feat(trust-registry): Pillar B — idprova-trust-registry open library (TrustList sign/verify + RFC 6962 Merkle federation + resolver) - #78
Merged
Conversation
…s-standard resolver design + skeleton Adds idprova-trust-registry: curated, offline-verifiable signed TrustList (sovereign/air-gapped) plus a federation spec (append-only signed log, Merkle consistency proofs) and a cross-standard resolver (Web Bot Auth / AP2 / MCP OAuth / Entra -> did:aid). Owns the verified whitespace: no vendor-neutral multi-operator agent registry exists. Design-only skeleton + DESIGN-pillar-b.md (incl. FEDERATION-SPEC) + SPEC.md. Co-Authored-By: TechBlaze <info@techblaze.com.au>
… store, Merkle federation proofs, resolver
Turns the Pillar B design skeleton into a working OPEN library:
- store: SQLite (rusqlite+r2d2) issuer store + time-windowed may_attest
- authority: curated TrustList JCS-sign (Ed25519) + offline verify_signed_list
(sign/verify canonicalize the identical TrustList{proof:None} -> deterministic)
- federation: RFC 6962-style BLAKE3 Merkle log — inclusion + consistency proof
generation AND verification, signed tree heads; mirror() is a documented
open-core boundary stub (live multi-operator sync = operator/enterprise edition)
- resolver: DidAidBackend resolves did:aid against the store
- api: wires /trust-list, /issuers, /issuers/:did, /resolve handlers
- 10 tests (sign/verify, store, may_attest rules, Merkle inclusion + consistency
incl. complete-subtree seed branch, STH, resolver, boundary stub)
Open-core line held: library open; governance/RBAC/HSM/admission-workflow and
live federation management stay in the separate commercial component.
Co-Authored-By: TechBlaze <info@techblaze.com.au>
pratyushsood24
force-pushed
the
feat/pillar-b-issuer-trust-registry
branch
from
June 26, 2026 23:10
8105370 to
d21c519
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pillar B —
idprova-trust-registry(neutral Issuer Trust Registry + cross-standard resolver)Third of the three KYA commercial-spine pillars (A merged in #76; C in #77). This turns the design skeleton into a working OPEN library.
Open-core boundary (held)
Per the accepted open-core decision, the free/paid line is at operation/governance/scale — never the protocol or verify path. This public crate ships the open library; the commercial operator/enterprise edition (governance workflow, RBAC/SCIM, HSM custody, multi-operator federation management, live mirroring) stays in a separate component.
What's implemented (open primitives)
store— SQLite (rusqlite+r2d2) issuer store; parameterized queries; time-windowedmay_attest(Active + within validity window + claim incredential_types).authority— curated TrustList JCS-sign (Ed25519) + offlineverify_signed_list. Sign and verify canonicalize the identicalTrustList { proof: None }struct → deterministic by construction (no hand-built JSON drift).federation— RFC 6962-style BLAKE3 Merkle log: inclusion + consistency proof generation AND verification, signed tree heads (sign/verify oversize ‖ root ‖ sequence). Domain-separated leaf (0x00) / node (0x01) hashing.mirror()is a documented open-core boundary stub (validates the peer URL via the SSRF guard, then returns the operator-edition error).resolver—DidAidBackendresolvesdid:aid:against the trust store; other envelope variants returnNone(cross-standard mapping table is a documented follow-up).api— wiresGET /trust-list(signed),GET /issuers/:did,GET /issuers?claim_type=,POST /resolve,GET /healthz.Tests (10, all green locally)
sign/verify round-trip + tamper; store round-trip + claim filter;
may_attestrules (Active/Suspended/expired/wrong-claim); Merkle inclusion + tamper; consistency (3→7 non-complete and 4→7 / 2→3 complete-subtree seed branch); STH sign/verify; resolver did:aid; boundary stub.CI hygiene
cargo clippy -p idprova-trust-registry --all-targets -- -D warnings→ cleancargo fmt -p idprova-trust-registry -- --check→ cleanmain(post-feat(webbotauth): Pillar A — RFC 9421 Web Bot Auth (conformant, Appendix-B verified) #76); SPEC relocated tocrates/idprova-trust-registry/SPEC.md.Build provenance
Codegen by the GLM worker (z.ai glm-5.2) under the orchestrate/review model; Claude reviewed every module and rewrote the consistency-proof verifiers +
main.rs, and added the complete-subtree test.Follow-ups (non-blocking)
did:aidmapping table (WBA keyid / AP2 / MCP / Entra).signer_keyidis hex; multibase for consistency with A/C later.