assert code_of(lambda: restored.open(packet('original'), now_ms=NOW)) == 'invalid_event'
     assert code_of(lambda: MailKeyring(OWNER).add(ENVS['card'], key_for(ENVS['rotated_card']))) == 'invalid_private_key'
 
 
@@ -213,7 +213,7 @@ def test_relay_raw_bounds_strict_json_route_change_and_path_binding():
         relay.deliver(MAILBOX, raw + ' ' * relay.max_body_bytes, now_ms=NOW)
     with pytest.raises(AgentProtocolError):
         relay.deliver(MAILBOX, raw[:-1] + ',"enc":"bad"}', now_ms=NOW)
-    assert code_of(lambda: relay.deliver(new_mail_id(), raw, now_ms=NOW)) == 'invalid_packet'
+    assert code_of(lambda: relay.deliver(new_mail_id(), raw, now_ms=NOW)) == 'invalid_event'
     # A valid sender signature still cannot prove ciphertext decryptability.
     assert code_of(lambda: relay.deliver(MAILBOX, V['recipient_rejections'][0]['packet'], now_ms=NOW)) == 'invalid_event_hash'
     bad = signed_change(next(c['packet'] for c in V['recipient_rejections'] if c['name'] == 'wrong HPKE AAD'), SENDER, nonce=900)