Project

General

Profile

Actions
Copy link

Feature #3854

open

Adopt IDP-issued ymid-agent-v2 credentials in Identity Vault

Added by Joshua Zhao 28 days ago.

Status:
New
Priority:
Normal
Assignee:
Joshua Zhao
Start date:
08/18/2026
Due date:
% Done:

0%

Estimated time:

Description

Summary

Identity Vault must consume the IDP-issued agent identity and private key produced by the current iOS approval flow instead of creating a user-local delegated issuer chain.

Scope

  • Strictly validate the complete ymid-agent-v2 relay payload and exact agent/approval identities.
  • Encrypt and persist the IDP-issued agent key, public parameters, generation, and approval metadata with additive schema migration.
  • Load opaque v3 parameters and the issued key into the WASM signer, serializing setParam -> setUser -> sign.
  • Emit realCredentialIdHex;agentIdentity;useCount;signatureBase64 for enhanced RPs.
  • Require legacy delegated-v1 pairings to pair again and update CLI/docs/tests.

Acceptance

  • Native IDP-issued Node key signs and verifies through the vendored WASM runtime.
  • Pairing validation, persistence, concurrent signing, lint, build, and full unit suite pass.

Related server/RP work: #3853.

Actions
Copy link

Also available in: Atom PDF