Repository navigation

feat(agent): device identity enrollment and channel - #2000

Open

Benoît Cortier (CBenoit) wants to merge 353 commits into

masterfrom

cbenoit-agent-identity-v1

Open

feat(agent): device identity enrollment and channel#2000
Benoît Cortier (CBenoit) wants to merge 353 commits into
masterfrom
cbenoit-agent-identity-v1

This pull request is big! We're only showing the most recent 250 commits

Commits on Oct 22, 2026
- test(agent-identity-conformance): validate every management 401
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  49cf473
- test(agent-identity): verify every shared vector independently
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  79cb161
- test(agent-identity-conformance): wait for cleanups enrollment leaves unordered
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  830cbe4
- test(agent-identity-conformance): name unmet revoked-enrollment cleanups
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8585f50
- docs(agent-identity): name the contract CONTRACT.agent-identity.md
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c2f9da7
- feat(agent-installer): add Agent Identity enrollment
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5f61ddb
- docs(agent-identity): describe the Windows state lock as built
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  440c881
- docs(agent-identity): record the channel runner's timing decisions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  628d7bf
- test(agent-identity): keep state test paths short
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  eca018a
- fix(agent): retry an identity file replace held open by a reader
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c9e48fe
- style(agent): format the identity file replace imports
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b575187
- feat(agent): keep an agent channel for each stored identity
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e6c6f06
- fix(agent): send queued channel acknowledgements before closing
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e6bfd80
- fix(agent): open no channel stream after a terminal closure
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8d7cc23
- docs(agent-identity): cite CONTRACT.agent-identity.md in the channel integration
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1574165
- test(agent-identity): check the repair keeps stored state
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0f92be5
- docs(agent): add an Agent Identity operator guide
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a1b24a4
- docs(agent): say how an agent learns its identity ended
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  dbeef28
- test(agent-identity-conformance): reset the mock before each agent sub-case
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e3e4494
- style(agent-identity): drop a redundant path qualification in a test
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f83b6d0
- test(agent-identity-conformance): tolerate channel traffic and cut writes
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  25b1028
- docs(agent-channel): give the channel intents citable sections
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  17c1f9f
- docs(agent-identity): settle three points from the first DVLS run
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e71912c
- test(agent-identity-conformance): tolerate keys deleted during key checks
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a0de826
- refactor(agent-identity-conformance): share the file-backend fixture case
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  7031a8f
- fix(agent): never repair an untrusted authority directory
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  4466b0c
- fix(agent): stop identity while an authority directory is untrusted
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5caaf9f
- docs(agent): explain why Windows locks the identity directory
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c9703cb
- fix(agent): leave authority directories intact on parent repair
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a6b819d
- fix(agent): check authority directories named in another case
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  24103ff
- test(agent): skip only the link case without link permission
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  87df7cc
- docs(agent): mark the identity runners' shutdown as untested
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2e89219
- docs(agent-identity): define a trusted authority directory
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2baa09a
- docs(agent-identity): bound request bodies and the leaf's extensions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  445c3c8
- docs(agent-identity): count the body depth limit from the top level
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5362b73
- docs(agent-identity): record five DVLS decisions its tests pin
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  062d77c
- docs(agent-identity): say when DVLS checks rotation completion
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3a1c0af
- docs(agent-identity): keep the authority base URL as received
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5a6362e
- docs(agent-identity): give the channel URL the same slash rule as u
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9b1450c
- docs(agent-identity-conformance): state the default rotation window
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f3e1b4e
- fix(agent-identity-mock): refuse a deleted identity's key as revoked
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  4720591
- refactor(agent-identity-mock): keep no token for an issued key
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  7fb76d2
- test(agent-identity-mock): pin the refusal of a confirm with a body
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0947cc9
- test(agent-identity-conformance): adapt the runner to a real DVLS
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  bd64e4f
- test(agent-identity-conformance): require a window for one-second leaves
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c39b063
- fix(agent-identity-mock): refuse bodies nested past 64 levels
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  17aa824
- test(agent-identity-mock): pin the refusal of invalid Unicode in bodies
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  61cac3e
- fix(agent-identity-mock): issue leaves without basicConstraints
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  02ef92d
- refactor(agent-identity-mock): name the body parser for every rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1fe9d50
- test(agent-identity-conformance): bound bodies and leaf extensions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0581d96
- docs(agent-identity): extend the trust check to the identity files
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  bf0deda
- fix(agent): store the enrollment URL without trailing slashes
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f1957d1
- fix(agent): keep the enrollment URL as received
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f88609d
- test(agent-identity): mark the oracles of the touched token and state tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d033b91
- test(agent-identity-httpsig): drop channel-layer checks that guard nothing
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  57af6f3
- test(agent-identity-httpsig): check the channel opening's tag and components
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  02ddf34
- test(agent-identity-httpsig): cover signing rules no test exercised
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  77b1060
- test(agent-identity-httpsig): mark where each expected value comes from
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  064fefd
- test(agent-identity-httpsig): check a failed channel opening never reaches the transport
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  841dcf6
- test(agent-identity-httpsig): cite the vector pass rule and the expiry rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b852384
- test(agent-identity-httpsig): open the channel path for URLs with several trailing slashes
