keri 1.2.0.dev1__tar.gz → 1.2.0.dev3__tar.gz

{keri-1.2.0.dev1/src/keri.egg-info → keri-1.2.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: keri
-Version: 1.2.0.dev1
+Version: 1.2.0.dev3
 Summary: Key Event Receipt Infrastructure
 Home-page: https://github.com/WebOfTrust/keripy
 Author: Samuel M. Smith

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/setup.py

@@ -37,7 +37,7 @@ from os.path import splitext
 from setuptools import find_packages, setup
 setup(
     name='keri',
-    version='1.2.0-dev1',  # also change in src/keri/__init__.py
+    version='1.2.0-dev3',  # also change in src/keri/__init__.py
     license='Apache Software License 2.0',
     description='Key Event Receipt Infrastructure',
     long_description="KERI Decentralized Key Management Infrastructure",

keri-1.2.0.dev3/src/keri/__init__.py

@@ -0,0 +1,5 @@
+# -*- encoding: utf-8 -*-
+
+__version__ = '1.2.0-dev3'  # also change in setup.py
+
+

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/delegate/confirm.py

@@ -96,9 +96,8 @@ class ConfirmDoer(doing.DoDoer):
 
         while True:
             esc = self.escrowed()
-            for ekey, edig in esc:
-                pre, sn = dbing.splitKeySN(ekey)  # get pre and sn from escrow item
-                dgkey = dbing.dgKey(pre, bytes(edig))
+            for pre, sn, edig in esc:
+                dgkey = dbing.dgKey(pre, edig)
                 eraw = self.hby.db.getEvt(dgkey)
                 if eraw is None:
                     continue
@@ -204,6 +203,7 @@ class ConfirmDoer(doing.DoDoer):
 
                             print(f"Delegate {eserder.pre} {typ} event committed.")
 
+                        self.hby.db.delegables.rem(keys=(pre, sn))
                         self.remove(self.toRemove)
                         return True
 
@@ -213,12 +213,6 @@ class ConfirmDoer(doing.DoDoer):
 
     def escrowed(self):
         esc = []
-        key = ekey = b''  # both start same. when not same means escrows found
-        while True:  # break when done
-            for ekey, edig in self.hby.db.getPseItemsNextIter(key=key):
-                esc.append((ekey, edig))
-            if ekey == key:  # still same so no escrows found on last while iteration
-                break
-            key = ekey  # setup next while iteration, with key after ekey
-
+        for (pre, sn), edig in self.hby.db.delegables.getItemIter():
+            esc.append((pre, sn, edig))
         return esc

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/incept.py

@@ -137,16 +137,15 @@ class InceptDoer(doing.DoDoer):
                                     clear=False)
         self.endpoint = endpoint
         self.proxy = proxy
-        hby = existing.setupHby(name=name, base=base, bran=bran, cf=cf)
-        self.hbyDoer = habbing.HaberyDoer(habery=hby)  # setup doer
-        self.swain = delegating.Anchorer(hby=hby)
-        self.postman = forwarding.Poster(hby=hby)
-        self.mbx = indirecting.MailboxDirector(hby=hby, topics=['/receipt', "/replay", "/reply"])
+        self.hby = existing.setupHby(name=name, base=base, bran=bran, cf=cf)
+        self.hbyDoer = habbing.HaberyDoer(habery=self.hby)  # setup doer
+        self.swain = delegating.Anchorer(hby=self.hby, proxy=self.hby.habByName(self.proxy))
+        self.postman = forwarding.Poster(hby=self.hby)
+        self.mbx = indirecting.MailboxDirector(hby=self.hby, topics=['/receipt', "/replay", "/reply"])
         doers = [self.hbyDoer, self.postman, self.mbx, self.swain, doing.doify(self.inceptDo)]
 
         self.inits = kwa
         self.alias = alias
-        self.hby = hby
         super(InceptDoer, self).__init__(doers=doers)
 
     def inceptDo(self, tymth, tock=0.0):
@@ -169,7 +168,7 @@ class InceptDoer(doing.DoDoer):
         self.extend([witDoer, receiptor])
 
         if hab.kever.delpre:
-            self.swain.delegation(pre=hab.pre, sn=0, proxy=self.hby.habByName(self.proxy))
+            self.swain.delegation(pre=hab.pre, sn=0)
             print("Waiting for delegation approval...")
             while not self.swain.complete(hab.kever.prefixer, coring.Seqner(sn=hab.kever.sn)):
                 yield self.tock

