Skip to content

Signing: thread auto-sign through AdcpClient protocol adapters #186

Description

@bokelley

Follow-up to #183 (RFC 9421 request signing). The primitive adcp.signing.sign_request(...) is in place and conformant, but AdcpClient / ADCPMultiAgentClient do not yet auto-sign outgoing requests.

What's missing

The issue #183 deliverable describes:

`AdcpClient(signing_key=..., agent_url=...)` — optional keyword-only params. `signing_key` is a `cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey` or `EllipticCurvePrivateKey` (P-256).
On every outgoing request to operations in the seller's advertised `request_signing.required_for` or `supported_for`, compute the canonical signature base [...] and attach `Signature`, `Signature-Input`, and (when covered) `Content-Digest` headers.

Right now callers have to call `sign_request` themselves and attach headers manually. Integration needs to:

  1. Accept signing config on `AdcpClient`/`ADCPMultiAgentClient` constructors.
  2. Resolve the counterparty's `request_signing` capability block (from `get_adcp_capabilities`) and decide whether to sign based on `required_for` / `supported_for`.
  3. Inject `sign_request` at the right point in the A2A and MCP protocol adapters (`src/adcp/protocols/`).
  4. Honor `covers_content_digest` tri-state: `required` → attach `Content-Digest` and cover it, `forbidden` → do not cover, `either` → signer's choice.

Why separate

Keeping this as a follow-up because:

  • Protocol-adapter changes touch transport glue and deserve focused review.
  • Capability-driven sign/not-sign logic needs tests against real seller advertisements.
  • The primitive being stable means the integration can happen incrementally without breaking the conformance suite.

Out of scope here

  • Signer key storage/rotation (separate operational concern)
  • Dynamic JWKS discovery from `brand.json` (already covered by `CachingJwksResolver` on the verifier side; buyer-side discovery is a separate deliverable)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions