Module auth 

Authentication + authorization via Schubert proof-carrying capability tokens.

Per docs/DESIGN.md D4, Ijima uses Schubert for both authn and authz: a schubert::crypto::CapabilityToken is Ed25519-signed by an issuer and carries a principal + capability. Verifying the signature authenticates the principal; the AccessController authorizes the action geometrically on Gr(4,8).

The capability vocabulary is declarative TOML at policy/policy.toml — selected by Schubert’s recommend CLI for Ijima’s constraints (Gr(4,8), dim 16, features std/crypto/policy).

Wire format

Bearer tokens are base64 of a length-prefixed binary blob:

u16 BE principal_len | principal utf-8
u16 BE capability_len | capability utf-8
32 bytes issuer public key
64 bytes Ed25519 signature

The signature covers principal \\0 capability \\0 issuer_key (the exact message Schubert’s issuer signs), so the wire format is pure transport — verification re-checks the signature cryptographically.

Structs

AuthenticatedPrincipal

The authenticated principal + capability carried by a verified token.

IjimaAuth

Ijima’s auth core: an AccessController (authz) plus a capability token issuer and verifier (authn) sharing one Ed25519 key.