davidherranandClaude Opus 4.8
88e277e1fd
Build + tests verde: agent-identity 18 (4 unit + 14 integration) + runtime 27.
Verificacion adversarial ultracode (3 skeptics): 2 confirmed + 1 partial/low,
todos los gaps PRE-EXISTENTES (no introducidos por FIX-3). Invariante "no
puedes registrar un public_key que no controlas" SE SOSTIENE.
FIX-3 (b) DID binding — V3-H1 anti-front-running:
- register_agent_did ahora exige signature: [u8;64] — una firma Ed25519 (por la
private key de public_key) sobre AGENT_DID_REGISTER_DOMAIN || who.encode().
- Verificacion on-chain via sp_io::crypto::ed25519_verify (host function, no
bloatea el wasm). Nuevo dep sp-io (no_std).
- Cierra el front-running: un atacante no puede registrar un public_key ajeno
(no produce la firma); el who en el mensaje ata la firma a este caller (no
replay-able a otra cuenta). Error InvalidSignature. Malleabilidad Ed25519
rechazada por ed25519-zebra (S canonico).
- Una sola fuente de verdad del mensaje (agent_did_register_message) compartida
entre verificador y firmante (evita divergencia tipo postcard-vs-SCALE).
- Orden: idempotency ANTES del verify (no gasta crypto en duplicados).
FIX-3 (c) derive_did domain-sep — V3-H2:
- blake3::derive_key("origin-chain/agent-did/v1", pk) en vez del concat ad-hoc
BLAKE3(pk || version). KDF domain-separado. Inmutable #16 preservado.
Tests: mock con keypairs Ed25519 reales (sp_core::ed25519::Pair) + sign helper.
12 scenarios (scenario_6 reformulado a front-running -> InvalidSignature, +
scenario_11 firma invalida, scenario_12 DID collision genuino del key-holder).
NOTA: la (a) domain-sep del attestation signing payload (el otro tercio de
FIX-3) ya esta cubierta por el DC ORIGIN_ATTESTATION_SIGNING_PAYLOAD_V1 (helper
de Ergon attestation_signed_message), pendiente su ship Cap 45+.
FOLLOW-UPS (low, pre-existentes, no bloquean):
- (a) anadir genesis_hash/chain-id al mensaje de registro (hardening cross-chain
replay) — ideal chain-wide junto al signing_payload de attestation.
- (b) DC para ratificar el modelo de autoridad Hybrid (quien firma) + si los
co_authors requieren prueba de consentimiento (lineage hoy no autenticado).
- (c) weight benchmarking real que contabilice el ed25519_verify (chain-wide,
post-testnet — ya en roadmap FIX-2 weights).
- creator = AccountId::new(public_key) (la cuenta del key-holder, no el caller):
coherente con el binding, semantica documentada.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
64 lines
2.0 KiB
TOML
64 lines
2.0 KiB
TOML
[package]
|
|
name = "origin-chain-agent-identity"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
homepage.workspace = true
|
|
description = "Agent identity pallet canonical per CHN-7 + Inmutable #41 Cross-Species Co-authorship. Phase 2.7 v0.0.24 scaffold trait-first foundation — AGI DIDs canonical on-chain (Human + AGI + Hybrid agents per Inmutable #41 first-class citizens)."
|
|
|
|
[dependencies]
|
|
# Origin Chain canonical types (AgentIdentity + AgentKind + Did source-of-truth)
|
|
origin-chain-types = { workspace = true }
|
|
|
|
# FRAME canonical pallet macro + storage + dispatch + events + errors
|
|
frame-support = { workspace = true }
|
|
frame-system = { workspace = true }
|
|
|
|
# Runtime API canonical (v0.0.27 — AgentIdentityApi.query_identity read-only RPC)
|
|
sp-api = { workspace = true }
|
|
|
|
# Crypto canonical (BLAKE3 hash derivation para DID)
|
|
blake3 = { workspace = true }
|
|
|
|
# Substrate primitives canonical (BoundedVec consumer)
|
|
sp-core = { workspace = true }
|
|
sp-runtime = { workspace = true }
|
|
|
|
# FIX-3 (V3-H1) DID binding — sp_io::crypto::ed25519_verify host function
|
|
sp-io = { workspace = true }
|
|
|
|
# SCALE codec canonical
|
|
parity-scale-codec = { workspace = true }
|
|
scale-info = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
# Mock runtime canonical para integration tests v0.0.26 — Pattern v0.0.18/v0.0.22 mirror.
|
|
sp-core = { workspace = true, default-features = true }
|
|
sp-io = { workspace = true, default-features = true }
|
|
sp-runtime = { workspace = true, default-features = true }
|
|
|
|
[features]
|
|
default = ["std"]
|
|
std = [
|
|
"origin-chain-types/std",
|
|
"frame-support/std",
|
|
"frame-system/std",
|
|
"sp-api/std",
|
|
"sp-core/std",
|
|
"sp-io/std",
|
|
"sp-runtime/std",
|
|
"parity-scale-codec/std",
|
|
"scale-info/std",
|
|
]
|
|
runtime-benchmarks = [
|
|
"frame-support/runtime-benchmarks",
|
|
"frame-system/runtime-benchmarks",
|
|
]
|
|
try-runtime = [
|
|
"frame-support/try-runtime",
|
|
"frame-system/try-runtime",
|
|
]
|