fix(rust): close the gaps between a verified credential and a trusted one - #531

Merged

yordis merged 32 commits into

mainfrom

yordis/davao-v1

Aug 8, 2026

Commits on Aug 7, 2026

fix(trogon-aauth-verify): make a verified signature cover the body it was sent with
yordis
committed
3aa5780
fix(trogon-aauth-verify): honor what a publisher says its key is for
yordis
committed
d7362d9
chore(trogon-aauth-verify): describe the replay store that exists, not one that does not
yordis
committed
160af04
fix(trogon-identity-types): keep private key material out of a published confirmation claim
yordis
committed
bae20cf
fix(trogon-gateway): make webhook dedup survive a replayed delivery
yordis
committed
bad87b2
fix(a2a-gateway): refuse to run unverified bundles when verification was asked for
yordis
committed
d17554d
fix(a2a-redaction): hold bundle signatures to the strict check
yordis
committed
837fb0b
fix(a2a-auth-callout): stop a token from choosing the algorithm that verifies it
yordis
committed
d00735c
chore(adr): record the external federation surface and correct what the corpus claims exists
yordis
committed
8cf3fd8
fix(a2a-identity-types): stop a replayable credential from reaching a log
yordis
committed
67e4f5c
fix(a2a-auth-callout): stop a replayable credential from reaching a log
yordis
committed
6181ed4
fix(trogon-jwks-publisher): refuse a key set no consumer can select from
yordis
committed
0487fb1
fix(trogon-gateway): keep a replay bound from lapsing on an already-provisioned stream
yordis
committed
87123bc
chore(adr): keep the federation issuer key out of agent key management
yordis
committed
94a9172
chore(adr): stop offboarding from reading as complete at the platform edge
yordis
committed
93f15ab
fix(trogon-nats): stop stream provisioning from overwriting what the operator tuned
yordis
committed
192caa3
fix(a2a-auth-callout): let the two key-policy refusals be counted apart
yordis
committed
373a9df
fix(trogon-identity-types): keep an unusable confirmation key out of an issued token
yordis
committed
9df7333
fix(trogon-aauth-verify): accept the Content-Digest shapes RFC 9530 allows
yordis
committed
98f63a3

Navigation Menu

Uh oh!

fix(rust): close the gaps between a verified credential and a trusted one - #531

fix(rust): close the gaps between a verified credential and a trusted one#531
yordis merged 32 commits into
mainfrom
yordis/davao-v1

Commits on Aug 7, 2026

fix(trogon-aauth-verify): make a verified signature cover the body it was sent with

fix(trogon-aauth-verify): honor what a publisher says its key is for

chore(trogon-aauth-verify): describe the replay store that exists, not one that does not

fix(trogon-identity-types): keep private key material out of a published confirmation claim

fix(trogon-gateway): make webhook dedup survive a replayed delivery

fix(a2a-gateway): refuse to run unverified bundles when verification was asked for

fix(a2a-redaction): hold bundle signatures to the strict check

fix(a2a-auth-callout): stop a token from choosing the algorithm that verifies it

chore(adr): record the external federation surface and correct what the corpus claims exists

fix(a2a-identity-types): stop a replayable credential from reaching a log

fix(a2a-auth-callout): stop a replayable credential from reaching a log

fix(trogon-jwks-publisher): refuse a key set no consumer can select from

fix(trogon-gateway): keep a replay bound from lapsing on an already-provisioned stream

chore(adr): keep the federation issuer key out of agent key management

chore(adr): stop offboarding from reading as complete at the platform edge

fix(trogon-nats): stop stream provisioning from overwriting what the operator tuned

fix(a2a-auth-callout): let the two key-policy refusals be counted apart

fix(trogon-identity-types): keep an unusable confirmation key out of an issued token

fix(trogon-aauth-verify): accept the Content-Digest shapes RFC 9530 allows

Commits on Aug 8, 2026

chore(a2a-auth-callout): check every segment of the token the redaction hides

fix(trogon-identity-types): stop a peer's private key from reaching the logs

chore(trogon-jwks-publisher): make an unselectable published key set unrepresentable

chore(trogon-nats): let a test name the provisioning refusal it asked for

fix(trogon-nats): stop provisioning from being able to widen what it owns

fix(trogon-nats): stop reconciliation from rewriting a stream that already agrees

chore(adr): keep the crypto suite's federation reference navigable

fix(trogon-channel): stop bucket provisioning tests from resting on who wins a race

chore(trogon-aauth-verify): pin the digest member this reader refuses to skip

fix(trogon-jwks-publisher): keep a set's rejection reason inside the error-naming convention

chore(a2a-auth-callout): pin the RSA-only refusal the new key guards can hide

chore(trogon-aauth-verify): pin the bare-key member this reader has to step over

fix(trogon-aauth-verify): stop a bare sha-256 member from leaving last-wins behind