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/ipex/agree.py

@@ -7,7 +7,7 @@ import argparse
 
 from hio.base import doing
 
-from keri.core import coring
+from keri.core import signing
 
 parser = argparse.ArgumentParser(description='Reply to IPEX offer message acknowledged willingness to accept offered '
                                              'credential')
@@ -23,4 +23,4 @@ def nonce(tymth, tock=0.0):
     """
     _ = (yield tock)
 
-    print(coring.randomNonce())
+    print(signing.Salter().qb64)

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/ipex/apply.py

@@ -7,7 +7,7 @@ import argparse
 
 from hio.base import doing
 
-from keri.core import coring
+from keri.core import signing
 
 parser = argparse.ArgumentParser(description='Request a credential from another party by initiating an IPEX exchange')
 parser.set_defaults(handler=lambda args: handler(args))
@@ -22,4 +22,4 @@ def nonce(tymth, tock=0.0):
     """
     _ = (yield tock)
 
-    print(coring.randomNonce())
+    print(signing.Salter().qb64)

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/ipex/list.py

@@ -8,6 +8,7 @@ keri.kli.commands module
 import argparse
 import datetime
 import os
+import json
 import sys
 
 from hio import help
@@ -199,6 +200,12 @@ class ListDoer(doing.DoDoer):
         if response is not None:
             print(f"    Response: {responseType} ({response.qb64})")
 
+        if self.verbose:
+            bsad = json.dumps(sad, indent=2)
+            print("    Full Credential:")
+            for line in bsad.splitlines():
+                print(f"\t{line}")
+
     def apply(self, note, exn, pathed):
         pass
 

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/ipex/offer.py

@@ -7,7 +7,7 @@ import argparse
 
 from hio.base import doing
 
-from keri.core import coring
+from keri.core import signing
 
 parser = argparse.ArgumentParser(description='Reply to IPEX apply message or initiate an IPEX exchange with an offer'
                                              ' for a credential with certain characteristics')
@@ -23,4 +23,4 @@ def nonce(tymth, tock=0.0):
     """
     _ = (yield tock)
 
-    print(coring.randomNonce())
+    print(signing.Salter().qb64)

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/multisig/join.py

@@ -21,47 +21,52 @@ from keri.vdr import verifying, credentialing
 logger = help.ogler.getLogger()
 
 parser = argparse.ArgumentParser(description='Join group multisig inception, rotation or interaction event.')
-parser.set_defaults(handler=lambda args: confirm(args))
+parser.set_defaults(handler=lambda args: join(args))
 parser.add_argument('--name', '-n', help='keystore name and file location of KERI keystore', required=True)
 parser.add_argument('--base', '-b', help='additional optional prefix to file location of KERI keystore',
                     required=False, default="")
+parser.add_argument('--group', '-a', help='human-readable name for the multisig group identifier prefix', required=False, default=None)
 parser.add_argument('--passcode', '-p', help='21 character encryption passcode for keystore (is not saved)',
                     dest="bran", default=None)  # passcode => bran
 parser.add_argument("--auto", "-Y", help="auto approve any delegation request non-interactively", action="store_true")
 
 
-def confirm(args):
-    """  Wait for and provide interactive confirmation of group multisig inception, rotation or interaction events
+def join(args):
+    """ Wait for and provide interactive confirmation of group multisig inception, rotation or interaction events
 
     Parameters:
-        args(Namespace): parsed arguements namespace object
+        args(Namespace): parsed arguments namespace object
 
     """
     name = args.name
     base = args.base
     bran = args.bran
     auto = args.auto
+    group = args.group
 