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0434f37
- test(agent-identity-httpsig): cite the channel URL slash rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d50abfa
- docs(agent-identity): audit each rotation completion exactly once
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  27f26e3
- docs(agent-identity): treat an undecodable first message as no Hello
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cc08b9b
- docs(agent-identity): give every contract section a stable anchor
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8e9b1f9
- docs(agent-identity): close a stream on an undecodable message
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  79f73a8
- test(agent-identity-mock): treat an undecodable first channel message as no Hello
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9625b49
- fix(agent-identity-mock): close a stream on an undecodable message with invalid_request
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a10f220
- chore(deps): point the lock file at webpki-roots 1.0.10
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  12599a7
- docs(agent-identity): bound channel envelopes at 64 KiB
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  589b738
- docs(agent-identity): keep every config within one channel envelope
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3665c2b
- docs(agent-identity): drop the redundant prefix from contract anchors
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d8fc9dc
- docs(agent-identity-conformance): state the per-authority harness rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  98ed6ec
- docs(agent-identity): say the renewal anchor's load time is not persisted
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  87f8f9c
- docs(agent-identity): keep DVLS configs within the channel limit
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e3f0ae1
- refactor(agent-identity): name the trust stop after stored identities
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  613feec
- fix(agent): stop identity while an identity.json is untrusted
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3d93ea1
- refactor(agent-identity): drop the untrusted identity file fallbacks
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  5ef2394
- perf(agent): check identity.json without opening it for its data
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  88177ba
- test(agent-identity): mark the oracles of the authority directory tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9535739
- feat(agent-identity-mock): bound channel envelopes and configs at 64 KiB
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cc5b70d
- docs(agent-identity): refuse oversize settings and retry blocked enrollments
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b16d110
- test(agent-identity-conformance): run checks on fitting authorities
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  996bbfe
- test(agent-identity-conformance): decide expiry by the certificates
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  390ce41
- test(agent-identity-conformance): tie expiry checks to the observed leaf
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  31788ad
- test(agent-identity-conformance): skip continuity checks on short leaves
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  19f48cc
- docs(agent-identity-conformance): keep authority secrets out of descriptions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0e1ad24
- test(device-key): drop checks that only checked themselves
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9fafef2
- test(device-key): assert what the governing documents decide
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b34d86e
- test(device-key): drop the no-trace check from the invalid-name test
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  115b4dd
- test(device-key): cover operations the intent decides but no test reached
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c131c01
- test(device-key): mark where each test's expected values come from
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f9b954a
- test(device-key): restore leftover recognition for the longest key name
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  954dece
- test(device-key): check the key descriptor's meaning rather than its spelling
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a93add6
- test(device-key): drop the minimum-wait checks from the key-directory lock tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a5f28ed
- test(device-key): mark the remaining tests and assertions
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  866df8b
- docs(device-key): state the file backend's directory rules and cleanup bounds
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  10ebb3c
- test(agent-identity-conformance): check undecodable and oversized channel messages
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b513266
- docs(device-key): scope cleanup to the crate's naming scheme
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  934c41b
- test(device-key): ground directory and cleanup tests in the intent
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  54711d8
- test(device-key): keep the uppercase temporary name distinct
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3647d35
- test(device-key): check that files outside the naming scheme survive
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b4cd351
- docs(device-key): never block or read without bound on unexpected entries
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  eec947e
- test(agent-channel-client): drop checks that guard nothing
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d0c18f6
- test(agent-channel-client): pin closing, handshake and timing rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  c1b7a26
- test(agent-channel-client): cover rules no test exercised
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  be4583e
- test(agent-channel-client): mark where each expected value comes from
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6481cb4
- test(agent-channel-client): accept an envelope of the contract's size
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  fd05d37
- test(agent-channel-client): give the opening timeout test room
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  46a78fb
- test(agent-channel-client): mark the unsupported proxy scheme test
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  18592a5
- docs(agent-identity): never bypass a configured proxy
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b60f5e0
- docs(agent-channel-client): close on a server message it cannot trust
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a1b2971
- fix(agent-channel-client): close on a server message it can't trust
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  dcebf27
- docs(agent-channel-client): ignore only well-identified messages before Welcome
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ca83e91
- docs(agent-identity): say what clears the DVLS config-size warning
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1552a86
- fix(device-key): keep unexpected key-store entries from blocking or vanishing
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9c58ba5
- docs(device-key): bound the size of a key file the file backend reads
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  7ed8621
- docs(agent-identity): state temporary cleanup and Windows replace retries
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  270def2
- docs(agent-identity): let revocation win over expiry before Hello
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  54102dd
- docs(agent-identity-mock): state scoped app keys and what reset keeps
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a336eb3
- docs(agent-identity): connect directly under Windows proxy auto-configuration
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6bb3854
- docs(agent-installer): state when the MSI enrolls and how failures behave
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e486c7d
- docs(agent): state the key-backend-unavailable system event
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cfd73c2
- docs(agent-identity-conformance): fault-injection tests are N/A on DVLS
