missionweaveprotocol

package module
v0.0.0-...-80c3985 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 1, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

README

English | 简体中文 | 繁體中文 | 日本語 | Español | Français | Deutsch

MissionWeaveProtocol Go SDK

MissionWeaveProtocol icon

Official website and documentation

The MissionWeaveProtocol Go SDK provides schema-first Go bindings for MissionWeaveProtocol 0.1. The Go module is github.com/missionweaveprotocol/go-sdk, and its root package is missionweaveprotocol.

This release demonstrates schema-and-vector conformance. It does not claim behavioral conformance for an authoritative Core, Agent runtime, Worker Scheduler, Group gateway, persistence, or the complete Mission/WorkItem state machine.

Protocol compatibility

Go SDK MissionWeaveProtocol
0.1.x 0.1

SDK and protocol versions are independent. PROTOCOL_PIN.json records the exact protocol commit plus SHA-256 digests for the vendored schemas and conformance vectors. This release is pinned to protocol commit f7e70a72c76bbeb5014c186cd820aac2112f0dde; the vendored Admission contract contains 30 evaluations and has digest sha256:39971bfafb68ef6c18f9026220cccc4f023fd4d5c8074f8ff0276cb1129cd0a0.

Requirements and installation

Go 1.24 or newer is required.

go get github.com/missionweaveprotocol/go-sdk@latest

Included capabilities

  • byte-exact embedded protocol pin, 22 Draft 2020-12 schemas, and 58 conformance vectors;
  • verification of schema, conformance, and combined bundle digests;
  • strict UTF-8 JSON parsing with recursive duplicate-member rejection;
  • offline $id schema resolution with format assertions and ECMAScript-compatible patterns;
  • an embedded or caller-supplied fs.FS SchemaCatalog;
  • a 58-vector conformance runner and missionweaveprotocol-conformance command;
  • RFC 8785 JSON canonicalization and sha256: content identifiers;
  • Ed25519 signing and verification with unpadded base64url values;
  • signing payloads that exclude only the top-level signature member;
  • SignedDocumentCodec coverage for all 22 cryptography cases and 62 evaluations;
  • AdmissionService coverage for all 5 Admission cases and 30 evaluations (12 complete, 18 rejected);
  • a generic, schema-validating, canonical FrameCodec for WebSocket frames.

Verify the embedded protocol bundle

if err := missionweaveprotocol.VerifyProtocolBundle(); err != nil {
    log.Fatal(err)
}
if err := missionweaveprotocol.VerifyCryptographyBundle(); err != nil {
    log.Fatal(err)
}
admission, err := missionweaveprotocol.VerifyAdmissionBundle()
if err != nil {
    log.Fatal(err)
}

pin, err := missionweaveprotocol.CurrentProtocolPin()
if err != nil {
    log.Fatal(err)
}
fmt.Println(pin.ProtocolVersion, pin.Commit, admission.EvaluationCount)

Validate a protocol document

catalog, err := missionweaveprotocol.NewEmbeddedSchemaCatalog()
if err != nil {
    log.Fatal(err)
}

if err := catalog.Validate("command.schema.json", commandJSON); err != nil {
    log.Fatal(err)
}

NewSchemaCatalog(source fs.FS) provides the same Interface for an unpacked protocol checkout or release bundle. Every schema is registered by $id before compilation; unresolved references never fall back to the network.

Encode and decode WebSocket frames

codec, err := missionweaveprotocol.NewFrameCodec()
if err != nil {
    log.Fatal(err)
}

frame, err := codec.DecodeFrame(frameJSON)
if err != nil {
    log.Fatal(err)
}

canonicalFrame, err := codec.EncodeFrame(frame)
if err != nil {
    log.Fatal(err)
}

DecodeFrame rejects malformed UTF-8, duplicate JSON members, unknown frame variants, extra fields, and schema-invalid content. EncodeFrame validates before returning canonical RFC 8785 JSON.

Canonicalize, hash, and sign

canonical, err := missionweaveprotocol.CanonicalizeJSON(document)
hash, err := missionweaveprotocol.CanonicalHash(document)
signature, err := missionweaveprotocol.SignDocument(privateKey, document)
verified, err := missionweaveprotocol.VerifyDocument(publicKey, document, signature)

CanonicalizeJSON, CanonicalHash, and the document-signing Interface accept JSON bytes and do not apply custom conversions for Go values such as time.Time. MarshalCanonicalJSON is an explicit convenience that applies standard encoding/json marshaling before JCS. SignDocument and VerifyDocument remove the top-level signature member before canonicalization; nested members with that name remain signed.

