Repository navigation
feat(cycles): offline verifier for the Cycles rail, release 4.3.0 - #27
Merged
Merged
Conversation
Port of the agent-passport-system 8.0.0 Cycles rail, offline path only. Adds receipt and denial types, map_cycles_denial_to_foundation with its constant tables, sign and verify for permit, release and denial, and the envelope checks (hash binding, envelope signature, 8.0.0 correspondence). Malformed, non-JSON, deeply nested and self-referencing input returns a structured failure and does not raise. Not ported: async DID variants, fetch and resolver path, did:cycles and JWKS key resolution, signer authority. Signed-off-by: Tymofii Pidlisnyi <tima@aeoess.com>
Vendors cycles-correspondence-vectors.json byte for byte from agent-passport-system ababe0f and asserts all 13 cases, plus byte for byte re-signing of every vector receipt. Ports the offline tests from cycles.test.ts and adds Python fail-closed tests. Signed-off-by: Tymofii Pidlisnyi <tima@aeoess.com>
Adds the 4.3.0 changelog entry for the Cycles offline verifier. Signed-off-by: Tymofii Pidlisnyi <tima@aeoess.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Cycles budget-authority rail to the Python SDK, offline path only, as a port of
agent-passport-system8.0.0 behaviour. The Python SDK had no payment rails before this.New module
agent_passport.v2.payment_rails.cycles, also exported from the package root:sign_cycles_permit_receipt,sign_cycles_release_receipt,sign_cycles_denialverify_cycles_permit_receipt,verify_cycles_release_receipt,verify_cycles_denial, synchronous, optionsevidence,expected_signer,now,ttl_secondsmap_cycles_denial_to_foundationwith the ErrorCode and DecisionReasonCode tables ported entry for entryWith a supplied envelope the checks run in the TypeScript order: content hash binding, the envelope's own Ed25519 signature, then the 8.0.0 correspondence check for permit and release (stage and
reservation_idonly). Denials get no correspondence check. Malformed receipts and envelopes return a structured failure and do not raise.Evidence
tests/cross_impl/cycles-correspondence-vectors.jsonis vendored byte for byte from agent-passport-systemababe0f(#237), all 13 cases pass. The test also re-signs each vector receipt and re-signed envelope from the published test seeds and matches the TypeScript signatures byte for byte.cycles.test.tsfor the offline path.matched, the 9 negative correspondence vectors fail and the 4 others pass.python -m pytest tests/ -q: 2753 passed, 9 skipped before, 2899 passed, 9 skipped after.Boundary
Out of scope: the async DID variants, the evidence fetch and resolver path,
did:cyclesand JWKS key resolution, and signer authority. Differences from TypeScript, all listed in the CHANGELOG: stricter RFC 3339 parsing ofissued_at, input capture for denials as well, a fail-closed bound of 200 nesting levels and 200000 values, andTypeErrorfor wrong-typed options.Version 4.3.0 is in its own commit.