Skip to content

CHANGELOG.md

Latest commit

 

History

History
316 lines (229 loc) · 23.8 KB

CHANGELOG.md

File metadata and controls

316 lines (229 loc) · 23.8 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, this project adheres to Semantic Versioning, commits follow Conventional Commits, and this changelog is generated by Structured Changelog.

Unreleased

v0.7.0 - 2026-08-09

Highlights

  • AuthZEN: New authzen/ PDP client for authorization decisions with agent-aware subject helpers
  • A2A: New a2a/ client for Google A2A agent discovery and task delegation
  • omniskill Adapter: New adapters/omniskill/ idjag verifier for omniskill's ExternalAuth seam
  • Keycloak Adapter: New adapters/keycloak/ identity-assertion-jwt receiver bootstrap (experimental)
  • MCP EMA Demo: New examples/mcp-ema/ end-to-end Enterprise-Managed Authorization demo

Added

  • authzen/ AuthZEN PDP client (d5bd420)
  • a2a/ A2A protocol client (337ea70)
  • adapters/omniskill/ idjag verifier adapter for omniskill ExternalAuth seam (1239f75)
  • adapters/keycloak/ Keycloak identity-assertion-jwt receiver adapter (f85c5a1)
  • examples/mcp-ema/ end-to-end MCP EMA demo (731accc)

Dependencies

  • github.com/ogen-go/ogen v1.22.0 -> v1.23.0 (6e339f4)
  • github.com/plexusone/omniobserve v0.11.0 -> v0.12.0 (ef042c8)
  • github.com/go-faster/errors v0.7.1 -> v0.8.0 (666b4e1)
  • go.opentelemetry.io/otel/metric v1.44.0 -> v1.45.0 (008c1e9)
  • go.opentelemetry.io/otel/trace v1.44.0 -> v1.45.0 (b4948da)
  • go.opentelemetry.io/otel v1.44.0 -> v1.45.0 (e739433)
  • github.com/plexusone/omniskill v0.12.0, github.com/modelcontextprotocol/go-sdk v1.7.0, and other go.mod updates (8fd1142)

Documentation

  • AuthZEN overview and getting-started guides (d4feb1a)
  • A2A overview and getting-started guides (ebd634f)
  • README updated with AuthZEN and A2A packages (eae7207)
  • README shields updated (157f282)
  • INIT-AGENTPROTOCOLS-001 initiative specs (PRD/TRD/PLAN/ROADMAP) (88d3c37)
  • omniskill and Keycloak adapter overview guides (4572728)

v0.6.0 - 2026-06-27

Highlights

  • Interface-Based Servers: New aauth/personserver and idjag/authzserver packages with pluggable storage interfaces
  • SCIM Extensions: New scimext/ package for SCIM 2.0 agent and application management
  • Protocol Types: Comprehensive AAuth types for consent, mission, delegation, and attestation
  • Architecture Refactor: Composition layer moved to plexusone/agentauth for cleaner separation

Breaking

  • Composition layer (cmd/, lambda/, examples with storage) moved to plexusone/agentauth
  • Import path change: github.com/plexusone/agentauth for production deployments

Added

  • aauth/personserver/ interface-based Person Server (f3fd5a3)
  • idjag/authzserver/ interface-based Authorization Server (bab2e18)
  • scimext/ SCIM 2.0 extensions for agents (fcae1bf)
  • agentauth/ unified authorization client (cf4304c)
  • AAuth consent, mission, delegation types (934f438)
  • PersonServer unit tests (38 tests) (6e0ddb0)
  • GitHub Actions CI workflow (0bb5872)
  • golangci-lint configuration (daf33da)

Dependencies

  • github.com/plexusone/omniobserve v0.11.0 (6c661bf)

Documentation

  • Protocol documentation for scimext and agentauth (9145e54)
  • ID-JAG MCP Enterprise-Managed Auth adoption guide (713da66)

v0.5.0 - 2026-05-24

Highlights

  • Cross-protocol bridging: New bridge/ package enables interoperability between ID-JAG, AIMS, and AAuth
  • Observability integration: New bridge/observe/ package with distributed tracing, metrics, and logging via OmniObserve
  • Protocol-bridge demo: Working example demonstrating multi-protocol authentication

Added

  • bridge/ package with canonical identity and cross-protocol converters (23ee068)
  • bridge.Identity canonical representation for protocol-agnostic code (23ee068)
  • bridge.DetectProtocol() for automatic protocol detection from JWT typ header (2d6a7c5)
  • bridge.Parse() for unified token parsing across protocols (2d6a7c5)
  • bridge.MultiProtocolMiddleware() HTTP handler accepting any protocol (373cef4)
  • bridge/observe/ package for OmniObserve integration (ed19b4f)
  • observe.Middleware() with distributed tracing, metrics, and logging (ed19b4f)
  • observe.DelegationTracker for delegation chain tracing (ed19b4f)
  • demos/protocol-bridge/ cross-protocol demo application (a3fd63c)

Dependencies

  • github.com/plexusone/omniobserve v0.10.0 (ed19b4f)

