Expand description
A capability certificate proves a key and a holder, never a permission.
Modules§
- offer
- Certificate-bearing offers leave the client wire frame shape unchanged.
- service_
key - The service certificate key is fetched once, never taken from pass JWKS.
- setup
- Canonical setup content shared by the identity help and the static guide.
- standing
- A fresh request on Lys’s certified-agent pass route proves current key standing. The certificate signature is still verified offline with the service key.
- status
- A signed MCP read observes the presented certificate’s exact current record.
Structs§
- Verified
Certificate - The result of signature, lifetime, holder and Noise-key checks. Withdrawal and current grants are separate decisions at admission.
Enums§
- Certificate
Refusal - Stable refusal names exclude certificate bytes and untrusted parser text.
Functions§
- verify
- Verifies only with the service key fetched from the trusted API base. Historical capability grants are deliberately never inspected for rights.