Skip to content

Commit 331f32e

Browse files
vvillait88vvillait88
authored
chore: canonicalize on www.agentscore.com; refresh deps and CI
Canonicalize UCP namespace on com.agentscore and issuer on www.agentscore.com; resolve agentscore-py >=2.5.0 from PyPI; refresh deps; CI setup-uv v8.3.0 + cache v6 + checkout v7. Version 2.5.0.
1 parent 8b540b6 commit 331f32e

106 files changed

Lines changed: 10668 additions & 1399 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ jobs:
2121
- uses: useblacksmith/checkout@v1
2222

2323
- name: Install uv
24-
uses: astral-sh/setup-uv@v8.1.0
24+
uses: astral-sh/setup-uv@v8.3.0
2525

2626
- name: Set up Python
2727
run: uv python install 3.12
2828

29-
- uses: actions/cache@v5
29+
- uses: actions/cache@v6
3030
with:
3131
path: |
3232
~/.cache/uv

‎.github/workflows/publish.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ jobs:
1717
runs-on: ubuntu-latest
1818
timeout-minutes: 15
1919
steps:
20-
- uses: actions/checkout@v6
20+
- uses: actions/checkout@v7
2121

22-
- uses: astral-sh/setup-uv@v8.1.0
22+
- uses: astral-sh/setup-uv@v8.3.0
2323

2424
- name: Set version from tag
2525
run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

‎.github/workflows/security.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
timeout-minutes: 5
3939
steps:
4040
- uses: useblacksmith/checkout@v1
41-
- uses: astral-sh/setup-uv@v8.1.0
41+
- uses: astral-sh/setup-uv@v8.3.0
4242
- uses: actions/setup-python@v6
4343
with:
4444
python-version: "3.13"

‎CLAUDE.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ Anonymous POST flows through to the handler unauthenticated and gets a 402 with
121121

122122
### `compatible_clients` field on emitted 402s
123123

124-
`build_agent_instructions` emits a `compatible_clients` field in the 402 body, derived automatically from `how_to_pay`: per-rail list of CLIs the AgentScore team has smoke-verified end-to-end. Vendors override with `build_agent_instructions(how_to_pay=how_to_pay, compatible_clients={...})` to add their own tested clients. Set to an empty dict `{}` to suppress the default. Same data is published as `core/docs/integrations/x402-clients.mdx` for human-side rationale + per-rail commands.
124+
`build_agent_instructions` emits a `compatible_clients` field in the 402 body, derived automatically from `how_to_pay`: per-rail list of CLIs the AgentScore team has smoke-verified end-to-end. Vendors override with `build_agent_instructions(how_to_pay=how_to_pay, compatible_clients={...})` to add their own tested clients. Set to an empty dict `{}` to suppress the default. Same data is published at https://docs.agentscore.com/integrations/x402-clients for human-side rationale + per-rail commands.
125125

126126
## Tooling
127127

@@ -155,7 +155,6 @@ uv run pytest tests/
155155
- **Never commit .env files or secrets**
156156
- **Use PRs**: never push directly to main
157157
- **Helpers are protocol translations + configurable opinions, not opinionated frameworks**
158-
- **Cross-language API parity**: keep the surface area identical between the node and python flavors so vendors switching languages have the same mental model
159158

160159
## Releasing
161160

‎CODE_OF_CONDUCT.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Examples of unacceptable behavior:
2424

2525
## Enforcement
2626

27-
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at engineering@agentscore.sh. All complaints will be reviewed and investigated promptly and fairly.
27+
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team at engineering@agentscore.com. All complaints will be reviewed and investigated promptly and fairly.
2828

2929
## Attribution
3030

‎README.md‎

Lines changed: 16 additions & 14 deletions
Large diffs are not rendered by default.