Documentation

  • Bridge package documentation (c077900)
  • OAuth to Agent migration guide (48c9c96)
  • Hybrid authentication guide (48c9c96)
  • Updated roadmap with Phase 7 and 8 progress (e6d6db0)

Tests

  • Comprehensive bridge package tests (4eaaa30)
  • Protocol-bridge demo integration test (f84073e)

v0.4.0 - 2026-05-24

Highlights

  • AIMS: Token parsing and verification with WITVerifier and WPTVerifier
  • AAuth: JWT typ header validation and context-aware verification methods
  • ID-JAG: IETF-compliant token types and IdP authorization server

Added

  • AIMS ParseWIT and ParseWPT functions for token inspection without verification (9fc9e1a)
  • AIMS WITVerifier for cryptographic WIT signature verification with issuer/audience validation (9fc9e1a)
  • AIMS WPTVerifier for WPT verification including HTTP request binding checks (9fc9e1a)
  • AIMS TokenTypeWIT and TokenTypeWPT constants per WIMSE specification (9fc9e1a)
  • AAuth validateTokenType function for JWT typ header validation in token parsers (20070a4)
  • ID-JAG IETF-compliant token type constants and JWT header values (a469aad)
  • ID-JAG required IETF claims (client_id, jti) in Assertion struct (bbd2b31)
  • ID-JAG IdPAuthServer for OAuth token exchange at identity providers (c3a32c9)
  • ID-JAG token type acceptance in Resource authorization server (53ade96)
  • Integration test script (scripts/integration-test.sh) for running all examples (7c8f4df)

Changed

  • BREAKING: AAuth ResourceServer.VerifyAgentToken and VerifyAuthToken now require context.Context parameter (a838560)
  • BREAKING: AAuth AuthServer.validateExchangeRequest now accepts context.Context for proper cancellation (a838560)
  • AIMS signingMethodForKey properly detects RSA, ECDSA (P-256/384/521), and Ed25519 keys (9fc9e1a)
  • AIMS WIT and WPT signing now sets typ header per WIMSE specification (9fc9e1a)

Fixed

  • SharkAuth DPoP parseJWKPublicKey now properly parses RSA, EC, and OKP keys using aauth.JWK (1187ad5)
  • AAuth request body size limit (1MB) prevents memory exhaustion in AuthServer (a838560)

Documentation

  • AIMS package documentation for parsing and verification APIs (0ebd848)
  • AAuth package documentation for context-aware verification methods (7a92300)
  • Project roadmap documenting release history and future phases (d520cfc)
  • README Development section with test, lint, and integration commands (4c17112)
  • ID-JAG datasheet updated for IETF compliance (0789d1e)
  • ID-JAG delegation example updated for IETF-compliant flow (9da3c03)

Tests

  • AIMS parsing and verification tests for WIT and WPT (f46f38b)
  • AAuth typ header validation tests for all token types (575800b)
  • SharkAuth DPoP proof verification tests for EC and RSA keys (a4c4c62)

v0.3.0 - 2026-05-11 (d9fc824)

Highlights

  • SharkAuth adapter: Agent delegation with may_act_grants and DPoP proof-of-possession
  • Ory adapter: Fosite custom OAuth handlers and Hydra client for production integration

Added

  • SharkAuth adapter (adapters/sharkauth/) for agent delegation infrastructure (1fa75e7)
  • RFC 8693 Token Exchange client for SharkAuth (1fa75e7)
  • DPoP proof-of-possession binding per RFC 9449 (1fa75e7)
  • may_act_grants API for structured delegation with cascade revocation (1fa75e7)
  • SharkAuth example: AAuth agent integration with delegation grants (1fa75e7)
  • Ory adapter (adapters/ory/) for Fosite and Hydra integration (4512cad)
  • Custom Fosite OAuth handlers for ID-JAG assertions and AAuth tokens (4512cad)
  • Token storage interface with in-memory implementation for Fosite (4512cad)
  • Hydra client for public and admin APIs with token exchange support (4512cad)
  • JWT Bearer grant support (RFC 7523) for Hydra (4512cad)
  • Token introspection with actor claim support for delegation (4512cad)
  • Ory example: ID-JAG assertion exchange with mock Hydra server (4512cad)

Documentation

  • Update three-tier architecture plan with adapter completion status (d9fc824)

Tests

  • Unit tests for SharkAuth client, delegation, and DPoP (1fa75e7)
  • Unit tests for Ory Fosite handlers and Hydra client (4512cad)

v0.2.0 - 2026-05-11 (0f644d7)

Highlights

  • AAuth protocol: HTTP message signatures (RFC 9421) with token exchange for AI agent authentication
  • Zitadel adapter: Production integration for ID-JAG, AIMS, and AAuth with Zitadel OIDC infrastructure
  • Unified navigation: AIStandards.io navbar integration across documentation site