-    confirmDoer = ConfirmDoer(name=name, base=base, bran=bran, auto=auto)
+    joinDoer = JoinDoer(name=name, base=base, bran=bran, group=group, auto=auto)
 
-    doers = [confirmDoer]
+    doers = [joinDoer]
     return doers
 
 
-class ConfirmDoer(doing.DoDoer):
-    """  Doist doer capable of polling for group multisig events and prompting user for action
+class JoinDoer(doing.DoDoer):
+    """ Doist doer capable of polling for group multisig events and prompting user for action
 
     """
 
-    def __init__(self, name, base, bran, auto=False):
+    def __init__(self, name, base, bran, group, auto=False):
         """ Create doer for polling for group multisig events and either approve automatically or prompt user
 
         Parameters:
             name (str): database environment name
             base (str): database directory prefix
             bran (str): passcode to unlock keystore
-
+            group (str): human-readable name for the multisig identifier prefix
+            auto (bool): non-interactively auto approve any inception, rotation, interaction, or other event
+                         while using the default group of "default-group"
         """
+        self.group = group
         self.hby = existing.setupHby(name=name, base=base, bran=bran)
         self.rgy = credentialing.Regery(hby=self.hby, name=name, base=base)
         self.hbyDoer = habbing.HaberyDoer(habery=self.hby)  # setup doer
@@ -88,11 +93,11 @@ class ConfirmDoer(doing.DoDoer):
 
         doers = [self.hbyDoer, self.witq,  self.mbx, self.counselor, self.registrar, self.credentialer, self.postman]
         self.toRemove = list(doers)
-        doers.extend([doing.doify(self.confirmDo)])
+        doers.extend([doing.doify(self.joinDo)])
         self.auto = auto
-        super(ConfirmDoer, self).__init__(doers=doers)
+        super(JoinDoer, self).__init__(doers=doers)
 
-    def confirmDo(self, tymth, tock=0.0):
+    def joinDo(self, tymth, tock=0.0):
         """
         Parameters:
             tymth (function): injected function wrapper closure returned by .tymen() of
@@ -146,7 +151,7 @@ class ConfirmDoer(doing.DoDoer):
         self.remove(self.toRemove)
 
     def incept(self, attrs):
-        """ Incept group multisig
+        """ Join a group multisig inception event
 
         """
         said = attrs["d"]
@@ -177,8 +182,8 @@ class ConfirmDoer(doing.DoDoer):
         inits["isith"] = oicp.ked["kt"]
         inits["nsith"] = oicp.ked["nt"]
 
-        inits["estOnly"] = eventing.TraitCodex.EstOnly in oicp.ked["c"]
-        inits["DnD"] = eventing.TraitCodex.DoNotDelegate in oicp.ked["c"]
+        inits["estOnly"] = kering.TraitCodex.EstOnly in oicp.ked["c"]
+        inits["DnD"] = kering.TraitCodex.DoNotDelegate in oicp.ked["c"]
 
         inits["toad"] = oicp.ked["bt"]
         inits["wits"] = oicp.ked["b"]
@@ -196,17 +201,20 @@ class ConfirmDoer(doing.DoDoer):
 
         if approve:
             if self.auto:
-                alias = "test alias"
+                if self.group is None:
+                    group = "default-group"
+                else:
+                    group = self.group
             else:
                 while True:
-                    alias = input(f"\nEnter alias for new AID: ")
-                    if self.hby.habByName(alias) is not None:
-                        print(f"AID alias {alias} is already in use, please try again")
+                    group = input(f"\nEnter group name for new AID: ")
+                    if self.hby.habByName(group) is not None:
+                        print(f"AID group name {group} is already in use, please try again")
                     else:
                         break
 
             try:
-                ghab = self.hby.makeGroupHab(group=alias, mhab=mhab,
+                ghab = self.hby.makeGroupHab(group=group, mhab=mhab,
                                              smids=smids, rmids=rmids, **inits)
             except ValueError as e:
                 return False
@@ -393,19 +401,22 @@ class ConfirmDoer(doing.DoDoer):
                 ghab = self.hby.habs[pre]
             else:
                 if self.auto:
-                    alias = "test alias"
+                    if self.group is None:
+                        group = "default-group"
+                    else:
+                        group = self.group
                 else:
                     while True:
-                        alias = input(f"\nEnter alias for new AID: ")
-                        if self.hby.habByName(alias) is not None:
-                            print(f"AID alias {alias} is already in use, please try again")
+                        group = input(f"\nEnter group name for new AID: ")
+                        if self.hby.habByName(group) is not None:
+                            print(f"AID group name {group} is already in use, please try again")
                         else:
                             break
 
-                ghab = self.hby.joinGroupHab(pre, group=alias, mhab=mhab, smids=smids, rmids=rmids)
+                ghab = self.hby.joinGroupHab(pre, group=group, mhab=mhab, smids=smids, rmids=rmids)
 
             try:
-                ghab.rotate(serder=orot)
+                ghab.rotate(serder=orot, smids=smids, rmids=rmids)
             except ValueError:
                 return False
 

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/multisig/rotate.py

@@ -53,9 +53,9 @@ def rotateGroupIdentifier(args):
     """
 
     data = config.parseData(args.data) if args.data is not None else None
-
-    rotDoer = GroupMultisigRotate(name=args.name, base=args.base, alias=args.alias, smids=args.smids, rmids=args.rmids,
-                                  bran=args.bran, wits=args.witnesses, cuts=args.cuts, adds=args.witness_add,
+    hby = existing.setupHby(name=args.name, base=args.base, bran=args.bran)
+    rotDoer = GroupMultisigRotate(hby=hby, alias=args.alias, smids=args.smids, rmids=args.rmids,
+                                  wits=args.witnesses, cuts=args.cuts, adds=args.witness_add,
                                   isith=args.isith, nsith=args.nsith, toad=args.toad, data=data)
 
     doers = [rotDoer]
@@ -70,7 +70,7 @@ class GroupMultisigRotate(doing.DoDoer):
 
     """
 
-    def __init__(self, name, base, bran, alias, smids=None, rmids=None, isith=None, nsith=None,
+    def __init__(self, hby, alias, smids=None, rmids=None, isith=None, nsith=None,
                  toad=None, wits=None, cuts=None, adds=None, data: list = None):
 
         self.alias = alias
@@ -80,12 +80,12 @@ class GroupMultisigRotate(doing.DoDoer):
         self.smids = smids
         self.rmids = rmids
         self.data = data
+        self.hby = hby
 
         self.wits = wits if wits is not None else []
         self.cuts = cuts if cuts is not None else []
         self.adds = adds if adds is not None else []
 
-        self.hby = existing.setupHby(name=name, base=base, bran=bran)
         self.hbyDoer = habbing.HaberyDoer(habery=self.hby)  # setup doer
         notifier = Notifier(self.hby)
         mux = grouping.Multiplexor(self.hby, notifier=notifier)

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/nonce.py

@@ -8,7 +8,7 @@ import argparse
 import pysodium
 from hio.base import doing
 
-from keri.core import coring
+from keri.core import signing
 
 parser = argparse.ArgumentParser(description='Print a new random nonce')
 parser.set_defaults(handler=lambda args: handler(args))
@@ -23,4 +23,4 @@ def nonce(tymth, tock=0.0):
     """
     _ = (yield tock)
 
-    print(coring.randomNonce())
+    print(signing.Salter().qb64)

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/rotate.py

@@ -151,7 +151,7 @@ class RotateDoer(doing.DoDoer):
 
         self.hby = existing.setupHby(name=name, base=base, bran=bran)
         self.hbyDoer = habbing.HaberyDoer(habery=self.hby)  # setup doer
-        self.swain = delegating.Anchorer(hby=self.hby)
+        self.swain = delegating.Anchorer(hby=self.hby, proxy=self.hby.habByName(self.proxy))
         self.postman = forwarding.Poster(hby=self.hby)
         self.mbx = indirecting.MailboxDirector(hby=self.hby, topics=['/receipt', "/replay", "/reply"])
         doers = [self.hbyDoer, self.mbx, self.swain, self.postman, doing.doify(self.rotateDo)]
@@ -198,7 +198,7 @@ class RotateDoer(doing.DoDoer):
                 auths[wit] = f"{code}#{helping.nowIso8601()}"
 
