regent-httpsig 0.6.0__tar.gz → 0.7.1__tar.gz

{regent_httpsig-0.6.0 → regent_httpsig-0.7.1}/CHANGELOG.md

@@ -1,5 +1,111 @@
 # Changelog
 
+## 0.7.1
+
+- Ship the `py.typed` marker: the package has been mypy-strict since 0.1, and
+  without the marker a strict consumer sees `import-untyped` on every import.
+
+## 0.7.0
+
+**AAuth -11 cut-over** (draft-hardt-oauth-aauth-protocol-11, published
+25 September 2026; Signature-Key -09; budgets editor's copy of 6 October). One
+dialect, as the editor asked: the -10 forms are gone, not kept behind a flag.
+Breaking for every AAuth signer and resource; Web Bot Auth is untouched.
+
+*Resource side (§11.3.4 — a typed answer for every refusal):*
+
+- **`HttpsigVerifier.verify_detailed()`** returns a `VerifiedSignature` or a
+  **`VerificationError`** carrying the Signature-Error code -11 assigns:
+  `invalid_signature`, `invalid_input` (+ `required_input`),
+  `unsupported_scheme` (+ `Accept-Signature-Scheme`), `unsupported_algorithm`
+  (+ `Accept-Signature-Alg`), `invalid_key`, `unknown_key`, `issuer_missing`,
+  `issuer_mismatch`, `invalid_jwt`, `expired_jwt`, `revoked_jwt`, `clock_skew`.
+  `error.headers()` is the 401's header set, `error.problem()` the
+  `application/problem+json` body (`type: urn:ietf:params:sig-error:<code>`).
+  `verify()` keeps its `None`-on-failure contract.
+- **Covered components are enforced** (§11.3.3.1): `@method @authority @path
+  signature-key`, plus `content-digest content-type` when the request has a
+  body — and the digest is checked against the body you pass. Missing
+  components are `invalid_input` with the full `required_input` list.
+- **`created` window** (§11.3.4 step 3): `HttpsigConfig.signature_window_seconds`
+  (default 60). Older than the window is `invalid_signature`; further ahead of
+  our clock is `clock_skew`; a past `expires` is `invalid_signature`. The
+  upstream library's 5-second skew rule no longer pre-empts these.
+- **RS-51 token time**: `exp` has no tolerance; `iat` is not a validity check
+  (only an `iat` beyond the window ahead is refused, as `clock_skew`); person
+  and auth tokens live at most **3600 s exactly** (the 90 s grace is gone);
+  `typ` is read first; an auth token's `dwk` must be `aauth-person.json` or
+  `aauth-access.json`.
+- **Fully-specified algorithms by default** (§11.3.1, RFC 9864):
+  `require_fully_specified_algs` is now `True`. The polymorphic `EdDSA` and a
+  `cnf.jwk` without `alg` are `unsupported_algorithm` with
+  `Accept-Signature-Alg: Ed25519, ES256, RS256`. A P-256 possession key
+  (ES256) now verifies. The flag stays only for private test rigs.
+- **The `jwks_uri` server scheme** (§11.3.2, Signature-Key §3.6):
+  `sig=jwks_uri;id="…";dwk="aauth-person.json";kid="…"` — the metadata
+  document at `{id}/.well-known/{dwk}` must name `issuer == id`
+  (`issuer_mismatch`), its `jwks_uri` is followed, the `kid` found (one
+  refetch on rotation, then `unknown_key`). `verify_server()` is the
+  entry point for usage and revocation endpoints; `trusted_ps` may pin a
+  JWKS URL or `""` to discover it.
+- **Revocation hook**: `HttpsigVerifier(is_revoked=meter.is_revoked)` — a