Sign and verify Signed Documents

SignedDocumentCodec implements the ordered cryptographic profile for exactly nine explicit document kinds:

codec, err := missionweaveprotocol.NewSignedDocumentCodec()
signed, err := codec.Sign(missionweaveprotocol.SignedDocumentCommand, unsigned, signingKey)
verified, err := codec.Verify(missionweaveprotocol.SignedDocumentCommand, raw, keyResolver)
fmt.Println(signed["signature"], verified.SigningHash(), verified.ResolvedKey().Principal())

SigningKey is the only signing adapter. KeyResolver receives a KeyResolutionRequest and must return a KeyRegistrySnapshot whose completeness is explicitly KeyRegistryOrganizationWide; partial or unspecified Agent Registry snapshots fail closed. Verification errors expose only a stable WireCode() to peers, while ProtectedDiagnostic() retains the first failing stage and reason for local operators. See the runnable test-fixture example in examples/sign.

First admission and historical trust

AdmissionService.AdmitFirst reruns all six Signed Document verification stages with current Registry evidence before consulting an authenticated, append-only Admission Log. VerifyHistoricalAdmission reruns the same verifier with retained Registry history and requires an existing validated record. AdmissionCurrentKeyResolver.ResolveCurrent is the explicit trust seam for new admissions; historical replay continues to use KeyResolver. The API accepts typed adapters, never caller-provided trust booleans.

admitted, err := missionweaveprotocol.NewAdmissionService().AdmitFirst(
    missionweaveprotocol.SignedDocumentCommand,
    commandBytes,
    currentRegistry,
    admissionLog,
    trustedContext,
)
if err != nil {
    log.Fatal(err)
}
fmt.Println(admitted.Record().AdmissionRecordID(), admitted.Verified().SigningHash())

Run conformance

Run against the embedded protocol bundle:

go run github.com/missionweaveprotocol/go-sdk/cmd/missionweaveprotocol-conformance@latest

Or run against a protocol checkout or release bundle:

go run ./cmd/missionweaveprotocol-conformance --root ../missionweaveprotocol

Success reports 58/58 conformance vectors passed. The command exits non-zero for a validity mismatch, malformed vector, missing resource, or schema compilation error.

Examples and development

go run ./examples/validate
go run ./examples/sign
go run ./internal/cmd/repository-policy
go test -race ./...
go vet ./...
go build ./...

The CI gate also verifies formatting, canonical naming, both embedded and checkout conformance, a compiled-binary resource smoke test, and a public-API consumer in a separate Go module.

Scope

The normative protocol repository remains the source of truth. This SDK intentionally does not copy the Python reference implementation's server, database adapters, scheduling algorithm, local runtime, or internal projection models. Future runtime features require their own behavioral conformance work and will be documented separately.

License

Licensed under Apache-2.0.

Documentation

Overview

Package missionweaveprotocol provides Go bindings for MissionWeaveProtocol.

Index

Constants

View Source 
const SDKVersion = "0.1.0"

SDKVersion is the independently versioned Go SDK release line.

Variables

This section is empty.

Functions

func CanonicalHash 

func CanonicalHash(document []byte) (string, error)

CanonicalHash returns a lowercase SHA-256 content identifier over canonical JSON bytes.

func CanonicalizeJSON 

func CanonicalizeJSON(document []byte) ([]byte, error)

CanonicalizeJSON returns the RFC 8785 JSON Canonicalization Scheme representation of one strict JSON document.

func DecodeJSON 

func DecodeJSON(document []byte) (any, error)

DecodeJSON parses one strict UTF-8 JSON value while preserving numbers and rejecting duplicate object member names at every nesting level.

func DocumentSigningPayload 

func DocumentSigningPayload(document []byte) ([]byte, error)

DocumentSigningPayload removes the top-level signature member and canonicalizes the remaining JSON object.

func MarshalCanonicalJSON 

func MarshalCanonicalJSON(value any) ([]byte, error)

MarshalCanonicalJSON serializes a Go value and returns its RFC 8785 representation.

func ProtocolFS 

func ProtocolFS() fs.FS

ProtocolFS returns the immutable embedded protocol artifact filesystem.

func ReadProtocolFile 

func ReadProtocolFile(name string) ([]byte, error)

ReadProtocolFile reads one embedded protocol file by its repository-relative logical path.

func SignBytes 

func SignBytes(privateKey ed25519.PrivateKey, message []byte) (string, error)

SignBytes signs bytes with Ed25519 and returns unpadded base64url.

func SignDocument 

func SignDocument(privateKey ed25519.PrivateKey, document []byte) (string, error)

SignDocument signs a protocol document after excluding its top-level signature member.

func VerifyBytes 

func VerifyBytes(publicKey ed25519.PublicKey, message []byte, signature string) (bool, error)

VerifyBytes verifies an unpadded base64url Ed25519 signature.

func VerifyCryptographyBundle 

func VerifyCryptographyBundle() error

VerifyCryptographyBundle verifies the independent signed-document cryptography manifest and every digest-protected artifact embedded with this SDK build.

func VerifyDocument 

func VerifyDocument(publicKey ed25519.PublicKey, document []byte, signature string) (bool, error)

VerifyDocument verifies a protocol document after excluding its top-level signature member.

func VerifyProtocolBundle 

func VerifyProtocolBundle() error

VerifyProtocolBundle verifies file counts and all three digests from PROTOCOL_PIN.json.

