Expand description
Pure application-token encoding and optional signature/token/session machinery.
Hashing untrusted material does not authenticate it. Applications must not admit tokens by hashing them or checking just one signature. Application authentication admits a token through the optional session engine, then checks the caller-bound session for each operation with current protected host inputs. Admission uses one explicit host transaction for verification and replay consumption. Standalone token verification remains a lower-level proof primitive; it does not establish a session or authorize application resources.
Modulesยง
- admission_
budget - canonical
- Canonical signed bytes for the existing Canic application-token protocol. Domains and tags are protocol identities, not package branding. This module does not verify signatures, authority, validity or caller binding.
- certificate_
issuance - Pure certificate issuance rules, without signing, time or authority admission.
- chain_
key_ batch - Pure Merkle construction for the existing chain-key batch proof format.
- portable
- Canonical portable credential claims and explicit protected-context checks. Encoding, decoding and hashing alone do not verify time or authority. Context checks do not verify signatures, enrollment provenance or revocation. No value returned by this module is sufficient for session admission.
- session_
request - Canonical session request identity, independent of proof verification or storage.
- token_
preparation - Pure delegated-token issuance over a host-admitted delegation proof.