+  token the application has on record as revoked is answered `revoked_jwt`
+  (RS-43, §11.12.5), never "invalid" or "expired".
+- **RS-52**: agent identifiers compare exactly; no case folding (test pinned).
+
+*FastAPI layer:*
+
+- `RequiredSignatureDep` answers a failed signature with `401` +
+  `Signature-Error` (+ `Accept-Signature-*`, + `AAuth-Requirement:
+  requirement=person-token` for a revoked/expired person or auth token) and a
+  problem+json body; an unsigned request gets `AAuth-Requirement:
+  requirement=agent-token` (§6.1). New `SignatureErrorDep`,
+  `RequiredServerSignatureDep`, `signature_error_response()`.
+- `BudgetMiddleware`: a **revoked** auth token is `revoked_jwt` +
+  `requirement=person-token`, with **no resource token** (the PS would reject
+  one naming a revoked token) and no `AAuth-Budget`; an **expired** auth token
+  is `expired_jwt` + `requirement=person-token` the same way (budgets editor's
+  copy, 6 October). The 0.5.1 final-record challenge and
+  `allow_expired_auth_token` are removed — the final figure reaches the
+  issuer through the usage endpoint. Any other signed-but-failing request on
+  a priced route is refused with `Signature-Error` instead of being treated
+  as unsigned.
+
+*Revocation endpoint (RS-60, §11.12):*
+
+- `make_revocation_endpoint`: the body is **`{"jti", "exp"}`**; the issuer
+  comes from the caller's verified server signature, never from the body.
+  The pair is recorded whether or not the token was ever seen here; the
+  answer is always an empty `200` — **no 404**. Errors are problem+json:
+  `invalid_request` 400 (incl. `exp` beyond `max_token_lifetime` + skew),
+  `unsupported_iss` 403 (`accepted_issuers=` predicate), a failed signature
+  401 + `Signature-Error`.
+- `InMemoryMeter.record_revocation(iss, jti, exp)` and `is_revoked(iss, jti)`;
+  entries live until `exp` + 60 s. `revoke()` remains for tokens the meter
+  holds.
+- `make_usage_endpoint` / `make_revocation_endpoint` accept an
+  `authenticate_ps` that returns a `VerifiedSignature`, an issuer string, a
+  `VerificationError` or `None`; refusals are 401 + `Signature-Error`.
+
+*Signers:*
+
+- **`EgressSigner.sign_aauth(method, url, headers, token=…, body=…)`**: the
+  -11 agent signature — `Signature-Key: sig=jwt;jwt="…"`, the required
+  components (+ body components with a computed `Content-Digest`), `created`
+  only, no `keyid`. `EgressSigner.public_jwk` now carries `alg: Ed25519`
+  (RFC 9864) for `cnf.jwk`; the Web Bot Auth directory is unchanged.
+- **`ServerSigner(seed, server_id, dwk)`**: the jwks_uri scheme for a PS/AS
+  (or a resource) calling another server; `.jwks()` is what to publish.
+- **`ResponseSigner(seed, server_id, dwk="aauth-resource.json")`** emits the
+  -11 `Signature-Key` form; the `jwks_url` form is gone. Golden vectors
+  regenerated.
+- `sign_request()`, `content_digest()`, `parse_signature_key()`,
+  `parse_signature_input()`, `build_person_token_requirement()` exported.
+
+Dropped: `allow_expired_auth_token`, `VerifiedSignature.expired`,
+`EXPIRED_AUTH_TOKEN_GRACE`, `ResponseSigner(jwks_url=)`, the `{iss, jti}`
+revocation body, the 90 s lifetime grace, `EdDSA` by default.
+
 ## 0.6.0
 
