[bokelley]

Implements specs/agent-identity-3-3.md R4 as amended by adcontextprotocol/adcp#8299 (WG-approved 2026-10-19): in 3.3, a governance context, designated-task response signing and a rights attestation move to the signing agent's Web Bot Auth key directory.

Stacked on the main → next sync (#1541); until that merges, this diff also shows the sync merge commit. Review the last two commits.

The rule, as implemented

• O is the canonical origin of iss (governance context), agent_url (designated-task response) or rights_agent.url (rights attestation), taken from the caller's own context. It is never read from the unverified token.
• Selection (select_jws_artifact_profile): the trust record derived from O (R3a step 1, TrustRecordEvaluator) lists O, with any role → key directory. The record doesn't list O, the operator never published one, or O has no registrable domain → 3.2 profile. A record that can't be read (an outage, an invalid record, a 404/410 after a 200, local capacity) → JwsArtifactError("jws_key_unavailable"), never 3.2.
• Key rules (verify_wba_jws_artifact): alg exactly EdDSA, kid = the key's RFC 7638 thumbprint, the key resolved in O's directory (DiscoveredSignerKeys) and checked to be at O. No use/key_ops/adcp_use checks. b64 is refused, and crit goes through the surface's joserfc registry.
• Revocation: O's list (OriginRevocationChecker). Revoked → jws_key_revoked. Stale or uncheckable → jws_revocation_unavailable, and so is an origin that serves no list, unless revocation_absent="accept".
• History: HttpGovernanceKeyArchive reads {O}/.well-known/jwks-archive.json, matches keys by thumbprint, refuses an archive that carries private members, treats a 404/410 as no archive, and uses the trust-record fetcher (IP-pinned, no redirects, 2 MiB cap).

Surfaces

• Governance context. verify_governance_authorization(..., web_bot_auth=WbaJwsArtifactVerifier(...)) selects the profile from expected_issuer. On the key-directory path jwks and the 3.2 revocation_checker are not used. Every other check is unchanged: claims, aud/caller/phase/sub, payload hash, commitment, replay, is_jti_revoked, revocation_resolver, and the caller's brand.json cross-check of iss (resolve_issuer_jwks still gates make_governance_enforcement_middleware, which passes web_bot_auth through **verifier_options).
  • Outages return governance_jwks_unavailable, newly added to the error-code literal (the security.mdx taxonomy's retryable code).
  • Revocation problems return governance_token_revoked. An origin that serves no list is refused, because a governance context authorizes spend.
  • The shared shape/header/crit/issuer checks moved unchanged into _parse_governance_token.
• Historical governance. verify_historical_governance_context(token=, expected_issuer=, web_bot_auth=) takes the key from the directory or, once it is rotated out, from the archive (key_source). It checks O's revocation list (an origin with no list has revoked nothing) and skips expiry, audience and replay. An unlisted issuer returns a failure with profile="3.2".
• Designated responses and rights attestations. The SDK has no surface verifiers for these. WbaJwsArtifactVerifier.verify(token, artifact=..., signing_agent_url=..., typ=...) supplies the selection and key rules that a surface verifier calls, and raises JwsArtifactUses32ProfileError when 3.2 applies. compact_jws_from_envelope(signed_response) builds the compact JWS from a designated-task envelope (decoded payload, JCS signing input). Go takes the same approach (identity.JWSVerifier).
• verify_wba_governance_issuer (the earlier #7894 draft's check, graded by vendored vectors that carry alg Ed25519 and a jku) is left as is, with documentation pointing to the R4 path. Re-homing those vectors is P7 work, per #8299.

Tests (tests/test_jws_artifacts_wba.py, 84 tests)

• Selection: listed with any role; unlisted; never published; public suffix and IP literal (no fetch); a transport failure, a 503, invalid JSON, an invalid record and a 404-after-200 are all unavailable, never 3.2; non-https and userinfo URLs are refused.
• Governance online: WBA keys verify without purpose members, and neither the 3.2 resolver nor the kid callback is consulted. Unlisted issuers stay on 3.2, where purpose checks still apply. A trust-record or directory outage never falls back to 3.2. Also covered: a key at another origin, an alias kid (not the thumbprint), ES256, a wrong signature, the revoked/stale/unavailable/no_list revocation states, and the surface checks (aud, jti revocation, expiry) still running.
• History: the archive serves a rotated-out key past expiry, the directory is preferred, online verification never reads the archive, unknown keys and an unreadable archive are refused, revocation still applies (no_list accepted), and an unlisted issuer returns profile="3.2".
• Archive: thumbprint matching (the kid member is ignored), caching, miss refetch after a cooldown, LRU bound, 404/410, a 503, invalid JSON, private members, unusable entries skipped.
• Designated response via the envelope helper; rights attestation bound to rights_agent.url; the 3.2 hand-off; typ/alg/b64/crit header rules; revocation_absent; malformed tokens, headers and keys.

Validation

• Full local suite (-k "not packaging and not artifacts", 4 workers): 17211 passed, 2617 skipped.
• Coverage: src/adcp/signing/jws_artifacts.py 96%.
• ruff check src/, ruff format --check on changed files, mypy src/adcp (1538 files): clean.

Review

code-reviewer and security-reviewer subagents found no High findings. Fixed:

• (Medium) a custom key resolver or archive raising a non-SDK exception escaped the verifier; it is now jws_key_unavailable / governance_jwks_unavailable.
• (Low) an archive entry with a non-string alg raised TypeError; it is now skipped.
• (Low) an archive miss stayed cached for the whole cache period; it is now refetched after 30 s.
• (Low) the docs contradicted themselves on outage codes; corrected.

Not changed: key-property failures (non-Ed25519 key, kid ≠ thumbprint) map to governance_token_invalid, as in TypeScript, rather than the 3.2 path's governance_key_unknown.

Cross-SDK differences are documented in docs/agent-identity-3-3-migration.md. Outages are governance_jwks_unavailable here and governance_key_unknown in TypeScript. A trust-record outage is unavailable even when the last record listed O, as in TypeScript; Go keeps the WBA path within the outage-continuation bound.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve.

Reviewer found no blocking or medium findings. New signing capability (adcp.signing.jws_artifacts, verify_historical_governance_context, web_bot_auth= param, optional profile field) is purely additive — no removals, no required→optional flips on public models — so feat(identity) is the correct semver signal.

Decision table walk-through:

• Row 1 (critical/high): no findings — skip.
• Row 2 (gated_paths): false — skip.
• Row 3 (high-risk deleted): reasons are only (added) and (modified) — skip.
• Row 4 (medium data-loss/schema/infra): no medium findings — skip.
• Row 5 (high_risk modified + medium): wba.py is (modified) but there are zero medium findings — does not fire.
• Row 6 (sticky escalate): no prior decision — skip.
• Row 7 (no-auto-approve team): no team match — skip.
• Row 8 (≥3 medium): zero medium — skip.
• Row 9: approve.

High-risk flag is a look-closer heuristic; the added jws_artifacts.py is new scaffolding and the modified wba.py drew no medium-or-higher concerns, so the modification is presumed contract-preserving. Reviewer confirmed fail-closed behavior in select_jws_artifact_profile (raises jws_key_unavailable on trust-record outage), kid-to-RFC-7638-thumbprint binding in verify_wba_jws_artifact, and that the #1524 CI fixes correctly un-skip 24 previously-dead signing tests rather than disabling them. Tests: 17211 passed, jws_artifacts.py at 96%.