‎SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ If you discover a security vulnerability, please report it responsibly.
66

77
**Do not open a public GitHub issue for security vulnerabilities.**
88

9-
Instead, email us at **security@agentscore.sh** with:
9+
Instead, email us at **security@agentscore.com** with:
1010

1111
- Description of the vulnerability
1212
- Steps to reproduce

‎agentscore_commerce/__init__.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
MppxComposeOutcome,
2525
PricingResult,
2626
SettleOutcome,
27+
build_aip_trusted_issuers,
2728
format_pydantic_errors,
2829
get_identity_status,
2930
pricing_result,
@@ -58,6 +59,7 @@
5859
A2A_DEFAULT_TRANSPORT,
5960
A2A_PROTOCOL_VERSION,
6061
AGENTSCORE_UCP_CAPABILITY,
62+
AIP_A2A_EXTENSION_URI,
6163
FIXABLE_DENIAL_REASONS,
6264
UCP_A2A_EXTENSION_URI,
6365
A2AAgentCard,
@@ -90,6 +92,7 @@
9092
UCPSigningKey,
9193
UCPVerificationError,
9294
VerifyWalletSignerResult,
95+
aip_a2a_extension,
9396
build_a2a_agent_card,
9497
build_agent_memory_hint,
9598
build_contact_support_next_steps,
@@ -156,6 +159,7 @@
156159
"A2A_DEFAULT_TRANSPORT",
157160
"A2A_PROTOCOL_VERSION",
158161
"AGENTSCORE_UCP_CAPABILITY",
162+
"AIP_A2A_EXTENSION_URI",
159163
"FIXABLE_DENIAL_REASONS",
160164
"UCP_A2A_EXTENSION_URI",
161165
"A2AAgentCard",
@@ -223,8 +227,10 @@
223227
"WorkOutcome",
224228
"X402BaseRailSpec",
225229
"__version__",
230+
"aip_a2a_extension",
226231
"build_a2a_agent_card",
227232
"build_agent_memory_hint",
233+
"build_aip_trusted_issuers",
228234
"build_contact_support_next_steps",
229235
"build_default_checkout_rails",
230236
"build_gate_from_policy",