 **Budgets — revocation reaches the meter** (base protocol §Token Revocation,

regent_httpsig-0.7.1/CONTRIBUTING.md

@@ -0,0 +1,11 @@
+# Contributing
+
+Issues and pull requests are welcome. A few things make review faster.
+
+- Say which specification and revision a change targets: RFC 9421, a Web Bot Auth draft revision, or an AAuth draft revision. The library tracks revisions published on the IETF datatracker.
+- Add or update a test for any wire-level change: a known-good signature or a request that must fail, next to the existing tests under `tests/`.
+- Keep the dependency tree as it is unless the change needs a new one; say why in the pull request.
+- Run `ruff check` and the test suite before opening the pull request; CI runs both.
+- Security problems go to the address in SECURITY.md, not to a public issue.
+
+Interoperability reports are as useful as code: if the library fails against a real signer or verifier, an issue with the raw request and the expected result is a contribution.

regent_httpsig-0.7.1/GOVERNANCE.md

@@ -0,0 +1,35 @@
+# Governance
+
+regent-httpsig is a small library with a small governance model. This file says who decides what, how a contributor becomes a maintainer, and how this file itself changes.
+
+## Roles
+
+**Contributor.** Anyone who opens an issue or a pull request. No agreement to sign beyond the Apache-2.0 licence of the repository; by submitting a change you licence it under the same terms.
+
+**Maintainer.** Has the commit bit, reviews and merges pull requests, cuts releases to PyPI, and answers security reports under SECURITY.md. Maintainers are listed in MAINTAINERS.md with their affiliation.
+
+**Security contact.** The address in SECURITY.md. Today it is the maintainer.
+
+## Decisions
+
+Changes land through pull requests with a green CI run. A pull request needs approval from one maintainer who is not its author; while there is a single maintainer, that maintainer's own changes are held for 48 hours before merge so that anyone can object on the pull request.
+
+Anything that changes the wire behaviour of the library, the set of supported drafts, or a public API is announced in the pull request title with the draft revision it targets, and recorded in CHANGELOG.md.
+
+The library implements external specifications: RFC 9421, the Web Bot Auth drafts, and the AAuth drafts. It does not define its own. Where a draft revision changes behaviour, the library tracks the revision published on the IETF datatracker, not the editor's copy, and the version number in CHANGELOG.md names the revision it targets.
+
+Disagreements are resolved on the pull request. If maintainers cannot agree, the change does not merge.
+
+## Becoming a maintainer
+
+A contributor becomes a maintainer after three merged pull requests of substance over at least sixty days, a nomination by an existing maintainer on a public issue, and no objection from other maintainers within fourteen days. A maintainer from a different organization than the existing maintainers is explicitly welcome; the project's stated goal is at least two maintainers from two organizations.
+
+A maintainer who has not reviewed or merged anything for six months is moved to emeritus in MAINTAINERS.md and can return by asking on an issue.
+
+## Releases
+
+Any maintainer can cut a release. Versions follow semantic versioning; a change of targeted draft revision is at least a minor version. Releases are published to PyPI from CI through trusted publishing; no maintainer holds a long-lived PyPI token.
+
+## Changing this file
+
+Changes to this file follow the same pull request process, with a fourteen-day comment period announced on an issue.

regent_httpsig-0.7.1/MAINTAINERS.md

@@ -0,0 +1,11 @@
+# Maintainers
+
+| Name | GitHub | Affiliation | Since |
+|---|---|---|---|
+| Abay Aubakirov | abay94 | Regent Protocol | 2026-08-17 |
+
+The project is looking for a second maintainer from another organization. See GOVERNANCE.md for how that works and open an issue titled "maintainer: <your name>" if you are interested.
+
+## Emeritus
+
+None.

{regent_httpsig-0.6.0 → regent_httpsig-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: regent-httpsig
-Version: 0.6.0
+Version: 0.7.1
 Summary: Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth.
 Project-URL: Homepage, https://github.com/regent-protocol/regent-httpsig
 Project-URL: Repository, https://github.com/regent-protocol/regent-httpsig
@@ -64,13 +64,20 @@ No FastAPI? The core has no framework dependencies:
 
 ```python
 verifier = HttpsigVerifier()
-sig = await verifier.verify(method, url, headers)   # VerifiedSignature | None
+sig = await verifier.verify(method, url, headers)            # VerifiedSignature | None
+out = await verifier.verify_detailed(method, url, headers, body)
+# VerifiedSignature | VerificationError(code="expired_jwt", …) | None
 ```
 
 Verification is **enrichment by default**: no `Signature` header costs nothing, a bad
-signature yields `None`, and nothing ever raises on untrusted input. Use
+signature yields `None`, and nothing ever raises on untrusted input. `verify_detailed()`
+says *why* with the `Signature-Error` code of draft-hardt-httpbis-signature-key exactly
+as AAuth -11 §11.3.4 assigns it (`invalid_signature`, `invalid_input`, `unsupported_scheme`,
+`unsupported_algorithm`, `invalid_key`, `unknown_key`, `issuer_missing`, `issuer_mismatch`,
+`invalid_jwt`, `expired_jwt`, `revoked_jwt`, `clock_skew`); `error.headers()` is the 401's
+header set and `error.problem()` its problem+json body. Use
 `regent_httpsig.fastapi.RequiredSignatureDep` when a signature must be present — the 401
-tells the agent exactly how to sign.
+carries that header, or `AAuth-Requirement: requirement=agent-token` when nothing was signed.
 
 > **Behind a reverse proxy?** The agent signed the *public* URL
 > (`https://api.example/…`), but your ASGI server sees `http://container/…`. The FastAPI
@@ -98,6 +105,18 @@ regent-httpsig keygen --agent https://myagent.example --out ./well-known/
 Publish the directory at `https://myagent.example/.well-known/http-message-signatures-directory`
 and every Web Bot Auth verifier on the internet can now identify your agent.
 