Types

type AdmissionAdapterError 

type AdmissionAdapterError struct {
	// contains filtered or unexported fields
}

AdmissionAdapterError carries one stable protected reason from a trusted deployment adapter.

func NewAdmissionAdapterError 

func NewAdmissionAdapterError(reason AdmissionReason, detail string) *AdmissionAdapterError

NewAdmissionAdapterError creates a typed adapter failure that AdmissionService can remap.

func (*AdmissionAdapterError) Error 

func (failure *AdmissionAdapterError) Error() string

Error returns protected local adapter detail. AdmissionService never exposes it on the wire.

func (*AdmissionAdapterError) Reason 

func (failure *AdmissionAdapterError) Reason() AdmissionReason

Reason returns the stable protected failure classification.

type AdmissionBundleSummary 

type AdmissionBundleSummary struct {
	SourceCommit               string
	ProfileID                  string
	ManifestVersion            int
	CryptographyArtifactDigest string
	ArtifactDigest             string
	ArtifactCount              int
	CaseCount                  int
	EvaluationCount            int
}

AdmissionBundleSummary reports the verified identity and counts of the embedded Admission bundle.

func VerifyAdmissionBundle 

func VerifyAdmissionBundle() (AdmissionBundleSummary, error)

VerifyAdmissionBundle verifies the independent Admission manifest and every digest-protected artifact embedded with this SDK build.

type AdmissionContextValue 

type AdmissionContextValue struct {
	AdmissionRecordID string
	TrustedAcceptedAt string
	AcceptedBy        Principal
}

AdmissionContextValue is trusted deployment context issued only after authoritative absence.

type AdmissionCurrentKeyResolver 

type AdmissionCurrentKeyResolver interface {
	ResolveCurrent(request KeyResolutionRequest) (KeyRegistrySnapshot, error)
}

AdmissionCurrentKeyResolver asserts that complete Registry evidence is current for admission.

type AdmissionDiagnostic 

type AdmissionDiagnostic struct {
	// contains filtered or unexported fields
}

AdmissionDiagnostic is protected local evidence that must not be relayed to peers.

func (AdmissionDiagnostic) Reason 

func (diagnostic AdmissionDiagnostic) Reason() AdmissionReason

Reason returns the stable protected Admission rejection reason.

func (AdmissionDiagnostic) Stage 

func (diagnostic AdmissionDiagnostic) Stage() string

Stage returns the Admission semantic stage.

type AdmissionError 

type AdmissionError struct {
	// contains filtered or unexported fields
}

AdmissionError is a deliberately non-oracular Admission-stage failure.

func (*AdmissionError) Error 

func (failure *AdmissionError) Error() string

Error exposes only the stable wire classification.

func (*AdmissionError) ProtectedDiagnostic 

func (failure *AdmissionError) ProtectedDiagnostic() AdmissionDiagnostic

ProtectedDiagnostic returns local Admission failure evidence.

func (*AdmissionError) WireCode 

func (failure *AdmissionError) WireCode() WireErrorCode

WireCode returns the stable error safe to place on the protocol wire.

type AdmissionLog 

type AdmissionLog interface {
	Lookup(organizationID, signingHash string) (AdmissionLookup, error)
	AppendOrReturnExisting(
		organizationID string,
		signingHash string,
		candidateBytes []byte,
	) (AuthenticatedAdmissionRecord, error)
}

AdmissionLog is the trusted append-only deployment seam used after six-stage verification.

type AdmissionLookup 

type AdmissionLookup struct {
	Record               *AuthenticatedAdmissionRecord
	AuthoritativeAbsence bool
}

AdmissionLookup contains exactly one found record or authoritative absence.

type AdmissionPin 

type AdmissionPin struct {
	Path                       string `json:"path"`
	SourceCommit               string `json:"sourceCommit"`
	ProfileID                  string `json:"profileId"`
	ManifestVersion            int    `json:"manifestVersion"`
	CryptographyArtifactDigest string `json:"cryptographyArtifactDigest"`
	ArtifactDigest             string `json:"artifactDigest"`
	ArtifactCount              int    `json:"artifactCount"`
	CaseCount                  int    `json:"caseCount"`
	EvaluationCount            int    `json:"evaluationCount"`
}

AdmissionPin identifies the independent First-Admission and historical-trust bundle.

