Skip to content

v0.3

Choose a tag to compare

View all tags
@thinksyncs thinksyncs released this 23 Jun 06:40
· 148 commits to main since this release
v0.3
94f2b16

Summary

v0.3 hardens the Session-Bound Agent Identity profile around byte-level L2 binding, replay handling, key namespace rules, and conservative authorization comparison.

Changes

  • Define the L2 binding construction with TLS exporter hash, exporter label, context bytes, attestation binder semantics, reuse rules, and negative cases.
  • Require replay cache configuration for JWT/CWT one-shot acceptance APIs.
  • Include TLS exporter and request-context hashes in replay keys.
  • Default L6 set comparison to exact matching.
  • Split gateway-routed and HTTP cache guidance into separate profile documents.
  • Add an L2 binding test vector and borrowed TLS exporter red-team coverage.
  • Stabilize environment-sensitive local test paths and regenerate SSOT.pdf.

Testing

  • GitHub Actions passed for PR #28 before merge: lint, live-red-team, matrix tests, and upload-coverage.
  • Local checks included go test -count=1 ./..., git diff --check, pdflatex, pdfinfo, and PDF render inspection.

Notes

  • Gateway-routed mode remains post-v0.3 design work.
  • Hardware-generated confidential-VM evidence remains outside the dependency-free local test profile.
Assets 2
Loading