+The same key signs as an **AAuth agent** (-11 §11.3.3) — the token in `Signature-Key`,
+the required components covered, `Content-Digest` computed when there is a body:
+
+```python
+headers = signer.sign_aauth("POST", url, {"content-type": "application/json"},
+                            token=agent_token, body=raw_body)
+```
+
+and a **server** (a PS or AS calling a resource's usage or revocation endpoint, §11.3.2)
+signs under the `jwks_uri` scheme with `ServerSigner(seed=…, server_id="https://ps.example",
+dwk="aauth-person.json")` — publish `.jwks()` at your metadata document's `jwks_uri`.
+
 ## What exactly is verified
 
 | Check | Status |
@@ -106,7 +125,9 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth draft -05 A.2.2 — sf-dictionary `Signature-Agent` covered with `;key=` | ✅ in CI¹ |
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
-| AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| AAuth -11 agent / person / auth tokens (`cnf.jwk` proof of possession, required components, body digest, 60 s `created` window, RS-51 token time, fully-specified algs, Ed25519 + ES256 possession keys) | ✅ in CI |
+| AAuth -11 server scheme (`jwks_uri` with `id`/`dwk`/`kid`, `issuer_mismatch`, key rotation refetch) | ✅ in CI |
+| Every -11 §11.3.4 Signature-Error code, `revoked_jwt` via the revocation record, RS-52 case-exact ids | ✅ in CI |
 | Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
@@ -128,12 +149,16 @@ keyid-less shape is pinned in CI.
   `{Signature-Agent}/.well-known/http-message-signatures-directory`. Both wire forms of
   `Signature-Agent` are accepted — the current sf-dictionary and the legacy bare sf-string
   OpenAI actually sends.
-- **AAuth** (`draft-hardt-oauth-aauth-protocol`, identity-based mode): the agent carries a
-  JWT `agent_token` in `Signature-Key`; the issuer's JWKS verifies the token, the token's
-  `cnf.jwk` verifies the request signature. Install with `pip install 'regent-httpsig[aauth]'`.
-  Tracks the **-11 editor's copy**: fully-specified algorithms (RFC 9864, `Ed25519` — with a
-  transition flag for the -10 ecosystem's `EdDSA`) and **person tokens** (`aa-person+jwt`,
-  opt-in via `HttpsigConfig.resource_url`).
+- **AAuth** (`draft-hardt-oauth-aauth-protocol-11`): the agent carries its token in
+  `Signature-Key` under the `jwt` scheme — an agent token (`aa-agent+jwt`), a person token
+  (`aa-person+jwt`, opt-in via `HttpsigConfig.resource_url`) or an auth token
+  (`aa-auth+jwt`, pinned via `trusted_ps`); the issuer's JWKS, discovered through
+  `{iss}/.well-known/{dwk}`, verifies the token, the token's `cnf.jwk` verifies the request
+  signature. Servers sign under `jwks_uri` (`id`/`dwk`/`kid`). Install with
+  `pip install 'regent-httpsig[aauth]'`. 0.7.0 is the **-11 cut-over** — one dialect, as
+  published: fully-specified algorithms only (RFC 9864; `EdDSA` is refused), the required
+  covered components, the 60-second `created` window, no tolerance on `exp`, revoked tokens
+  named as revoked. `require_fully_specified_algs=False` survives for private test rigs only.
   For a full-protocol AAuth implementation (both roles, all token types) see
   [christian-posta/aauth-python-library](https://github.com/christian-posta/aauth-python-library) —
   this library is the thin relying-party verifier that handles both dialects.
@@ -174,14 +199,18 @@ production on [get4agent.com](https://get4agent.com).
 
