agent_mesh_protocol/
lib.rs

1//! Cryptographic primitives for the agent-mesh.
2//!
3//! This crate provides the identity layer the rest of the workspace
4//! builds on:
5//!
6//! * [`UserKey`] — root of trust, one ed25519 keypair per user.
7//! * [`AgentKey`] — short-lived per-process sub-key, certified by a
8//!   `UserKey` via a [`CertChain`].
9//! * [`GitHubBinding`] — cross-signature linking a `UserKey` to the
10//!   ed25519 SSH key GitHub already knows about.
11//! * [`SignedEnvelope`] — the wire format every mesh message is
12//!   wrapped in.
13//! * [`Fingerprint`] — short BLAKE3 identifier for keys and content.
14//!
15//! All wall-clock time in this crate is treated as a *claim* (e.g.
16//! `AgentMetadata::issued_at`), never as a coordination primitive.
17//! See the project `CLAUDE.md` for the rationale.
18
19#![doc(html_root_url = "https://docs.rs/agent-mesh-protocol")]
20
21pub mod agent_key;
22pub mod authority;
23pub mod caveats;
24pub mod envelope;
25pub mod error;
26pub mod fingerprint;
27pub mod github_binding;
28pub mod signer;
29pub mod user_key;
30
31#[cfg(feature = "pyo3")]
32pub mod pyo3_module;
33
34pub use agent_key::{AgentKey, AgentMetadata, CertChain, Issuer, SerdeSig};
35pub use authority::{
36    admit, check_derivation, empty_closure, relate, verify_chain, AdmissionDecision,
37    AdmissionReject, AttestationId, AttestationVerifier, Authority, AuthorityId, AuthorityMismatch,
38    BindError, ChainDecision, ChainReject, ConfinedAxis, DenyAllElevations, Derivation,
39    DerivationDecision, DerivationReject, Grant, GrantId, ResolvedAuthority, ResolvedGrant,
40    ResolvedScope, ScopeRelation,
41};
42pub use caveats::{Caveats, CountBound, Scope};
43pub use envelope::{Recipient, SignedEnvelope};
44pub use error::{MeshError, Result};
45pub use fingerprint::Fingerprint;
46pub use github_binding::{ssh_pubkey_ed25519_bytes, GitHubBinding};
47pub use signer::MeshSigner;
48pub use user_key::{UserKey, UserPublic};
agent_mesh_protocol/lib.rs

agent_mesh_protocol/
lib.rs