         if hab.kever.delpre:
-            self.swain.delegation(pre=hab.pre, sn=hab.kever.sn, proxy=self.hby.habByName(self.proxy))
+            self.swain.delegation(pre=hab.pre, sn=hab.kever.sn)
             print("Waiting for delegation approval...")
             while not self.swain.complete(hab.kever.prefixer, coring.Seqner(sn=hab.kever.sn)):
                 yield self.tock

keri-1.2.0.dev3/src/keri/app/cli/commands/watcher/__init__.py

@@ -0,0 +1,6 @@
+# -*- encoding: utf-8 -*-
+"""
+KERI
+keri.app.cli.commands.watcher Package
+"""
+

keri-1.2.0.dev3/src/keri/app/cli/commands/watcher/add.py

@@ -0,0 +1,132 @@
+# -*- encoding: utf-8 -*-
+"""
+KERI
+keri.kli.commands module
+
+"""
+import argparse
+
+from hio import help
+from hio.base import doing
+
+from keri.app import connecting, habbing, forwarding
+from keri.app.cli.common import existing
+from keri.core import eventing, serdering
+
+logger = help.ogler.getLogger()
+
+parser = argparse.ArgumentParser(description='Add AID or Alias to list of AIDs for a watcher to watch')
+parser.set_defaults(handler=lambda args: add(args),
+                    transferable=True)
+parser.add_argument('--name', '-n', help='keystore name and file location of KERI keystore', required=True)
+parser.add_argument('--alias', '-a', help='human readable alias for the identifier to whom the credential was issued',
+                    required=True)
+parser.add_argument('--base', '-b', help='additional optional prefix to file location of KERI keystore',
+                    required=False, default="")
+parser.add_argument('--passcode', '-p', help='22 character encryption passcode for keystore (is not saved)',
+                    dest="bran", default=None)  # passcode => bran
+parser.add_argument("--watcher", '-w', help="the watcher AID or alias to add to", required=True)
+parser.add_argument("--watched", '-W', help="the watched AID or alias to add")
+
+
+def add(args):
+    """ Command line handler for adding an aid to a watcher's list of AIds to watch
+
+    Parameters:
+        args(Namespace): parsed command line arguments
+
+    """
+
+    ed = AddDoer(name=args.name,
+                 alias=args.alias,
+                 base=args.base,
+                 bran=args.bran,
+                 watcher=args.watcher,
+                 watched=args.watched)
+    return [ed]
+
+
+class AddDoer(doing.DoDoer):
+
+    def __init__(self, name, alias, base, bran, watcher, watched):
+        self.hby = existing.setupHby(name=name, base=base, bran=bran)
+        self.hab = self.hby.habByName(alias)
+        self.org = connecting.Organizer(hby=self.hby)
+
+        if watcher in self.hby.kevers:
+            wat = watcher
+        else:
+            wat = self.org.find("alias", watcher)
+            if len(wat) != 1:
+                raise ValueError(f"invalid recipient {watcher}")
+            wat = wat[0]['id']
+
+        if not wat:
+            raise ValueError(f"unknown watcher {watcher}")
+
+        if watched in self.hby.kevers:
+            watd = watched
+        else:
+            watd = self.org.find("alias", watched)
+            if len(watd) != 1:
+                raise ValueError(f"invalid recipient {watched}")
+            watd = watd[0]['id']
+
+        if not watd:
+            raise ValueError(f"unknown watched {watched}")
+
+        self.watcher = wat
+        self.watched = watd
+
+        self.oobi = None
+        for (key,), obr in self.hby.db.roobi.getItemIter():
+            if obr.cid == watd:
+                self.oobi = key
+
+        if not self.oobi:
+            raise ValueError(f"no valid oobi for watched {self.watched}")
+
+        doers = [doing.doify(self.addDo)]
+
+        super(AddDoer, self).__init__(doers=doers)
+
+    def addDo(self, tymth, tock=0.0):
+        """ Grant credential by creating /ipex/grant exn message
+
+        Parameters:
+            tymth (function): injected function wrapper closure returned by .tymen() of
+                Tymist instance. Calling tymth() returns associated Tymist .tyme.
+            tock (float): injected initial tock value
+
+        Returns:  doifiable Doist compatible generator method
+
+        """
+        # enter context
+        self.wind(tymth)
+        self.tock = tock
+        _ = (yield self.tock)
+
+        if isinstance(self.hab, habbing.GroupHab):
+            raise ValueError("watchers for multisig AIDs not currently supported")
+
+        postman = forwarding.StreamPoster(hby=self.hby, hab=self.hab, recp=self.watcher, topic="reply")
+        for msg in self.hab.db.clonePreIter(pre=self.hab.pre):
+            serder = serdering.SerderKERI(raw=msg)
+            postman.send(serder=serder, attachment=msg[serder.size:])
+
+        data = dict(cid=self.hab.pre,
+                    wid=self.watched,
+                    oobi=self.oobi)
+
+        route = "/watcher/aid/add"
+        msg = self.hab.reply(route=route, data=data)
+        rpy = serdering.SerderKERI(raw=msg)
+        postman.send(serder=rpy, attachment=msg[rpy.size:])
+
+        doer = doing.DoDoer(doers=postman.deliver())
+        self.extend([doer])
+
+        while not doer.done:
+            yield self.tock
+
+        print(f"Request to add {self.watched} to watcher {self.watcher} submitted.")