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  03f7654
- docs(device-key): list and delete keys that break the access rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  569316e
- ci: restore fail-fast for the tests matrix
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  64158ac
- docs(agent): say when an agent notices the channel back on
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b2900d9
- test(agent-identity): cite contract anchors in channel and signer markers
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8ad0b72
- test(agent-installer): mark the oracles of the Agent Identity tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  950eb7c
- test(agent-identity): mark the source of each test's expected value
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  63e93fd
- test(agent-identity): compare the token hash and CSR algorithm with outside values
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2ed5858
- test(agent-identity): cover the gaps mutation testing found in identity state
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ceffe55
- test(agent-identity): name the change type of the stored-format test
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8949251
- test(agent-identity): mark the temporary-file and replace-retry tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ab6cf81
- test(agent-identity): check an overflowing Retry-After against the 1 h cap
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  180673e
- test(agent): mark the oracle sources of Agent Identity tests
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  747f2d8
- test(device-key): refuse a key file another account owns, as root
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  06867d5
- ci: run the root-only device-key tests as root
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8627d4d
- test(agent-identity-conformance): mark test oracles
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  f99755d
- test(agent-identity-mock): mark where each expected value comes from
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6212b6c
- test(agent-identity-mock): require 500 for an enrollment whose config no longer fits
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  804490d
- test(agent-identity-mock): cover rules no test exercised
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0b7456c
- test(agent-identity-mock): refuse a channel opening that repeats a signature header
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  965c422
- test(agent-identity-mock): mark the tests the mock intent and contract now decide
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d554e04
- test(agent-identity-mock): cover the channel handshake rules no test exercised
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1981159
- test(agent-identity-mock): assert only the config revision rules the contract states
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  d66b60d
- docs(agent-identity): link the contract's short anchors
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a6e9d16
- test(http-client-proxy): mark test oracles
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  881f7cc
- test(agent-identity-conformance): drop a session retry test no DVLS rule decides
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  010ca6d
- docs(agent-identity): reserve key_storage in enroll and renew responses
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e9d6334
- fix(agent): fail identity requests on a Manual proxy they can't use
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  14556e5
- test(agent-identity-conformance): mark the conformance tests with their sources
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  56c8e60
- test(agent-identity-conformance): mark the agent conformance tests with their sources
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  7d5d530
- test(agent): assert only the key-name prefix form at config load
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  e093657
- test(agent): cite the identity intent for the key-backend event
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  7abe8ed
- test(agent-installer): cite the MSI intent for the enroll and cleanup rules
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1b91740
- fix(agent): warn once per run about Windows proxy auto-configuration
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  a0dc2a0
- fix(agent): skip the auto-configuration warning when a proxy is in use
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ba125d3
- test(device-key): pin machine-key refusals and the key file size bound
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  3a4cc73
- test(device-key): say which checks refuse a key of another algorithm
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  2671464
- docs(agent-identity): state how unusable and auto-configured proxies behave
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  b28cdaf
- docs(agent-identity-conformance): name the tests for every coverage item
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  898360d
- test(agent-identity-conformance): assert outcomes instead of message text
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  58dace1
- test(agent-identity-conformance): skip renewal checks on short leaves
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  9524edb
- test(device-key): list and delete a key file that breaks the access rule
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  629674a
- fix(agent): read a system proxy without a scheme as an HTTP proxy
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  60305da
- fix(agent-identity-mock): advertise the address the mock listens on
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  845f269
- fix(agent): read a proxy without a scheme as an HTTP proxy for every client
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  6e206ab
- docs(agent-identity): state what revocation actually guarantees
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  691502d
- docs(agent-identity): cite DVLS's intent in the RDM repository
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  865f402
- docs(agent-channel-client): spread reconnects after a long-lived stream
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  017a53d
- docs(agent-identity): let an authority implement the signature profile itself
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  909e0a9
- ci: verify the Agent Identity test vectors independently
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  feaea39
- fix(agent): refuse to store an identity past its 2 MiB size limit
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1703489
- fix(agent-channel-client): back off a non-gRPC 5xx response as an outage
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0b05644
- fix(agent-channel-client): restart the backoff only after a long-lived stream
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  0c16404
- test(agent-channel-client): leave the stable-time test room for a scheduling stall
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  cb42e66
- fix(agent): never connect directly around a system proxy that can't be read
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  ae50719
- fix(agent): fail identity requests on a system proxy they can't use
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  bfec9f7
- fix(agent-channel-client): refuse server messages larger than an envelope
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  fbdffb8
- fix(agent): bound the agent channel notices an identity queues
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  8bcdb89
- docs(agent): state how channel notices are coalesced
  
  Benoît Cortier (CBenoit)
  and
  Copilot
  committed
  1940ae3
Commits on Oct 23, 2026
Commits on Oct 24, 2026
- test(agent): skip the SDDL descriptor tests under Miri
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  7a81460
- docs(agent-identity): pin chain signatures to P-256
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  2712d77
- docs(agent-identity): say how a moved authority's chain is checked
  
  Benoît Cortier (CBenoit)
  and
  Claude (claude)
  committed
  2798649

Commits

Commits on Oct 22, 2026