feat: Gap Remediation Round 2 — server middleware, call chaining, observability, Guided Tour multi-agent flow#17
Merged
Conversation
- Re-validated all 11 gaps against spec and SDK (2026-05-25) - Added spec-level observations from deep read (research §8) - Added implementation decisions and act claim enforcement to Phase 1 - Expanded audience resolution logic in Phase 2 - Added routing table for call chaining in Phase 5
- GuidedTour: jkt-jwt signing mode, Prefer header, optional ECDSA - AgentConsole: jkt-jwt mode, prefer-wait, upstream-token flags - SampleApp: mini resource server + 3 new Blazor pages for server-side demos - Docs: 6 new files, 14 existing files updated across all gaps
…integration tests
…challenge handling
- Updated PendingStore and Program to accept IAAuthKey instead of AAuthKey. - Modified DefaultSignatureKeyResolver to utilize MetadataClient for jkt-jwt verification. - Enhanced JwksClient to resolve keys as IAAuthKey. - Introduced KeyFactory for creating IAAuthKey instances from JWKs. - Updated TokenVerifier and AuthTokenBuilder to work with IAAuthKey. - Added comprehensive tests for jkt-jwt and ECDSA key handling.
…mance tests for Prefer: wait=N header
… observability features
…er verification - Refactored ActivityDiagnosticsTests to use AAuthVerificationOptions. - Added AAuthVerificationMiddleware to handle HTTP signature verification and JWT issuer verification in a single pass. - Created AAuthVerificationOptions for middleware configuration, including trusted issuers and resource identifier. - Developed comprehensive unit tests for AAuthVerificationMiddleware to ensure correct behavior for various scenarios, including valid and invalid tokens, issuer verification, and missing claims.
…r/client code - Updated Hwk.razor to include client and server code for HWK pseudonymous access. - Enhanced JwksUri.razor with client and server code for JWKS URI agent identity access. - Improved Jwt.razor to demonstrate enrollment and token handling for three-party JWT access. - Refactored Program.cs to remove unnecessary AAuth server-side services and middleware. - Deleted ResourceEndpoints.cs as its functionality is now integrated into the main application. - Added orchestrator sample with full implementation for multi-agent call chaining. - Introduced CallChain.razor to demonstrate multi-hop delegation from Agent A to Orchestrator and WhoAmI. - Updated appsettings.json files across samples to include orchestrator configuration. - Enhanced AAuthClientBuilder with clearer documentation for JWT signing modes. - Improved AAuthVerificationMiddleware to handle audience verification and token validation more robustly.
…ing in response handling
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second round of gap remediation addressing server-side middleware, multi-agent call chaining, observability, and sample enhancements. 87 files changed, 447 tests passing (190 unit + 257 conformance).
Key Changes
Server Middleware (new)
AAuthVerificationMiddleware— full HTTP signature + JWT issuer verification via JWKS discovery, with per-pathUseWhenscoping401+resource_tokenfor agent-token callersAddAAuthAuthentication()/RequireAAuthPolicy()for ASP.NET Core auth pipelineCall Chaining (new)
TokenExchangeClient.ExchangeAsyncacceptsupstreamTokenparameter — PS builds nestedactclaimsUseJwt(string)onAAuthClientBuilder— present a pre-acquired auth token directlyactchain verificationObservability (new)
ActivitySourceintegration for signature verification spansPrefer: wait=Nheader support for long-polling with conformance testsSamples & Documentation
GET /hwk,GET /jwks-uri,GET /(three-party JWT)make demonow starts 5 services (added Orchestrator)SDK Enhancements
IAAuthKeyinterface extraction for key abstractionRequireIssuerVerificationoption on verification middlewareResourceIdentifierfor audience validationTesting
All 447 tests pass — 190 unit/integration + 257 conformance, including:
actclaim verificationPrefer: wait=Nlong-polling conformanceHow to Test
Select "5 · Call Chain (Multi-Agent)" in the Guided Tour picker or visit the Call Chain page in SampleApp.