type AdmissionReason 

type AdmissionReason string

AdmissionReason is protected local evidence for an Admission-stage rejection. 

const (
	AdmissionRecordMissing                 AdmissionReason = "record-missing"
	AdmissionRecordBindingMismatch         AdmissionReason = "record-binding-mismatch"
	AdmissionTrustedTimeOutsideKeyInterval AdmissionReason = "trusted-time-outside-key-interval"
	AdmissionMalformedTrustedTime          AdmissionReason = "malformed-trusted-time"
	AdmissionRecordConflict                AdmissionReason = "record-conflict"
	AdmissionRecordSchemaInvalid           AdmissionReason = "record-schema-invalid"
	AdmissionLogAuthenticationFailed       AdmissionReason = "log-authentication-failed"
	AdmissionAppendIntegrityNotEstablished AdmissionReason = "append-integrity-not-established"
	AdmissionLogUnavailable                AdmissionReason = "log-unavailable"
	AdmissionLogIndeterminate              AdmissionReason = "log-indeterminate"
	AdmissionCommitFailed                  AdmissionReason = "commit-failed"
	AdmissionEventSelfAnchoring            AdmissionReason = "event-self-anchoring"
)

type AdmissionService 

type AdmissionService struct {
	// contains filtered or unexported fields
}

AdmissionService orchestrates First Admission and historical replay above six-stage verification.

func NewAdmissionService 

func NewAdmissionService() *AdmissionService

NewAdmissionService constructs a service over the exact embedded protocol schemas.

func (*AdmissionService) AdmitFirst 

func (service *AdmissionService) AdmitFirst(
	kind SignedDocumentKind,
	documentBytes []byte,
	registry AdmissionCurrentKeyResolver,
	log AdmissionLog,
	trustedContext TrustedAdmissionContext,
) (*AdmittedSignedDocument, error)

AdmitFirst verifies synchronously before consulting or mutating the Admission Log.

func (*AdmissionService) PrepareFirstAdmission 

func (service *AdmissionService) PrepareFirstAdmission(
	verified *VerifiedSignedDocument,
	trustedContext TrustedAdmissionContext,
) (*PreparedFirstAdmission, error)

PrepareFirstAdmission issues and validates one candidate after authoritative absence.

func (*AdmissionService) VerifyHistoricalAdmission 

func (service *AdmissionService) VerifyHistoricalAdmission(
	kind SignedDocumentKind,
	documentBytes []byte,
	registry KeyResolver,
	log AdmissionLog,
) (*AdmittedSignedDocument, error)

VerifyHistoricalAdmission reruns six-stage verification and never creates a missing record.

type AdmittedSignedDocument 

type AdmittedSignedDocument struct {
	// contains filtered or unexported fields
}

AdmittedSignedDocument is immutable six-stage and First-Admission evidence.

func (*AdmittedSignedDocument) Record 

func (admitted *AdmittedSignedDocument) Record() FirstAdmissionRecord

func (*AdmittedSignedDocument) RecordBytes 

func (admitted *AdmittedSignedDocument) RecordBytes() []byte

func (*AdmittedSignedDocument) Verified 

func (admitted *AdmittedSignedDocument) Verified() *VerifiedSignedDocument

type AuthenticatedAdmissionRecord 

type AuthenticatedAdmissionRecord struct {
	RecordBytes          []byte
	AuthenticatedService Principal
}

AuthenticatedAdmissionRecord is one record returned through an authenticated Admission Log.

type ConformanceReport 

type ConformanceReport struct {
	Results []VectorResult
}

ConformanceReport records every manifest result.

func RunConformance 

func RunConformance(source fs.FS) (ConformanceReport, error)

RunConformance validates the complete manifest found in source using an offline SchemaCatalog.

func RunEmbeddedConformance 

func RunEmbeddedConformance() (ConformanceReport, error)

RunEmbeddedConformance validates the complete protocol bundle embedded in this SDK build.

func (ConformanceReport) Passed 

func (report ConformanceReport) Passed() bool

Passed reports whether every conformance vector matched its expected validity.

func (ConformanceReport) Summary 

func (report ConformanceReport) Summary() string

Summary returns the stable human-readable conformance count.

type CryptographyPin 

type CryptographyPin struct {
	Path            string `json:"path"`
	SourceCommit    string `json:"sourceCommit"`
	ProfileID       string `json:"profileId"`
	ManifestVersion int    `json:"manifestVersion"`
	ArtifactDigest  string `json:"artifactDigest"`
	ArtifactCount   int    `json:"artifactCount"`
	CaseCount       int    `json:"caseCount"`
	EvaluationCount int    `json:"evaluationCount"`
}

CryptographyPin identifies the independent signed-document cryptography bundle.

type DocumentValidationError 

type DocumentValidationError struct {
	Schema string
	Cause  error
}

DocumentValidationError reports that a JSON document failed strict parsing or one normative schema.