 - `insufficient-budget` refusals carry **`required`** — the refused request's
   maximum cost — so the agent lowers its bound and retries instead of guessing.
-- **Revocation**: `make_revocation_endpoint(meter, authenticate_ps=…)` is the
-  base protocol's endpoint; a revoked token stops spending at once, in-flight
-  requests complete, and its final record rides on the next challenge.
-- An **expired** auth token gets the base protocol's plain challenge with a
-  resource token carrying that token's **final** consumption record — the
-  figure its issuer needs to settle the allocation (a record stated at or
-  after `exp` is final; one on a live token is a snapshot and releases
-  nothing).
+- **Revocation** (-11 §11.12): `make_revocation_endpoint(meter, authenticate_ps=…)`
+  takes the signed `POST {"jti", "exp"}`, keys the record by the caller's
+  verified identity, answers an empty `200` always (no 404) and problem+json
+  `invalid_request` / `unsupported_iss`. A revoked token stops spending at
+  once, in-flight requests complete, and a later presentation is answered
+  `401` + `Signature-Error: error=revoked_jwt` + `AAuth-Requirement:
+  requirement=person-token` — no resource token (§11.12.5). Wire
+  `HttpsigVerifier(is_revoked=meter.is_revoked)` so the verifier names it first.
+- An **expired** auth token is answered the same way with `expired_jwt`
+  (budgets editor's copy, 6 October): nothing is served or metered, and the
+  token's final consumption record reaches its issuer through the usage
+  endpoint, not on the challenge.
 - **Streaming** responses run in the draft's cost-omitted mode: `reserved` in
   the header, commit when the stream ends (set `request.state.budget_cost`
   mid-stream if you learn the actual), and the agent recovers the exact cost
@@ -193,11 +222,15 @@ production on [get4agent.com](https://get4agent.com).
 ```python
 from regent_httpsig import InMemoryMeter, ResponseSigner, make_usage_endpoint
 
+async def authenticate_ps(request):          # the PS signs as a server, §11.3.2
+    return await verifier.verify_server(request.method, str(request.url),
+                                        dict(request.headers), await request.body())
+
 handler = make_usage_endpoint(
     meter,
-    authenticate_ps=my_ps_authenticator,   # verify the PS's jwks_uri signature
+    authenticate_ps=authenticate_ps,
     unit="USD", decimals=6,
-    signer=ResponseSigner(seed=SEED, jwks_url="https://api.example/jwks.json"),
+    signer=ResponseSigner(seed=SEED, server_id="https://api.example"),  # dwk aauth-resource.json
 )
 
 @app.post("/usage")
@@ -241,9 +274,12 @@ from regent_httpsig import HttpsigConfig, HttpsigVerifier
 
 verifier = HttpsigVerifier(HttpsigConfig(
     trusted_agents=frozenset({"https://chatgpt.com", "https://operator.openai.com"}),
-    max_age_hours=25,       # reject signatures created earlier than this
-    cache_ttl=600,          # key-directory cache seconds
-))
+    max_age_hours=25,              # Web Bot Auth: reject signatures created earlier than this
+    signature_window_seconds=60,   # AAuth -11: the `created` window (advertise as signature_window)
+    resource_url="https://api.example",                    # accept person / auth tokens for us
+    trusted_ps={"https://ps.example": ""},                 # pinned issuers ("" = discover the JWKS)
+    cache_ttl=600,                 # key-directory cache seconds
+), is_revoked=meter.is_revoked)    # optional: name revoked tokens as revoked
 ```
 
 Pass your app's shared client to reuse its pool: `HttpsigVerifier(http_client=my_async_client)`.
@@ -252,9 +288,13 @@ Pass your app's shared client to reuse its pool: `HttpsigVerifier(http_client=my
 
 - Web Bot Auth and AAuth are **IETF drafts** (RFC 9421 itself is a final standard). We track
   the drafts; breaking draft changes land as minor releases while we're 0.x.
-- **Ed25519 only** for now — it's what the agent ecosystem ships.
-- Body coverage (`content-digest`) is verified when covered by the signature, but this
-  library does not require it; decide per-route whether you need it.
+- Web Bot Auth is **Ed25519 only** — it's what the agent ecosystem ships. AAuth
+  possession keys may be Ed25519 or P-256 (ES256); RS256 is accepted for issuer keys.
+- On the AAuth path a request with a body **must** cover `content-digest` and
+  `content-type` (-11 §11.3.3.1) and the digest is checked against the body you pass;
+  the FastAPI layer reads the body for you. Web Bot Auth keeps its per-route choice.
+- Not in 0.7.0: issuing person/resource tokens, missions, the `202` deferred
+  `requirement=auth-token`, federated mode — the PS half of the protocol.
 