‎agentscore_commerce/aip/__init__.py‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
"""AIP (Agentic Identity Protocol) — AIT verification (verifier role) + RFC 9421 signing.
2+
3+
This package is the AgentScore verifier for Agent Identity Tokens (AITs): a merchant gate
4+
hands a parsed request plus a trusted-issuer :class:`JwksCache` to the orchestrator and gets
5+
back the signature-checked, structurally-valid claims (or a typed failure mapped onto the AIP
6+
wire error taxonomy). It also exposes the RFC 9421 HTTP Message Signature primitives an agent
7+
uses to prove possession of its ``cnf``-bound key.
8+
9+
Submodules:
10+
agentscore_commerce.aip.types - AIT claim contract + structural validation
11+
agentscore_commerce.aip.http_signature - RFC 9421 sign / verify (the AIP subset)
12+
agentscore_commerce.aip.jwks - trusted-issuer enforcement + JWKS key discovery
13+
agentscore_commerce.aip.verify - the AIT verification pipeline (orchestrator)
14+
agentscore_commerce.aip.request - build a VerifyRequestContext from a framework request
15+
agentscore_commerce.aip.gate - framework-agnostic gate + RFC 9457 denial bodies
16+
17+
The public surface mirrors the reference top-level AIP exports; where the reference
18+
folds an input shape into an options interface (``VerifyAitOptions`` / ``SignMessageInput`` /
19+
``VerifyMessageSignatureInput`` / ``JwksCacheOptions``), Python passes keyword args and the
20+
corresponding concrete dataclasses (:class:`SignatureParams`, :class:`SignedMessage`,
21+
:class:`VerifyRequestContext`) are surfaced instead.
22+
"""
23+
24+
from agentscore_commerce.aip.gate import (
25+
AipErrorBody,
26+
AipErrorRequirements,
27+
AipGateEvaluation,
28+
AipGateOptions,
29+
AipGateResult,
30+
aip_error_code,
31+
aip_error_status,
32+
build_aip_error_body,
33+
build_aip_weak_auth_body,
34+
check_trust_requirements,
35+
evaluate_aip_parts,
36+
evaluate_aip_request,
37+
verify_ait_parts,
38+
verify_ait_request,
39+
)
40+
from agentscore_commerce.aip.http_signature import (
41+
AIP_COVERED_COMPONENTS,
42+
AIP_SIGNATURE_TAG,
43+
MAX_POP_WINDOW_SECONDS,
44+
ParsedSignatureInput,
45+
SignatureParams,
46+
SignedMessage,
47+
VerifyFailureReason,
48+
VerifyMessageSignatureResult,
49+
build_signature_base,
50+
normalize_authority,
51+
parse_signature_input,
52+
parse_signature_value,
53+
sign_message,
54+
verify_message_signature,
55+
)
56+
from agentscore_commerce.aip.jwks import (
57+
AGENTSCORE_CANONICAL_ISSUER,
58+
DEFAULT_CACHE_SECONDS,
59+
HARD_MAX_CACHE_SECONDS,
60+
JWKS_REFETCH_COOLDOWN_SECONDS,
61+
JWKS_WELL_KNOWN_PATH,
62+
FetchResponse,
63+
JwksCache,
64+
JwksLookupFailure,
65+
JwksLookupResult,
66+
canonicalize_issuer,
67+
resolve_cache_seconds,
68+
)
69+
from agentscore_commerce.aip.request import (
70+
HeadersLike,
71+
RequestLike,
72+
VerifyContextParts,
73+
build_verify_context_from_parts,
74+
build_verify_context_from_request,
75+
has_agent_identity_header,
76+
has_agent_identity_header_parts,
77+
)
78+
from agentscore_commerce.aip.types import (
79+
AitHeader,
80+
AitPayload,
81+
AitValidationResult,
82+
AmrValue,
83+
IdentityClaim,
84+
IntentClaim,
85+
TrustLevel,
86+
is_ait_shape,
87+
validate_ait_payload,
88+
)
89+
from agentscore_commerce.aip.verify import (
90+
AGENT_IDENTITY_HEADER,
91+
AIT_SIGNING_ALGS,
92+
SignatureMaterial,
93+
VerifiedAit,
94+
VerifyAitFailure,
95+
VerifyAitFailureResult,
96+
VerifyAitResult,
97+
VerifyAitSuccess,
98+
VerifyRequestContext,
99+
verify_ait,
100+
)
101+
102+
__all__ = [
103+
"AGENTSCORE_CANONICAL_ISSUER",
104+
"AGENT_IDENTITY_HEADER",
105+
"AIP_COVERED_COMPONENTS",
106+
"AIP_SIGNATURE_TAG",
107+
"AIT_SIGNING_ALGS",
108+
"DEFAULT_CACHE_SECONDS",
109+
"HARD_MAX_CACHE_SECONDS",
110+
"JWKS_REFETCH_COOLDOWN_SECONDS",
111+
"JWKS_WELL_KNOWN_PATH",
112+
"MAX_POP_WINDOW_SECONDS",
113+
"AipErrorBody",
114+
"AipErrorRequirements",
115+
"AipGateEvaluation",
116+
"AipGateOptions",
117+
"AipGateResult",
118+
"AitHeader",
119+
"AitPayload",
120+
"AitValidationResult",
121+
"AmrValue",
122+
"FetchResponse",
123+
"HeadersLike",
124+
"IdentityClaim",
125+
"IntentClaim",
126+
"JwksCache",
127+
"JwksLookupFailure",
128+
"JwksLookupResult",
129+
"ParsedSignatureInput",
130+
"RequestLike",
131+
"SignatureMaterial",
132+
"SignatureParams",
133+
"SignedMessage",
134+
"TrustLevel",
135+
"VerifiedAit",
136+
"VerifyAitFailure",
137+
"VerifyAitFailureResult",
138+
"VerifyAitResult",
139+
"VerifyAitSuccess",
140+
"VerifyContextParts",
141+
"VerifyFailureReason",
142+
"VerifyMessageSignatureResult",
143+
"VerifyRequestContext",
144+
"aip_error_code",
145+
"aip_error_status",
146+
"build_aip_error_body",
147+
"build_aip_weak_auth_body",
148+
"build_signature_base",
149+
"build_verify_context_from_parts",
150+
"build_verify_context_from_request",
151+
"canonicalize_issuer",
152+
"check_trust_requirements",
153+
"evaluate_aip_parts",
154+
"evaluate_aip_request",
155+
"has_agent_identity_header",
156+
"has_agent_identity_header_parts",
157+
"is_ait_shape",
158+
"normalize_authority",
159+
"parse_signature_input",
160+
"parse_signature_value",
161+
"resolve_cache_seconds",
162+
"sign_message",
163+
"validate_ait_payload",
164+
"verify_ait",
165+
"verify_ait_parts",
166+
"verify_ait_request",
167+
"verify_message_signature",
168+
]

0 commit comments

Comments
 (0)