P5: confirm/provision a PocketId non-interactive agent credential (+ test procedure) #2
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Design context:
docs/design/server-split.md+ tracking issue seltzerhq/pecun#18 (the code lives here in nic/commons). (design section 8, "Agent auth")PocketId is passkey/human-centric; confirm it can mint a non-interactive agent credential (OAuth2
client-credentials grant / service account) for the MCP server's backend identity
(
COMMONS_AGENT_TOKEN, role=agent).Test paths:
Today, without PocketId:
commons-server mint-token --role agentissues an HS256 agent token thedev server accepts; a write through it stamps
posted_by=agent(already exercised byServerBootstrapIntegrationTests+AgentAttributionTests).Real PocketId path: obtain a token from PocketId's token endpoint for the agent client, present it
to
commons-serverconfigured withCOMMONS_OIDC_JWKS_URL/ISSUER/AUDIENCE, confirmJWKSVerifieraccepts it (signature + iss + aud) and a write stamps
posted_by=agent.Fallback if PocketId cannot issue agent credentials: a static service JWT signed by a key in the
backend's trusted JWKS (or a dedicated HS256 secret) -- the backend supports both paths.
Confirm PocketId capability; provision the agent client; document the obtain-token command.