 ## Related projects
 

{regent_httpsig-0.6.0 → regent_httpsig-0.7.1}/README.md

@@ -34,13 +34,20 @@ No FastAPI? The core has no framework dependencies:
 
 ```python
 verifier = HttpsigVerifier()
-sig = await verifier.verify(method, url, headers)   # VerifiedSignature | None
+sig = await verifier.verify(method, url, headers)            # VerifiedSignature | None
+out = await verifier.verify_detailed(method, url, headers, body)
+# VerifiedSignature | VerificationError(code="expired_jwt", …) | None
 ```
 
 Verification is **enrichment by default**: no `Signature` header costs nothing, a bad
-signature yields `None`, and nothing ever raises on untrusted input. Use
+signature yields `None`, and nothing ever raises on untrusted input. `verify_detailed()`
+says *why* with the `Signature-Error` code of draft-hardt-httpbis-signature-key exactly
+as AAuth -11 §11.3.4 assigns it (`invalid_signature`, `invalid_input`, `unsupported_scheme`,
+`unsupported_algorithm`, `invalid_key`, `unknown_key`, `issuer_missing`, `issuer_mismatch`,
+`invalid_jwt`, `expired_jwt`, `revoked_jwt`, `clock_skew`); `error.headers()` is the 401's
+header set and `error.problem()` its problem+json body. Use
 `regent_httpsig.fastapi.RequiredSignatureDep` when a signature must be present — the 401
-tells the agent exactly how to sign.
+carries that header, or `AAuth-Requirement: requirement=agent-token` when nothing was signed.
 
 > **Behind a reverse proxy?** The agent signed the *public* URL
 > (`https://api.example/…`), but your ASGI server sees `http://container/…`. The FastAPI
@@ -68,6 +75,18 @@ regent-httpsig keygen --agent https://myagent.example --out ./well-known/
 Publish the directory at `https://myagent.example/.well-known/http-message-signatures-directory`
 and every Web Bot Auth verifier on the internet can now identify your agent.
 
+The same key signs as an **AAuth agent** (-11 §11.3.3) — the token in `Signature-Key`,
+the required components covered, `Content-Digest` computed when there is a body:
+
+```python
+headers = signer.sign_aauth("POST", url, {"content-type": "application/json"},
+                            token=agent_token, body=raw_body)
+```
+
+and a **server** (a PS or AS calling a resource's usage or revocation endpoint, §11.3.2)
+signs under the `jwks_uri` scheme with `ServerSigner(seed=…, server_id="https://ps.example",
+dwk="aauth-person.json")` — publish `.jwks()` at your metadata document's `jwks_uri`.
+
 ## What exactly is verified
 
 | Check | Status |
@@ -76,7 +95,9 @@ and every Web Bot Auth verifier on the internet can now identify your agent.
 | Web Bot Auth draft -05 A.2.2 — sf-dictionary `Signature-Agent` covered with `;key=` | ✅ in CI¹ |
 | Web Bot Auth A.2.3 — legacy sf-string form (**what OpenAI ships in production**) | ✅ in CI |
 | Sign → verify roundtrip (fresh keys, full pipeline) | ✅ in CI |
-| AAuth identity-mode roundtrip (`aa-agent+jwt` + `cnf.jwk` proof of possession) | ✅ in CI |
+| AAuth -11 agent / person / auth tokens (`cnf.jwk` proof of possession, required components, body digest, 60 s `created` window, RS-51 token time, fully-specified algs, Ed25519 + ES256 possession keys) | ✅ in CI |
+| AAuth -11 server scheme (`jwks_uri` with `id`/`dwk`/`kid`, `issuer_mismatch`, key rotation refetch) | ✅ in CI |
+| Every -11 §11.3.4 Signature-Error code, `revoked_jwt` via the revocation record, RS-52 case-exact ids | ✅ in CI |
 | Signed by [`aauth-signing`](https://github.com/christian-posta/aauth-python-library) (jwt scheme, keyid-less) → verified | ✅² |
 | Tampered request / expired signature / wrong directory key rejected | ✅ in CI |
 