func (*DocumentValidationError) Error 

func (e *DocumentValidationError) Error() string

func (*DocumentValidationError) Unwrap 

func (e *DocumentValidationError) Unwrap() error

type ExpectedSigner 

type ExpectedSigner struct {
	Rule      ExpectedSignerRule
	Principal Principal
}

ExpectedSigner is the signer identity evidence supplied to a KeyResolver request. Principal is populated only for ExpectedSignerExactPrincipal.

type ExpectedSignerRule 

type ExpectedSignerRule string

ExpectedSignerRule describes the signer identity constraint already derived from the document. 

const (
	ExpectedSignerExactPrincipal   ExpectedSignerRule = "exact-principal"
	ExpectedSignerServicePrincipal ExpectedSignerRule = "service-principal"
)

type FirstAdmissionRecord 

type FirstAdmissionRecord struct {
	// contains filtered or unexported fields
}

FirstAdmissionRecord is immutable parsed First-Admission evidence.

func (FirstAdmissionRecord) AcceptedBy 

func (record FirstAdmissionRecord) AcceptedBy() Principal

func (FirstAdmissionRecord) AdmissionRecordID 

func (record FirstAdmissionRecord) AdmissionRecordID() string

func (FirstAdmissionRecord) DocumentKind 

func (record FirstAdmissionRecord) DocumentKind() SignedDocumentKind

func (FirstAdmissionRecord) KeyID 

func (record FirstAdmissionRecord) KeyID() string

func (FirstAdmissionRecord) OrganizationID 

func (record FirstAdmissionRecord) OrganizationID() string

func (FirstAdmissionRecord) Principal 

func (record FirstAdmissionRecord) Principal() Principal

func (FirstAdmissionRecord) ProtocolVersion 

func (record FirstAdmissionRecord) ProtocolVersion() string

func (FirstAdmissionRecord) SigningHash 

func (record FirstAdmissionRecord) SigningHash() string

func (FirstAdmissionRecord) TrustedAcceptedAt 

func (record FirstAdmissionRecord) TrustedAcceptedAt() string

type FrameCodec 

type FrameCodec struct {
	// contains filtered or unexported fields
}

FrameCodec canonicalizes and schema-validates generic MissionWeaveProtocol WebSocket frames.

func NewFrameCodec 

func NewFrameCodec() (*FrameCodec, error)

NewFrameCodec constructs a codec over the protocol schemas embedded in this SDK build.

func (*FrameCodec) DecodeFrame 

func (codec *FrameCodec) DecodeFrame(document []byte) (map[string]any, error)

DecodeFrame strictly parses and validates one UTF-8 JSON frame.

func (*FrameCodec) EncodeFrame 

func (codec *FrameCodec) EncodeFrame(frame map[string]any) ([]byte, error)

EncodeFrame validates one generic frame and returns canonical RFC 8785 JSON.

type KeyRegistryCompleteness 

type KeyRegistryCompleteness string

KeyRegistryCompleteness states the scope over which Registry uniqueness can be proven. 

const (
	// KeyRegistryOrganizationWide asserts that the snapshot contains every signing-key binding in
	// the organization, which is required to detect key reuse and aliases.
	KeyRegistryOrganizationWide KeyRegistryCompleteness = "organization-wide"
)

type KeyRegistrySnapshot 

type KeyRegistrySnapshot struct {
	Completeness  KeyRegistryCompleteness
	RegistryBytes []byte
}

KeyRegistrySnapshot is raw Agent Registry evidence plus an explicit completeness assertion. The codec fails closed unless Completeness is KeyRegistryOrganizationWide.

type KeyResolutionRequest 

type KeyResolutionRequest struct {
	Kind           SignedDocumentKind
	KeyID          string
	ExpectedSigner ExpectedSigner
	ProtectedTime  ProtectedSignedTime
}

KeyResolutionRequest gives a resolver enough context to select the correct organization-wide Registry without delegating any normative validation to it.

type KeyResolver 

type KeyResolver interface {
	Resolve(request KeyResolutionRequest) (KeyRegistrySnapshot, error)
}

KeyResolver is the sole application adapter used during Signed Document verification. It must return a complete organization-wide Agent Registry snapshot/history; the codec, not the adapter, validates and resolves that Registry.

type PinnedArtifact 

type PinnedArtifact struct {
	Path   string `json:"path"`
	Files  int    `json:"files"`
	SHA256 string `json:"sha256"`
}

PinnedArtifact records one byte-exact protocol artifact tree.

type PreparedFirstAdmission 

type PreparedFirstAdmission struct {
	// contains filtered or unexported fields
}

PreparedFirstAdmission is immutable candidate evidence produced before an atomic append.

