Feat/verified identities - #102
Merged
Merged
Conversation
Add IdentityProofSigner in ans-sdk-crypto. It builds compact JWS control proofs that bind a verified identity to an agent key. Add the nimbus-jose-jwt dependency and unit tests. Signed-off-by: James Hateley <jhateley@godaddy.com>
Add IdentityService and IdentityClient in ans-sdk-registration for Verified-Identity management, with IdentityPaths for the endpoint paths. Add unit tests for the client, service, paths, and the registration client error paths. Signed-off-by: James Hateley <jhateley@godaddy.com>
Add transparency-log reads for verified identities (getAgentIdentities, getAgentIdentityHistory, and linked-agent lookups) and the v2 event schema models. Join verified identities onto agent badges and add TlLeafUncommitted error handling. Add unit tests and model coverage. Signed-off-by: James Hateley <jhateley@godaddy.com>
bchen-godaddy
requested changes
Aug 7, 2026
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
Signed-off-by: James Hateley <jhateley@godaddy.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Fixes #86
Summary
This branch adds Verified Identity support to the ANS Java SDK. A Verified Identity is a first-class object with its own lifecycle, separate from agent registration. The branch covers three areas: identity management, control-proof signing, and transparency-log reads.
Identity management (ans-sdk-registration)
The new
IdentityClientgives access to the eight Registration Authority operations on the/v2/ans/identitiessurface: register, list, get details, rotate, verify control, revoke, link to agents, and unlink. An internalIdentityServicedoes the HTTP work. AnIdentityPathshelper builds the request paths.Register and rotate return a 202 challenge round. The identity is not sealed until the caller completes the challenge and submits a control proof to verify-control. A link request carries at most 256 agents. The client offers both synchronous and asynchronous (
CompletableFuture) call styles.Control-proof signing (ans-sdk-crypto)
The new
IdentityProofSignersigns the control-proof challenge as a compact JWS string, one per proven key. It supports the three algorithms the verifier implements: EdDSA (Ed25519), ES256 (ECDSA P-256), and RS256 (RSA 2048 or more). It reads the algorithm from the private key. It rejects key-agreement keys and curves with no verifier before it signs.The served signing input becomes the JWS payload without change, because the RA checks payload equality before signature. This work adds a dependency on Nimbus JOSE 10.0.2.
Transparency-log reads (ans-sdk-transparency)
TransparencyClientgains identity reads: get identity badge, identity audit, identity receipt, identity linked agents, agent identities, and agent identity history. Each read has an async variant.The agent badge now includes the joined verified identities. The badge caps its inline identity list at 25 entries. A caller pages the full set through the agent-identities read, which reports the total count. New models cover these responses:
AgentIdentitiesResponse,IdentityLinkedAgentsResponse, andLinkedAgentView.A new
TlLeafUncommittedExceptionmaps the retryable503 TL_LEAF_UNCOMMITTEDcondition. This condition means a leaf is committed but no signed checkpoint covers it yet. The exception carries theRetry-Afterdelay and reports itself as retryable.The branch also adds V2 schema handling for transparency-log events. It adds the V2 models
EventV2,AttestationsV2,CertificateInfoV2,DnsRecordV2,ProducerV2, andTransparencyLogV2.Testing
Unit tests added for all new code paths and coverage held > 90%.
E2E testing performed against locally running RA/TL.
AI assistance
Checklist
git commit -s) certifying the DCO