Tracking issue: implementation plan for #279

[tediou5]

This issue tracks the implementation work for #279.

The work will land in a sequence of small PRs so that each step remains reviewable and mergeable.

Planned order

• PR1. Internal crypto dispatch infrastructure

  • Move build-dependent crypto dispatch behind an internal layer in tsp_sdk/src/crypto.
  • Preserve current behavior.

• PR2. Internal capability model

  • Add internal types for build capabilities, advertised peer capabilities, defaults or policy, and selection results or errors.

• PR3. DID capability extraction and store population

  • Preserve advertised authentication and keyAgreement options during DID resolution.
  • Attach those options to resolved peer state.

• PR4. Pure selection engine

  • Implement runtime selection from advertised options, build capabilities, and defaults or policy.
  • Cover the main cases with unit tests.

• PR5. Sender-path integration

  • Apply runtime selection on outbound sends.
  • Keep the existing public send APIs working.

• PR6. Authentication verification and observability

  • Complete authentication-side selection and verification.
  • Expose the selected key-agreement and authentication result to tests, logging, or send results.

• PR7. Persistence, export, docs, and cleanup

  • Update persistence and export if capability sets need to be stored.
  • Update examples and developer-facing notes.
  • Clean up legacy naming where needed.

Notes

• store and async_store will move together.
• Persistence and export changes are intentionally left near the end.
• Early PRs focus on internal structure first, then behavior.

Done when

• One build can talk to different peers with different runtime-selected key-agreement options.
• One build can choose different authentication options for different peers.
• DID-advertised options are preserved long enough for runtime selection.
• Missing keyAgreement or authentication can be handled through documented defaults.
• Existing send APIs remain usable through the transition.

[tediou5]

Most of the work has been completed in #322. The remaining item is adding DID/VID support for declaring supported crypto suites, which will be handled in a separate PR.