func (*PreparedFirstAdmission) Record 

func (prepared *PreparedFirstAdmission) Record() FirstAdmissionRecord

func (*PreparedFirstAdmission) RecordBytes 

func (prepared *PreparedFirstAdmission) RecordBytes() []byte

func (*PreparedFirstAdmission) Verified 

func (prepared *PreparedFirstAdmission) Verified() *VerifiedSignedDocument

type Principal 

type Principal struct {
	Type string
	ID   string
}

Principal identifies the organization Principal bound to a resolved signing key.

type ProtectedSignedTime 

type ProtectedSignedTime struct {
	Text    string
	Instant RFC3339Instant
}

ProtectedSignedTime retains both exact timestamp text and its arbitrary-precision instant.

type ProtocolPin 

type ProtocolPin struct {
	Repository      string                    `json:"repository"`
	Commit          string                    `json:"commit"`
	ProtocolVersion string                    `json:"protocolVersion"`
	WireNamespace   string                    `json:"wireNamespace"`
	Artifacts       map[string]PinnedArtifact `json:"artifacts"`
	Cryptography    CryptographyPin           `json:"cryptography"`
	Admission       AdmissionPin              `json:"admission"`
	BundleSHA256    string                    `json:"bundleSha256"`
}

ProtocolPin identifies the normative protocol source and its vendored artifact digests.

func CurrentProtocolPin 

func CurrentProtocolPin() (ProtocolPin, error)

CurrentProtocolPin loads the metadata embedded with this SDK build.

type RFC3339Instant 

type RFC3339Instant struct {
	// contains filtered or unexported fields
}

RFC3339Instant represents an RFC 3339 instant without truncating fractional-second precision. Its fields are private so copies cannot mutate evidence retained by a verified result.

func (RFC3339Instant) EpochSecond 

func (instant RFC3339Instant) EpochSecond() int64

EpochSecond returns whole UTC seconds since 1970-01-01T00:00:00Z.

func (RFC3339Instant) Fraction 

func (instant RFC3339Instant) Fraction() string

Fraction returns fractional-second digits with insignificant trailing zeroes removed.

type ResolvedKeyEvidence 

type ResolvedKeyEvidence struct {
	// contains filtered or unexported fields
}

ResolvedKeyEvidence is immutable evidence selected from a fully validated Agent Registry snapshot.

func (ResolvedKeyEvidence) Algorithm 

func (key ResolvedKeyEvidence) Algorithm() string

Algorithm returns the resolved key algorithm.

func (ResolvedKeyEvidence) KeyID 

func (key ResolvedKeyEvidence) KeyID() string

KeyID returns the resolved immutable key identifier.

func (ResolvedKeyEvidence) OrganizationID 

func (key ResolvedKeyEvidence) OrganizationID() string

OrganizationID returns the Registry organization identifier.

func (ResolvedKeyEvidence) Principal 

func (key ResolvedKeyEvidence) Principal() Principal

Principal returns the exact Principal bound to the key.

func (ResolvedKeyEvidence) PublicKeyBytes 

func (key ResolvedKeyEvidence) PublicKeyBytes() []byte

PublicKeyBytes returns a copy of the decoded 32-byte public key.

func (ResolvedKeyEvidence) PublicKeyText 

func (key ResolvedKeyEvidence) PublicKeyText() string

PublicKeyText returns the canonical base64url public-key spelling from the Registry.

func (ResolvedKeyEvidence) RevokedAt 

func (key ResolvedKeyEvidence) RevokedAt() (RFC3339Instant, bool)

RevokedAt returns the effective exclusive revocation boundary, if present.

func (ResolvedKeyEvidence) RevokedAtText 

func (key ResolvedKeyEvidence) RevokedAtText() (string, bool)

RevokedAtText returns the first lexical spelling of the effective exclusive revocation boundary.

func (ResolvedKeyEvidence) ValidFrom 

func (key ResolvedKeyEvidence) ValidFrom() RFC3339Instant

ValidFrom returns the inclusive key-validity boundary.

func (ResolvedKeyEvidence) ValidFromText 

func (key ResolvedKeyEvidence) ValidFromText() string

ValidFromText returns the first lexical spelling of the inclusive validity boundary.

func (ResolvedKeyEvidence) ValidUntil 

func (key ResolvedKeyEvidence) ValidUntil() (RFC3339Instant, bool)

ValidUntil returns the effective exclusive expiry boundary, if present.

func (ResolvedKeyEvidence) ValidUntilText 

func (key ResolvedKeyEvidence) ValidUntilText() (string, bool)

ValidUntilText returns the first lexical spelling of the effective exclusive expiry boundary.

type SchemaCatalog 

type SchemaCatalog struct {
	// contains filtered or unexported fields
}

SchemaCatalog owns one fully resolved, offline set of normative schemas.