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/cli/commands/witness/authenticate.py

@@ -35,7 +35,10 @@ parser.add_argument("--witness", '-w', help="the witness AID or alias to authent
 
 
 def auth(args):
-    """ Command line list credential registries handler
+    """ Command line handler for authenticating  against a witness by retrieving the secret or a TOTP
+
+    Parameters:
+        args(Namespace): parsed command line arguments
 
     """
 
@@ -65,7 +68,7 @@ class AuthDoer(doing.DoDoer):
         if not wit:
             raise ValueError(f"unknown witness {witness}")
 
-        self.witness = witness
+        self.witness = wit
         self.clienter = httping.Clienter()
         doers = [doing.doify(self.authDo), self.clienter]
 

{keri-1.2.0.dev1 → keri-1.2.0.dev3}/src/keri/app/delegating.py

@@ -47,50 +47,30 @@ class Anchorer(doing.DoDoer):
         self.proxy = proxy
 
         super(Anchorer, self).__init__(doers=[self.witq, self.witDoer, self.postman, doing.doify(self.escrowDo)],
-                                     **kwa)
+                                       **kwa)
 
     def delegation(self, pre, sn=None, proxy=None):
         if pre not in self.hby.habs:
             raise kering.ValidationError(f"{pre} is not a valid local AID for delegation")
 
+        if proxy is not None:
+            self.proxy = proxy
+
         # load the hab of the delegated identifier to anchor
         hab = self.hby.habs[pre]
         delpre = hab.kever.delpre  # get the delegator identifier
         if delpre not in hab.kevers:
             raise kering.ValidationError(f"delegator {delpre} not found, unable to process delegation")
 
-        dkever = hab.kevers[delpre]  # and the delegator's kever
         sn = sn if sn is not None else hab.kever.sner.num
 
