fix: correct passport verification and public skill guidance - #191
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Passport offers instructed callers to wrap a signed credential in
{"credential": ...}, while/credentials/verifyverifies the request body itself. Following those instructions returnedvalid=falsefor a valid passport. Offers from check/capabilities, the discovery manifest, payment challenge, post-prove bundle and new inbox messages now instruct callers to send the credential object directly. The API description states the same contract.The public Agent Guild Trust skill and its source-tagged Codex plugin mirror now give the exact verification request and checks issuer, subject and credential dates. It also describes preflight probes and passport issuance/logging accurately, including that omitting a User-Agent does not disable service logging. The skill stays within its existing free preflight and passport verification scope.
Validation: all 51 focused passport/offer/bundle/inbox/funnel/identity and installable-skill tests pass, including nine regression cases that execute the actual returned instructions against the HTTP handler. The six advertised flows fail against the baseline and pass with this fix. Valid, tampered and wrapped-body controls retain their expected behavior. Both skill validators pass, contract regeneration has no drift, and the diff is clean.
Verification logic, pricing and attribution are unchanged. Previously queued inbox messages and cached instructions are not migrated. This is a demonstrated guidance defect; no external conversion loss is inferred.