func NewEmbeddedSchemaCatalog 

func NewEmbeddedSchemaCatalog() (*SchemaCatalog, error)

NewEmbeddedSchemaCatalog compiles the protocol schemas embedded in this SDK build.

func NewSchemaCatalog 

func NewSchemaCatalog(source fs.FS) (*SchemaCatalog, error)

NewSchemaCatalog compiles every schema from source, registers references by $id, enables Draft 2020-12 format assertions, and forbids network loading.

func (*SchemaCatalog) Validate 

func (catalog *SchemaCatalog) Validate(schemaName string, document []byte) error

Validate parses a strict JSON document and validates it against a named normative schema.

type SignatureEvidence 

type SignatureEvidence struct {
	// contains filtered or unexported fields
}

SignatureEvidence is immutable retained signature-envelope evidence.

func (SignatureEvidence) Algorithm 

func (signature SignatureEvidence) Algorithm() string

Algorithm returns the signature algorithm.

func (SignatureEvidence) Bytes 

func (signature SignatureEvidence) Bytes() []byte

Bytes returns a copy of the decoded 64-byte Ed25519 signature.

func (SignatureEvidence) CreatedAt 

func (signature SignatureEvidence) CreatedAt() string

CreatedAt returns the exact signature.createdAt text received on the wire.

func (SignatureEvidence) KeyID 

func (signature SignatureEvidence) KeyID() string

KeyID returns the immutable Registry key identifier from the signature envelope.

func (SignatureEvidence) Value 

func (signature SignatureEvidence) Value() string

Value returns the exact canonical base64url signature text received on the wire.

type SignedDocumentCodec 

type SignedDocumentCodec struct {
	// contains filtered or unexported fields
}

SignedDocumentCodec owns profile selection, schema validation, canonicalization, and signature envelope construction for signed protocol documents.

func NewSignedDocumentCodec 

func NewSignedDocumentCodec() (*SignedDocumentCodec, error)

NewSignedDocumentCodec builds a codec over the exact schemas embedded in this SDK build.

func (*SignedDocumentCodec) Sign 

func (codec *SignedDocumentCodec) Sign(
	kind SignedDocumentKind,
	unsignedDocument map[string]any,
	signingKey SigningKey,
) (map[string]any, error)

Sign signs one unsigned JSON object under an explicitly selected signed-document profile. The caller's object is never mutated.

func (*SignedDocumentCodec) Verify 

func (codec *SignedDocumentCodec) Verify(
	kind SignedDocumentKind,
	raw []byte,
	resolver KeyResolver,
) (*VerifiedSignedDocument, error)

Verify performs the six ordered Signed Document verification stages for one explicit profile.

type SignedDocumentKind 

type SignedDocumentKind string

SignedDocumentKind explicitly selects one of the nine signature-required protocol profiles. 

const (
	SignedDocumentAgentCard        SignedDocumentKind = "agent-card"
	SignedDocumentApproval         SignedDocumentKind = "approval"
	SignedDocumentArtifact         SignedDocumentKind = "artifact"
	SignedDocumentCommand          SignedDocumentKind = "command"
	SignedDocumentContextPackage   SignedDocumentKind = "context-package"
	SignedDocumentEvent            SignedDocumentKind = "event"
	SignedDocumentEvidence         SignedDocumentKind = "evidence"
	SignedDocumentExtensionProfile SignedDocumentKind = "extension-profile"
	SignedDocumentGroupSnapshot    SignedDocumentKind = "group-snapshot"
)

type SignedDocumentVerificationError 

type SignedDocumentVerificationError struct {
	// contains filtered or unexported fields
}

SignedDocumentVerificationError is a deliberately non-oracular verification failure.

func (*SignedDocumentVerificationError) Error 

func (failure *SignedDocumentVerificationError) Error() string

Error exposes only the stable wire classification, never the failing stage or detailed reason.

func (*SignedDocumentVerificationError) ProtectedDiagnostic 

func (failure *SignedDocumentVerificationError) ProtectedDiagnostic() VerificationDiagnostic

ProtectedDiagnostic returns local first-failure evidence that must not be relayed to peers.

func (*SignedDocumentVerificationError) WireCode 

func (failure *SignedDocumentVerificationError) WireCode() WireErrorCode

WireCode returns the stable error safe to place on the protocol wire.

type SigningKey 

type SigningKey interface {
	Algorithm() string
	KeyID() string
	Sign(message []byte) ([]byte, error)
}

SigningKey is the sole application adapter used by SignedDocumentCodec when signing.

type TrustedAdmissionContext 

type TrustedAdmissionContext interface {
	Issue(organizationID, signingHash string) (AdmissionContextValue, error)
}

TrustedAdmissionContext issues the acceptance instant and authenticated service identity.