         # load the event and signatures
         evt = hab.makeOwnEvent(sn=sn)
 
-        smids = []
-        if isinstance(hab, GroupHab):
-            phab = hab.mhab
-            smids = hab.smids
-        elif proxy is not None:
-            phab = proxy
-        elif hab.kever.sn > 0:
-            phab = hab
-        elif self.proxy is not None:
-            phab = self.proxy
-        else:
-            raise kering.ValidationError("no proxy to send messages for delegation")
-
         # Send exn message for notification purposes
-        exn, atc = delegateRequestExn(phab, delpre=delpre, evt=bytes(evt), aids=smids)
-
-        self.postman.send(hab=phab, dest=hab.kever.delpre, topic="delegate", serder=exn, attachment=atc)
-
         srdr = serdering.SerderKERI(raw=evt)
-        del evt[:srdr.size]
-        self.postman.send(hab=phab, dest=delpre, topic="delegate", serder=srdr, attachment=evt)
-
-        seal = dict(i=srdr.pre, s=srdr.snh, d=srdr.said)
-        self.witq.query(hab=phab, pre=dkever.prefixer.qb64, anchor=seal)
-
-        self.hby.db.dune.pin(keys=(srdr.pre, srdr.said), val=srdr)
+        self.witDoer.msgs.append(dict(pre=pre, sn=srdr.sn))
+        self.hby.db.dpwe.pin(keys=(srdr.pre, srdr.said), val=srdr)
 
     def complete(self, prefixer, seqner, saider=None):
         """ Check for completed delegation protocol for the specific event
@@ -139,8 +119,8 @@ class Anchorer(doing.DoDoer):
             yield 0.5
 
     def processEscrows(self):
-        self.processUnanchoredEscrow()
         self.processPartialWitnessEscrow()
+        self.processUnanchoredEscrow()
 
     def processUnanchoredEscrow(self):
         """
@@ -159,11 +139,10 @@ class Anchorer(doing.DoDoer):
                 couple = seqner.qb64b + dserder.saidb
                 dgkey = dbing.dgKey(kever.prefixer.qb64b, kever.serder.saidb)
                 self.hby.db.setAes(dgkey, couple)  # authorizer event seal (delegator/issuer)
-                self.witDoer.msgs.append(dict(pre=pre, sn=serder.sn))
 
                 # Move to escrow waiting for witness receipts
-                logger.info(f"Waiting for fully signed witness receipts for {serder.sn}")
-                self.hby.db.dpwe.pin(keys=(pre, said), val=serder)
+                logger.info(f"Delegation approval received, {serder.pre} confirmed")
+                self.hby.db.cdel.put(keys=(pre, coring.Seqner(sn=serder.sn).qb64), val=coring.Saider(qb64=serder.said))
                 self.hby.db.dune.rem(keys=(pre, said))
 
     def processPartialWitnessEscrow(self):
@@ -188,9 +167,33 @@ class Anchorer(doing.DoDoer):
                             witnessed = True
                     if not witnessed:
                         continue
-                logger.info(f"Witness receipts complete, {pre} confirmed.")
+                logger.info(f"Witness receipts complete, waiting for delegation approval.")
+                hab = self.hby.habs[pre]
+                delpre = hab.kever.delpre  # get the delegator identifier
+                dkever = hab.kevers[delpre]  # and the delegator's kever
+                smids = []
+                if isinstance(hab, GroupHab):
+                    phab = hab.mhab
+                    smids = hab.smids
+                elif self.proxy is not None:
+                    phab = self.proxy
+                else:
+                    raise kering.ValidationError("no proxy to send messages for delegation")
+
+                evt = hab.db.cloneEvtMsg(pre=serder.pre, fn=0, dig=serder.said)
+                exn, atc = delegateRequestExn(phab, delpre=delpre, evt=bytes(evt), aids=smids)
+
+                self.postman.send(hab=phab, dest=hab.kever.delpre, topic="delegate", serder=exn, attachment=atc)
+
+                srdr = serdering.SerderKERI(raw=evt)
+                del evt[:srdr.size]
+                self.postman.send(hab=phab, dest=delpre, topic="delegate", serder=srdr, attachment=evt)
+
+                seal = dict(i=srdr.pre, s=srdr.snh, d=srdr.said)
+                self.witq.query(hab=phab, pre=dkever.prefixer.qb64, anchor=seal)
+
                 self.hby.db.dpwe.rem(keys=(pre, said))
-                self.hby.db.cdel.put(keys=(pre, seqner.qb64), val=coring.Saider(qb64=serder.said))
+                self.hby.db.dune.pin(keys=(srdr.pre, srdr.said), val=srdr)
 
 
 def loadHandlers(hby, exc, notifier):