Added

  • AAuth library (aauth/) implementing draft-hardt-oauth-aauth-protocol (38fd1e1)
  • HTTP message signatures (RFC 9421) for request authentication (8f595c6)
  • AAuth token types: aa-agent+jwt and aa-auth+jwt (238c71f)
  • Agent client with automatic request signing transport (18dbff8)
  • Resource server middleware for AAuth token validation (a1921b1)
  • Auth server with token exchange and JWKS endpoints (e80f1d2)
  • Discovery client for AAuth metadata retrieval (29f9e26)
  • AAuth examples: simple agent, delegation, token exchange (d5f7d1b)
  • AAuth delegation example with Person Server flow (e73ae2e)
  • PIDL definitions for AAuth protocol flows (303b4b8)
  • Zitadel adapter (adapters/zitadel/) for production OIDC integration (46ceed0)
  • RFC 8693 token exchange client for ID-JAG assertions (4b48d73)
  • RFC 7523 JWT profile grants with oauth2.TokenSource interface (992a34f)
  • Token verification using Zitadel JWKS for all protocols (d889c03)
  • HTTP middleware for Zitadel token validation (c43ddf3)
  • Zitadel example applications for each protocol (69015d1)
  • Multi-protocol integration demo application (a63258e)

Changed

  • Rename module from github.com/grokify/agent-protocols to github.com/aistandardsio/agent-protocols (32340ad)
  • Documentation site uses unified AIStandards.io navigation bar (77a30bf)

Fixed

  • Use aistandards.io URLs to avoid mixed content blocking on GitHub Pages (0f644d7)
  • Match aistandards.io navbar styling with three-segment title (8124e1d)

Dependencies

  • Add golang.org/x/oauth2 for TokenSource interface (c4fb160)

Documentation

  • AAuth protocol documentation: overview, getting started, examples, API reference (0cd708a)
  • Zitadel adapter documentation: overview, getting started, examples, API reference (6bb8043)
  • v0.2.0 release notes (3983875)
  • Updated navigation for adapters section (76d81b5)

Tests

  • Unit tests for Zitadel adapter components (75b9b4e)

v0.1.0 - 2026-04-19

Highlights

  • Initial release with ID-JAG and AIMS protocol implementations for AI agent authentication
  • ID-JAG: OAuth 2.0 token exchange with JWT assertions and human-to-agent delegation support
  • AIMS: SPIFFE-based workload identity with WIT/WPT authentication per WIMSE specification

Added

  • ID-JAG library (idjag/) implementing draft-ietf-oauth-identity-assertion-authz-grant (25c20f6)
  • JWT assertion creation and signing with RS256/ES256 support (25c20f6)
  • Token exchange client for RFC 8693 token exchange flow (25c20f6)
  • JWT Bearer client for RFC 7523 JWT bearer grant (25c20f6)
  • Authorization server with JWKS endpoint for assertion verification (25c20f6)
  • Resource server middleware for Bearer token validation (25c20f6)
  • Actor claim (act) support for human-to-agent delegation chains (25c20f6)
  • Static key and JWKS-based JWT verifiers (25c20f6)
  • AIMS library (aims/) implementing draft-klrc-aiagent-auth-00 (f7165d3)
  • SPIFFE ID parsing and validation with trust domain support (f7165d3)
  • Nine-layer AIMS architecture model (f7165d3)
  • AgentIdentity type combining SPIFFE ID, credentials, and attestation (f7165d3)
  • Workload Identity Token (WIT) per draft-ietf-wimse-s2s-protocol (5479db2)
  • WIMSE Proof Token (WPT) with HTTP request binding (5479db2)
  • X.509 SVID and JWT-SVID credential types (f7165d3)
  • Attestation types: TPM, SGX, SEV-SNP, TDX, Kubernetes, AWS, GCP, Azure, GitHub (f7165d3)
  • ID-JAG examples: simple agent flow and human-to-agent delegation (e8a8ac8)
  • AIMS examples: simple WIT/WPT authentication and mTLS with X.509 SVID (9fc6faa)
  • PIDL definitions for ID-JAG flows (simple, delegation, token exchange) (445dd49)
  • PIDL definitions for AIMS flows (WIT issuance, WPT authentication) (b03a5f1)

Changed

  • Restructure repository for multiple protocols (idjag/, aims/) (8c2ee5a)

Fixed

  • Resolve gosec lint errors (G101, G112, G117, G120, G704) (d6960a4)

Documentation

  • MkDocs documentation site with Material theme (6b769c0)
  • Protocol overview with sequence diagrams for ID-JAG (6b769c0)
  • Getting started guides for both ID-JAG and AIMS (6b769c0)
  • API reference documentation for both packages (c671ab4)
  • PIDL-generated Mermaid sequence diagrams (16376ad)
  • Multi-protocol landing page with comparison table (89b6813)
  • AIMS overview with 9-layer architecture diagram (016d755)

Build

  • GitHub Actions CI workflows for build, lint, and SAST (81e1c3f)
  • golangci-lint configuration (2c89238)

Tests

  • Comprehensive unit tests for AIMS package (SPIFFE, WIT, WPT, credentials, attestation) (cd820eb)