[jhateley-godaddy]

Summary

feat(pop): ANS-6 Method B — application-layer proof of possession (DPoP + SCITT)

Summary

This PR adds application-layer, agent-to-agent authentication to the SDK. It
implements ANS-6 Method B. The caller proves that it holds its ANS Identity
Certificate key with an RFC 9449 DPoP proof. The proof travels in an HTTP header
over normal server-authenticated HTTPS. The proof binds to the Transparency Log
SCITT artifacts: the receipt and the status token. No client certificate is in
the TLS handshake, so the proof survives L7 proxies and gateways that terminate
TLS. Method B needs no authorization server and makes no per-request
Transparency Log query.

New modules

Module	Role	Published
ans-sdk-pop	Core signer and verifier	Yes
ans-sdk-pop-spring	Spring servlet filter for the callee side	Yes
ans-sdk-pop-spring/examples/dpop-scitt-auth	Client and server example you can run	No

Caller side (mint and send)

• PopSigner mints proofs. The header holds exactly typ, alg (ES256),
  jwk, and x5c (one leaf). The claims are htm, htu, iat, jti
  (128-bit), and ans_profile=1, plus optional ath (§7.8) and
  ans_content_digest (§7.13). At build time it checks that the private key
  matches the certificate key.
• PopHttp.attachIdentity attaches the DPoP header and the SCITT headers.
  accessTokenFromAuthorization gives the callee one parser for the
  Authorization: DPoP <token> value.

Callee side (verify)

• CallerVerifier composes the three proofs — possession (DPoP), liveness
  (status token), and identity (receipt) — in the §7.4 order. It runs the §7.5
  binding:

  • The proof certificate fingerprint must be in the status token
    validIdentityCerts.
  • The certificate ans:// SAN host must equal the status token host.
  • The receipt leaf must name the same agent.

  It records the jti last, only after every other check passes (fail-closed).

• DpopProofVerifier decodes the header strictly. It compares jwk to
  x5c[0] byte-for-byte before any signature work, checks certificate validity,
  and accepts ES256 only.

• CaffeineReplayCache is bounded and fails closed at capacity. It uses an
  atomic check-and-store and stores a digest of the jti.

• PopAuthenticationFilter enforces the §7.7 authority requirement. It fails
  startup when neither withExternalUrl(...) nor withTrustedHosts(...) is set,
  so htu never comes from the client Host header. It rejects duplicate
  security headers and supports a peer allowlist through CallerPolicy.

Build

• Registers ans-sdk-pop and ans-sdk-pop-spring as publishable modules (the
  90% coverage rule applies).
• Raises Bouncy Castle to 1.84 and Caffeine to 3.2.0.

Scope

This PR is 44 files, +5,533 / −3 against the merge base (d3c7328), across 13
commits. All commits are GPG-signed and carry the DCO Signed-off-by trailer.
The four modified files are all build wiring (settings.gradle.kts,
build.gradle.kts, gradle.properties,
ans-sdk-spring-boot-starter/build.gradle.kts). Everything else is new.

Testing

Unit tests cover the signer, verifier, proof, replay cache, HTTP helpers, policy,
and the Spring filter.
Local end to end tests carried out against RA/TL ref implementation

AI assistance

Checklist

• The PR title follows Conventional Commits — release notes are generated from it
• Tests cover the change
• The linked issue above uses a closing keyword
• Every commit is signed off (git commit -s) certifying the DCO

[bchen-godaddy]

LGTM

[kperry-godaddy]

The Method B pipeline itself holds up: closed JOSE header, jwk matched to x5c[0] before any signature work, certificate validity, the SCITT binding, and a replay cache that fails closed and records the jti last are all in place and read cleanly. What shapes my read is timing. ANS-6 changed under this branch: the text merged on 2026-09-14 (ans-registry a6dcb07, five days after the last commit here) makes ans_content_digest REQUIRED on every proof, with the empty-content digest for bodiless requests, verified after the SCITT binding. The code implements the 2026-08-31 draft where the claim was opt-in, so today the filter rejects every proof from a conformant signer (the Go pop package always emits the claim) while accepting digest-less proofs with the body unbound, and proofs minted through PopHttp.attachIdentity are rejected by the Go verifier. Since CallerOptions, VerifyOptions and PopSigner.sign become published API with this PR, I'd land the digest change here rather than as a breaking follow-up.

Nine things worth a look, all inline. Four carry suggestions you can commit as-is (the verifier method, the signer line, the filter's authority derivation, and the HTTP helper); the other five need a wider change, so they are sketched. Six of the nine are one thread, the content digest seen from the signer, options, verifier, filter and helper, and land best as a single change set together with the inverted tests and the §10 vectors.

Two calls are yours, and the comments depend on them: the error category for a proof with no digest (I lean MALFORMED_PROOF, matching §7.4 step 2 and the Go reference, over CONTENT_BINDING_MISMATCH), and whether a null body hash on the callee side means "no content" (Go's reading) or a misconfiguration.

Spec text as merged: https://github.com/agentnameservice/ans-registry/blob/a6dcb0789b3710c4b367fd53b7f91c5adf120965/spec/ans-6-agent-authentication.md