@@ -98,12 +119,16 @@ keyid-less shape is pinned in CI.
   `{Signature-Agent}/.well-known/http-message-signatures-directory`. Both wire forms of
   `Signature-Agent` are accepted — the current sf-dictionary and the legacy bare sf-string
   OpenAI actually sends.
-- **AAuth** (`draft-hardt-oauth-aauth-protocol`, identity-based mode): the agent carries a
-  JWT `agent_token` in `Signature-Key`; the issuer's JWKS verifies the token, the token's
-  `cnf.jwk` verifies the request signature. Install with `pip install 'regent-httpsig[aauth]'`.
-  Tracks the **-11 editor's copy**: fully-specified algorithms (RFC 9864, `Ed25519` — with a
-  transition flag for the -10 ecosystem's `EdDSA`) and **person tokens** (`aa-person+jwt`,
-  opt-in via `HttpsigConfig.resource_url`).
+- **AAuth** (`draft-hardt-oauth-aauth-protocol-11`): the agent carries its token in
+  `Signature-Key` under the `jwt` scheme — an agent token (`aa-agent+jwt`), a person token
+  (`aa-person+jwt`, opt-in via `HttpsigConfig.resource_url`) or an auth token
+  (`aa-auth+jwt`, pinned via `trusted_ps`); the issuer's JWKS, discovered through
+  `{iss}/.well-known/{dwk}`, verifies the token, the token's `cnf.jwk` verifies the request
+  signature. Servers sign under `jwks_uri` (`id`/`dwk`/`kid`). Install with
+  `pip install 'regent-httpsig[aauth]'`. 0.7.0 is the **-11 cut-over** — one dialect, as
+  published: fully-specified algorithms only (RFC 9864; `EdDSA` is refused), the required
+  covered components, the 60-second `created` window, no tolerance on `exp`, revoked tokens
+  named as revoked. `require_fully_specified_algs=False` survives for private test rigs only.
   For a full-protocol AAuth implementation (both roles, all token types) see
   [christian-posta/aauth-python-library](https://github.com/christian-posta/aauth-python-library) —
   this library is the thin relying-party verifier that handles both dialects.
@@ -144,14 +169,18 @@ production on [get4agent.com](https://get4agent.com).
 
 - `insufficient-budget` refusals carry **`required`** — the refused request's
   maximum cost — so the agent lowers its bound and retries instead of guessing.
-- **Revocation**: `make_revocation_endpoint(meter, authenticate_ps=…)` is the
-  base protocol's endpoint; a revoked token stops spending at once, in-flight
-  requests complete, and its final record rides on the next challenge.
-- An **expired** auth token gets the base protocol's plain challenge with a
-  resource token carrying that token's **final** consumption record — the
-  figure its issuer needs to settle the allocation (a record stated at or
-  after `exp` is final; one on a live token is a snapshot and releases
-  nothing).
+- **Revocation** (-11 §11.12): `make_revocation_endpoint(meter, authenticate_ps=…)`
+  takes the signed `POST {"jti", "exp"}`, keys the record by the caller's
+  verified identity, answers an empty `200` always (no 404) and problem+json
+  `invalid_request` / `unsupported_iss`. A revoked token stops spending at
+  once, in-flight requests complete, and a later presentation is answered
+  `401` + `Signature-Error: error=revoked_jwt` + `AAuth-Requirement:
+  requirement=person-token` — no resource token (§11.12.5). Wire
+  `HttpsigVerifier(is_revoked=meter.is_revoked)` so the verifier names it first.
+- An **expired** auth token is answered the same way with `expired_jwt`
+  (budgets editor's copy, 6 October): nothing is served or metered, and the
+  token's final consumption record reaches its issuer through the usage
+  endpoint, not on the challenge.
 - **Streaming** responses run in the draft's cost-omitted mode: `reserved` in
   the header, commit when the stream ends (set `request.state.budget_cost`
   mid-stream if you learn the actual), and the agent recovers the exact cost
@@ -163,11 +192,15 @@ production on [get4agent.com](https://get4agent.com).
 ```python
 from regent_httpsig import InMemoryMeter, ResponseSigner, make_usage_endpoint
 
+async def authenticate_ps(request):          # the PS signs as a server, §11.3.2
+    return await verifier.verify_server(request.method, str(request.url),
+                                        dict(request.headers), await request.body())
+
 handler = make_usage_endpoint(
     meter,
-    authenticate_ps=my_ps_authenticator,   # verify the PS's jwks_uri signature
+    authenticate_ps=authenticate_ps,
     unit="USD", decimals=6,
-    signer=ResponseSigner(seed=SEED, jwks_url="https://api.example/jwks.json"),
+    signer=ResponseSigner(seed=SEED, server_id="https://api.example"),  # dwk aauth-resource.json
 )
 
 @app.post("/usage")
@@ -211,9 +244,12 @@ from regent_httpsig import HttpsigConfig, HttpsigVerifier
 
 verifier = HttpsigVerifier(HttpsigConfig(
     trusted_agents=frozenset({"https://chatgpt.com", "https://operator.openai.com"}),
-    max_age_hours=25,       # reject signatures created earlier than this
-    cache_ttl=600,          # key-directory cache seconds
-))
+    max_age_hours=25,              # Web Bot Auth: reject signatures created earlier than this
+    signature_window_seconds=60,   # AAuth -11: the `created` window (advertise as signature_window)
+    resource_url="https://api.example",                    # accept person / auth tokens for us
+    trusted_ps={"https://ps.example": ""},                 # pinned issuers ("" = discover the JWKS)
+    cache_ttl=600,                 # key-directory cache seconds
+), is_revoked=meter.is_revoked)    # optional: name revoked tokens as revoked
 ```
 
