Skip to content

OpenAgentID 0.2.0

Choose a tag to compare

View all tags
@l1feorg l1feorg released this 11 Oct 19:02
v0.2.0
3f82b2e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenAgentID 0.2.0 ships the two existing npm packages @openagentid/sdk@0.2.0 and @openagentid/oidc@0.2.0 from the canonical OpenAgentID/openagent-sdk repository.

  • Real agent OpenID Connect provider: protected signing keys, discovery/public JWKS, registered clients, code/PKCE/consent, signed agent claims and current identity checks at redemption/UserInfo. LifeID federation verifies the exact proven human/organization owner.
  • Self-root agents and signed descendants: explicit authoritative current DID/audience authorization, owner: null, and a root authorization ID/revision. Self-root status imposes no reduced access tier; services apply normal operation and tenant authorization. Signature, key-purpose, lifetime, revocation and atomic replay checks remain enforced.
  • Verification SDK, HTTP handler/client and oaid verify CLI; deterministic OAS Glyph SDK/SVG handler with avatar override; concrete OAS Ed25519/JCS evidence verification and verified OATS scoring.
  • New did:oas identities and literal legacy did:l1fe support. Legacy bridge success requires real identity custody and capability-broker hooks.

Node requirements: SDK >=20; OIDC >=20.19.0. Both packages include ESM/CommonJS, declarations, source maps and licenses. Migration and hosted adapter requirements.

Release source: PR #1 and PR #2. Final reviewed head: 1601e11a6036db67c3809f9086360c4da9284405. CI: all14 jobs green, Rust222/222 and TypeScript222/222 conformance, drift0. Remote artifact qualification: SDK258/OIDC127 tests, typechecks, builds, packs and installed-consumer ESM/CommonJS/CLI checks.

Exact previewed tarballs:

  • SDK SHA-256: 13257449bfb2f356484292baf1b6587dacffa434108a15b48f0cd69b3d7edcc7
  • OIDC SHA-256: e108e8a1664461457055b22f443781442128ea66a8aca02028b95852b187cd57

This open core release does not claim hosted LifeID/Genesis deployment or consumer rollout. Hosts supply authoritative adapters, shared durable challenge/storage authorities, Blinds credential brokering and Genesis KMS custody.

Iris Core Review passed the exact final head on October11 at13:54:58 Central. LifeID self-root registration authority must reject identities that already have an owner; a client cannot choose its own root mode.

Packages in this release

Package Version
@openagentid/sdk 0.2.0 published 2026-10-11 19:01 UTC
@openagentid/sdk-testing 0.1.1 unchanged
@openagentid/http 0.1.1 unchanged
@openagentid/mcp 0.1.1 unchanged
@openagentid/claude-agent 0.1.1 unchanged
@openagentid/scim 0.1.1 unchanged
@openagentid/oidc 0.2.0 published 2026-10-11 19:02 UTC
@openagentid/crypto-wasm 0.1.1 unchanged
create-openagent 0.1.1 unchanged

Source and verification

This tag points at 3f82b2e, the merge of #2 on main. npm recorded no gitHead for these versions. Every source embedded in the SDK tarball's sourcemaps, and each package's manifest, README, CHANGELOG and licenses, match this commit byte for byte. These versions were published by hand before the release workflow existed, so they carry no provenance attestation. The attached tarballs are the files npm serves (their sha512 equals npm's integrity):

gh release download v0.2.0 --repo OpenAgentID/openagent-sdk
shasum -a 256 -c SHA256SUMS
Assets 5
Loading