Crate openagent_auth_protocol 

openagent-auth-protocol — the transport-agnostic type layer for the OpenAgent Core Protocol identity flow.

This crate implements a specification; it does not define one

The normative protocol document is the OpenAgent Core Protocol Specification (openagents/openagent.id/OPENAGENT-CORE-SPEC.md): abstract messages in Section 15, transport bindings in Section 16. If this crate disagrees with the specification, the specification is correct.

Identity flow (Section 15.1)

1. IdentityChallenge — the server issues a cryptographic challenge (openagent-challenge-v1: nonce, timestamp, origin, optional realm)
2. IdentityProof — the agent signs the JCS-canonicalized (RFC 8785) challenge bytes with its DID key
3. IdentityVerified — the server confirms identity and issues a session token

Concrete transports (HTTP, WebSocket, Weave) implement transport::AuthTransport.

History

This crate was previously “OAAP”, a separate 4-step mutual-authentication protocol (PRESENT / CHALLENGE / PROVE / ESTABLISHED with an embedded lineage push and BLAKE3 tuple hashing) that diverged from the Core Protocol while claiming adjacency to it — and for a stretch did not compile at all (its two error enums disagreed). The Core Protocol is the one normative authentication protocol for the stack; the old vocabulary is retired.

Lineage presentation is deliberately not part of this flow: the agent presents a proof of key possession, and the server resolves the DID document and evaluates lineage with its own trust policy (and, for privileged authority, the OAS lineage contracts). A protocol that lets the caller push its own proofs trades server-side verification for caller-side assertion.

Re-exports

pub use error::AuthProtocolError;

pub use message::IdentityChallenge;

pub use message::IdentityProof;

pub use message::IdentityVerified;

pub use message::KeyType;

pub use message::TrustTier;

pub use message::CHALLENGE_TYPE;

pub use session::InMemorySessionStore;

pub use session::Session;

pub use session::SessionId;

pub use session::SessionState;

pub use session::SessionStore;

pub use transport::AuthTransport;

pub use types::ConformanceLevel;

pub use types::DidDocument;

pub use types::DiscoveryDocument;

pub use types::LineageLink;

pub use types::LineageProof;

Modules

error

Error types for the OpenAgent Core Protocol identity flow.

handshake

Core handshake logic for the OpenAgent Core Protocol identity flow.

message

Wire message types for the OpenAgent Core Protocol identity flow.

session

Session state management for authenticated Core Protocol connections.

transport

Transport abstraction for the Core Protocol identity flow.

types

Shared types for the OAAP protocol.

Constants

VERSION

Crate version.