type VectorResult 

type VectorResult struct {
	Name          string
	ExpectedValid bool
	ActualValid   bool
	Error         string
}

VectorResult records the expected and observed validity of one conformance vector.

func (VectorResult) Passed 

func (result VectorResult) Passed() bool

Passed reports whether the observed validity matched the manifest.

type VerificationDiagnostic 

type VerificationDiagnostic struct {
	// contains filtered or unexported fields
}

VerificationDiagnostic is protected local evidence about the first failing stage. It is kept separate from Error(), whose text intentionally exposes only the wire classification.

func (VerificationDiagnostic) Reason 

func (diagnostic VerificationDiagnostic) Reason() string

Reason returns the protected local failure reason.

func (VerificationDiagnostic) Stage 

func (diagnostic VerificationDiagnostic) Stage() VerificationStage

Stage returns the first failing semantic verification stage.

type VerificationStage 

type VerificationStage string

VerificationStage identifies the first normative Signed Document verification stage reached. 

const (
	VerificationParse             VerificationStage = "parse"
	VerificationSchema            VerificationStage = "schema"
	VerificationSignatureEnvelope VerificationStage = "signature-envelope"
	VerificationKeyResolution     VerificationStage = "key-resolution"
	VerificationCanonicalization  VerificationStage = "canonicalization"
	VerificationSignature         VerificationStage = "signature"
	VerificationComplete          VerificationStage = "complete"
)

type VerifiedSignedDocument 

type VerifiedSignedDocument struct {
	// contains filtered or unexported fields
}

VerifiedSignedDocument is immutable evidence produced only after all six verification stages.

func (*VerifiedSignedDocument) CompleteBytes 

func (verified *VerifiedSignedDocument) CompleteBytes() []byte

CompleteBytes returns a copy of the complete signed document's RFC 8785 bytes.

func (*VerifiedSignedDocument) CompleteHash 

func (verified *VerifiedSignedDocument) CompleteHash() string

CompleteHash returns the lowercase sha256: identifier over CompleteBytes.

func (*VerifiedSignedDocument) Document 

func (verified *VerifiedSignedDocument) Document() map[string]any

Document returns a deep copy of the parsed signed document.

func (*VerifiedSignedDocument) Kind 

func (verified *VerifiedSignedDocument) Kind() SignedDocumentKind

Kind returns the explicit Signed Document profile used for verification.

func (*VerifiedSignedDocument) ProtectedInstant 

func (verified *VerifiedSignedDocument) ProtectedInstant() RFC3339Instant

ProtectedInstant returns the parsed protected instant without fractional truncation.

func (*VerifiedSignedDocument) ProtectedTime 

func (verified *VerifiedSignedDocument) ProtectedTime() string

ProtectedTime returns the exact protected signed-time text received on the wire.

func (*VerifiedSignedDocument) ReceivedBytes 

func (verified *VerifiedSignedDocument) ReceivedBytes() []byte

ReceivedBytes returns a copy of the exact UTF-8 bytes supplied to Verify.

func (*VerifiedSignedDocument) ResolvedKey 

func (verified *VerifiedSignedDocument) ResolvedKey() ResolvedKeyEvidence

ResolvedKey returns an immutable copy of resolved Agent Registry evidence.

func (*VerifiedSignedDocument) Signature 

func (verified *VerifiedSignedDocument) Signature() SignatureEvidence

Signature returns an immutable copy of retained signature material.

func (*VerifiedSignedDocument) SigningBytes 

func (verified *VerifiedSignedDocument) SigningBytes() []byte

SigningBytes returns a copy of the RFC 8785 bytes covered by the Ed25519 signature.

func (*VerifiedSignedDocument) SigningHash 

func (verified *VerifiedSignedDocument) SigningHash() string

SigningHash returns the lowercase sha256: identifier over SigningBytes.

type WireErrorCode 

type WireErrorCode string

WireErrorCode is the non-oracular protocol error exposed to a remote peer. 

const (
	WireProtocolViolation      WireErrorCode = "PROTOCOL_VIOLATION"
	WireSchemaValidationFailed WireErrorCode = "SCHEMA_VALIDATION_FAILED"
	WireAuthInvalidSignature   WireErrorCode = "AUTH_INVALID_SIGNATURE"
)

Source Files

View all Source files

Directories

Path Synopsis
cmd
missionweaveprotocol-conformance command
examples
sign command
This command demonstrates SignedDocumentCodec with protocol-owned test-only fixtures.
 This command demonstrates SignedDocumentCodec with protocol-owned test-only fixtures.
validate command
internal
cmd/bundle-smoke command
cmd/repository-policy command
repositorypolicy
Package repositorypolicy enforces canonical repository naming and documentation vocabulary.
 Package repositorypolicy enforces canonical repository naming and documentation vocabulary.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.