feat(dotnet-agent-identity): add the authority library

[Benoît Cortier (CBenoit)]

Add Devolutions.AgentIdentity, the .NET library that holds what every Agent Identity authority must do the same way under the agent-identity contract, so that DVLS and PSU cannot drift apart on the agent-facing protocol.
The host keeps storage, hosting, management and the root key, and supplies a certificate registry, a nonce store, a root signer, a clock and a random number generator.

The library implements:

• request authentication per contract §6, steps 1 to 6 in order: a strict RFC 8941 parser that refuses repeated members, parameters and labels; only canonical base64, keyid and nonce encodings; Content-Digest; and a nonce recorded only after the signature verifies;
• the agent channel handshake of §7.3 and §7.4: a fresh challenge per stream, the proof, a registry re-read, and the order of Hello failures and stream deadlines;
• enrollment tokens, their secret hash and the enrollment decision of §2.1;
• metadata, request body and CSR validation;
• identity certificates issued through the host's root signer, and the renewal decision of §5.3;
• the agent-facing response bodies, the identity config and the channel's push messages;
• the error bodies and gRPC statuses of §5.4 and §7.4.

Only the signature check and the channel handshake create AuthenticatedIdentity, the type through which code acts for an identity.
The RFC 9421 profile is written over the BCL's ECDSA rather than NSign, because NSign's parser keeps the last of repeated parameters, which step 1 forbids, and its request verification is built for ASP.NET Core.
The library is derived from the contract, the shared test vectors and the shared intent alone, as one more independent implementation, and its tests run every shared test vector.

The package lives in dotnet/AgentIdentity/ with a README for host developers, is built and tested in the .NET library CI job, and is published by publish-libraries.yml next to Devolutions.Agent.Channel, on which it depends.

Issue: DGW-479

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Benoît Cortier (CBenoit)]

Acceptance evidence at db7fa950

• db7fa950 only moves the sources into folders by contract area: 90 renames at 100% similarity, no content change; the results below hold at it.
• Clean Release build (bin/obj removed): dotnet build dotnet/AgentIdentity/AgentIdentity.sln -c Release gives 0 warnings and 0 errors.
• dotnet test dotnet/AgentIdentity/AgentIdentity.sln: 1480 passed, 0 failed.
• Shared vectors at d9d3ee91, each its own test, all passing:
  • 92 of 92 http_signature cases and 3 of 3 sequences;
  • 16 of 16 ok signature bases byte-equal to signature_base;
  • 4 of 4 CSR vectors;
  • 8 of 8 channel_proof cases, plus the proof input equal to message_hex;
  • RFC 9421 B.2.4.
• pwsh ./dotnet/AgentIdentity/build.ps1 produces Devolutions.AgentIdentity.2026.10.20 .nupkg and .snupkg, holding the DLL, its XML docs and the README. The only dependency is Devolutions.Agent.Channel 2026.9.25; nothing comes from ASP.NET Core.
• dotnet/AgentIdentity/INTENT.md is byte-identical to the approved text and was committed once (d9fd8ba1). The INTENT.agent-identity.md symlink has the same blob as the other copies.
• Intent drift audit of dotnet/AgentIdentity/: every applicable statement conforms. Two partials found at an intermediate head were closed before this head: response bodies, config and renewal rules were missing, and renewal issuance took a raw Guid.
• Each commit range was reviewed by a model from a different family than the writer's, with a cap of three rounds; every final verdict is approve.

Decisions within the brief

• Directory dotnet/AgentIdentity/ (accepted):
  • dotnet/ holds hand-written .NET components that no crate or OpenAPI document generates;
  • crates/* is a Cargo workspace glob that needs a Cargo.toml in every directory;
  • utils/dotnet/'s build.ps1 packs everything in its folder under one version cadence.
• RFC 9421 profile written over the BCL's ECDSA instead of NSign (accepted): one strict parse drives both the checks and the signature base.
• The handshake takes Devolutions.Agent.Channel message types (accepted).
• Scope adjusted within the intent sentence. The library also parses the request bodies and writes the response bodies, IdentityConfig, the channel push messages and the §5.3 RenewalRules. A renewal issues through Issue(AuthenticatedIdentity renewing, ...). Every authority must produce these the same way.
• VerifyHelloAsync and HelloTimedOutAsync re-read the registry, because a host cannot map a stream still in its handshake to an identity (invariant 5). Contract §7.4 adopted this order at d9d3ee91.
• Classifications decided by a stated rule:
  • Request authentication:
    • a certificate is unexpired while now ≤ notAfter, and notBefore is not checked;
    • signature and digest lengths fail at step 5, as the vectors label them;
    • a method that is not an RFC 9110 token fails at step 5;
    • unavailable maps to gRPC Unavailable.
  • Enrollment:
    • the Authorization scheme is compared case-insensitively, surrounding white space is ignored, and the bag is never decoded;
    • the token's u and the agent_channel_url must not hold user information, and their trailing slashes are removed.
  • CSRs and certificates:
    • CSR subject and attributes are read only as DER elements;
    • the leaf's AKI is the issuer's SKI, so the issuer must carry one;
    • the leaf has an SKI by method 1, a critical KeyUsage and no BasicConstraints;
    • the serial is 16 random bytes, and notBefore is truncated to the second.
  • JSON and enums:
    • request bodies refuse a byte order mark and nesting deeper than 64;
    • config product fields are snake_case at every depth, with no repeated names and no null members;
    • public enums start at 1.

Deviations from the brief

• No behavioural deviation; the scope adjustments above stay within the intent sentence, as the brief allows.
• The test vector loader is strict: a new member in test-vectors.json fails the suite until the loader reads it, so that changes to the vector format on the base are noticed rather than skipped.

Open questions

1. Devolutions.Agent.Channel is not on nuget.org yet, and this package depends on it, so the two must be published together.
2. CONTRACT.md's Definitions call retired "replaced by a confirmed certificate", but §5.3 also retires a pending certificate when renew issues a newer one. CertificateStatus.Retired mirrors the Definitions wording.

UNTESTED properties

• The values of the public enums stay the same across releases: AgentIdentityErrorCode, AgentOperation, CertificateStatus, EnrollmentOutcome, RenewalOutcome, RenewalRequestReason, ReconnectReason.
• Every AgentIdentityError message is a constant sentence (AgentIdentityError.cs:16).
• A CSR point coordinate of p or more is rejected (CertificateSigningRequest.cs:186).
• Of two racing handshake calls, exactly one ends the handshake (ChannelOpening.cs:255).
• The RFC 8941 parser runs in linear time (StructuredField.cs:139).
• The Content-Digest comparison is constant-time (RequestAuthenticator.cs:261).

Note

Human-tuned, LLM-assisted content.