 Pass your app's shared client to reuse its pool: `HttpsigVerifier(http_client=my_async_client)`.
@@ -222,9 +258,13 @@ Pass your app's shared client to reuse its pool: `HttpsigVerifier(http_client=my
 
 - Web Bot Auth and AAuth are **IETF drafts** (RFC 9421 itself is a final standard). We track
   the drafts; breaking draft changes land as minor releases while we're 0.x.
-- **Ed25519 only** for now — it's what the agent ecosystem ships.
-- Body coverage (`content-digest`) is verified when covered by the signature, but this
-  library does not require it; decide per-route whether you need it.
+- Web Bot Auth is **Ed25519 only** — it's what the agent ecosystem ships. AAuth
+  possession keys may be Ed25519 or P-256 (ES256); RS256 is accepted for issuer keys.
+- On the AAuth path a request with a body **must** cover `content-digest` and
+  `content-type` (-11 §11.3.3.1) and the digest is checked against the body you pass;
+  the FastAPI layer reads the body for you. Web Bot Auth keeps its per-route choice.
+- Not in 0.7.0: issuing person/resource tokens, missions, the `202` deferred
+  `requirement=auth-token`, federated mode — the PS half of the protocol.
 
 ## Related projects
 

{regent_httpsig-0.6.0 → regent_httpsig-0.7.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "regent-httpsig"
-version = "0.6.0"
+version = "0.7.1"
 description = "Verify and sign AI agent HTTP traffic in Python — RFC 9421 HTTP Message Signatures: Web Bot Auth (what OpenAI ships) and AAuth."
 readme = "README.md"
 license = "Apache-2.0"

{regent_httpsig-0.6.0 → regent_httpsig-0.7.1}/src/regent_httpsig/__init__.py

@@ -18,9 +18,19 @@ from regent_httpsig.netguard import NotPublicURL, assert_public_url
 from regent_httpsig.sfv import (
     build_aauth_budget_header,
     build_aauth_requirement,
+    build_person_token_requirement,
     parse_signature_agent,
+    parse_signature_input,
+    parse_signature_key,
+)
+from regent_httpsig.sign import (
+    DIRECTORY_MEDIA_TYPE,
+    EgressSigner,
+    ServerSigner,
+    content_digest,
+    generate_seed,
+    sign_request,
 )
-from regent_httpsig.sign import DIRECTORY_MEDIA_TYPE, EgressSigner, generate_seed
 from regent_httpsig.usage import (
     ResponseSigner,
     UsageQueryError,
@@ -30,9 +40,14 @@ from regent_httpsig.usage import (
     parse_usage_request,
     validate_budget_grant,
 )
-from regent_httpsig.verify import WBA_TAG, HttpsigVerifier, VerifiedSignature
+from regent_httpsig.verify import (
+    WBA_TAG,
+    HttpsigVerifier,
+    VerificationError,
+    VerifiedSignature,
+)
 
-__version__ = "0.6.0"
+__version__ = "0.7.1"
 
 __all__ = [
     "DIRECTORY_MEDIA_TYPE",
@@ -46,7 +61,14 @@ __all__ = [
     "InvalidBudgetClaim",
     "NotPublicURL",
     "UnitMismatch",
+    "VerificationError",
     "VerifiedSignature",
+    "ServerSigner",
+    "content_digest",
+    "sign_request",
+    "build_person_token_requirement",
+    "parse_signature_input",
+    "parse_signature_key",
     "WBA_TAG",
     "__version__",
     "assert_public_url",