Expand description
Portable authentication, delegation proofs and optional local session machinery.
Hashing untrusted material does not authenticate it. Applications must not admit credentials by hashing them or checking just one signature. Application authentication admits a credential through the optional session engine, then checks the caller-bound session for each operation with current protected host inputs. Admission uses one explicit host transaction for verification and replay consumption. Standalone proof verification establishes no session or resource grant.
Modulesยง
- admission_
budget - canonical
- Canonical signed bytes for Root delegations, proofs and role identities. Domains and tags are protocol identities, not package branding. This module does not verify signatures, authority, validity or caller binding.
- certificate_
issuance - Pure certificate issuance rules, without signing, time or authority admission.
- chain_
key_ batch - Pure Merkle construction for the existing chain-key batch proof format.
- portable
- Canonical portable credential claims and explicit protected-context checks. Encoding, decoding and hashing alone do not verify time or authority. Context checks do not verify signatures, enrollment provenance or revocation. No value returned by this module is sufficient for session admission.
- session_
request - Canonical session request identity, independent of proof verification or storage.