feat: add agent_key_thumbprint scaffold to gateway.agent_identity - #474
Open
qubeena07 wants to merge 1 commit into
Open
feat: add agent_key_thumbprint scaffold to gateway.agent_identity#474qubeena07 wants to merge 1 commit into
qubeena07 wants to merge 1 commit into
Conversation
Closes agentrust-io#425. SAGE wanted an offline check that a downstream signature came from the agent a TRACE Claim describes. Investigating turned up that the issue's own premise did not hold on current code: the Agent Manifest binding carries no agent public key anywhere, and subject_source is a static config value today, not a live authenticated credential. There is no key material anywhere in the runtime to hash yet, confirmed and refined together with the issue author in the comment thread. Landed as a nullable, additive field instead. agent_key_thumbprint, an RFC 7638 JWK thumbprint rendered as sha256 hex, sits on AgentIdentityInfo and AgentIdentityOut and stays None today since no code path supplies agent key bytes. The real behavior change is on the verifier side: verify_trace_claim now fails closed with AGENT_KEY_THUMBPRINT_UNBOUND_SUBJECT on any claim that carries the field while subject_source is not live authenticated, so a future producer cannot launder a config supplied identity into what looks like a hardware attested key binding. Populating the field for real needs either an agent_manifest_sdk schema change carrying the agent's public key, or a live mTLS or challenge response credential wired into the binding. Both are out of scope here and tracked in the issue thread. Signed-off-by: Dipika Ranabhat <qubeena7@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #425.
SAGE wanted an offline check that a downstream signature came from the agent a TRACE Claim describes. Digging into it turned up that the issue's own premise does not hold on current code: the Agent Manifest binding carries no agent public key anywhere, and subject_source is a static config value today, not a live authenticated credential. There is no key material anywhere in the runtime to hash yet. This was confirmed and worked through together with the issue author in the comment thread, who agreed to the approach below.
Landed as a nullable, additive field instead. agent_key_thumbprint, an RFC 7638 JWK thumbprint rendered as sha256 hex, sits on AgentIdentityInfo and AgentIdentityOut and stays None today since no code path supplies agent key bytes.
The real behavior change is on the verifier side. verify_trace_claim now fails closed with AGENT_KEY_THUMBPRINT_UNBOUND_SUBJECT on any claim that carries the field while subject_source is not live authenticated, so a future producer cannot launder a config supplied identity into what looks like a hardware attested key binding. This check is unconditional, it runs whether or not the caller requests the existing agent manifest cross check.
Populating the field for real needs either an agent_manifest_sdk schema change carrying the agent's public key, or a live mTLS or challenge response credential wired into the binding. Both are out of scope here and stay tracked in the issue thread.
Changes
Test plan