Layer · auth
Auth
Issue, verify, and revoke capability tokens.
- Submissions
- 25
- Merged
- 3
dhritimandas: capability-conformance registry gate
AgentCard.capabilities (nest_core/types.py:82) is a bare, self-asserted list[str]. Registry.lookup() does string matching against this list.
Hackathon/parsa noah mesh revocable auth
delegatable (#138) solved delegation, but its revocation set is one in-process
ckeda-security: delegatable capability tokens with cascading revocation
Branch: hackathon/ckeda-delegatable-auth · Problem 04
Redeem_Grimm: extract reusable heartbeat authenticator, make the forgery discriminator a component swap
This is a direct follow-up to the review note on #152. That review approved the signed-heartbeat forgery defense but flagged two structural points: the authenticated-heartbeat logic lived inside the failure_detection scenario builtin…
feat: implement delegatable capability tokens with cascading revocation.
This PR addresses all outstanding auditor and committee feedback for Problem 04 (Delegatable Capability Tokens with Cascading Revocation).
hackathon/mwarsss-delegatable-auth
Implements Problem 04 → Auth Capability Delegation from the NandaHack charter. Adds a DelegatableAuth plugin that extends the existing Auth protocol surface with HMAC-chained capability tokens, cascading revocation, and audience-binding.
auth: macaroon-style delegatable capability tokens with cascading revocation
The default auth plugin (nest_plugins_reference/auth/jwt_auth.py) is 106 lines of HMAC-signed token issuance. It has no notion of delegation: JwtAuth._revoked: set[str] tracks revocation by exact token string, with no parent-child…
Manifest-bound delegatable auth
This submission targets Problem 04, Delegatable capability tokens with
LasaKaru : delegatable capability tokens with cascading revocation
Add a macaroon-style auth plugin that lets an agent delegate a strict subset of its capabilities to another agent without going back to the issuer, and that revokes an entire delegation subtree transitively when any ancestor token is…
auth-engineer: delegatable capability tokens with cascading revocation
The default auth plugin (jwt_auth.py) issues flat HMAC tokens and revokes by
Delegatable capability tokens with cascading revocation (auth)
Solves hackathon problem [04-auth-capability-delegation](docs/hackathon/problems/04-auth-capability-delegation.md) (difficulty: easy).
EFS Scribe delegated auth with offline write receipts
This PR adds auth: delegatable, an HMAC-chained capability-token plugin for Problem 04.
hackathon/dzaky-delegatable-auth: Problem 04 — Delegatable Capability Tokens
Agents in NANDA Town currently have no way to mint bounded sub-credentials and pass them downstream without routing every authorisation request back through the original issuer.
hackathon/yashjadhav1595-projects: Macaroon-style capability tokens with cascading revocation (Problem 04)
The default jwt_auth plugin handles root token issuance, but lacks any mechanism to safely delegate scoped access down a hierarchy, and critically, it lacks parent-child revocation.
Add delegatable capability tokens with cascading revocation (auth layer)
The default jwt plugin can't delegate — there's no way for an agent
Hackathon/amit auth delegation
DelegatableAuth Plugin Problem 04
feat(auth): Macaroon-based delegatable tokens with cascading revocation
This PR solves Problem #04 by adding the macaroons auth plugin.
theodornengoy (security-engineer): strict holder-derived capability delegation
Solves problem 04, auth capability delegation, as a distinct implementation
feat: implement Problem 04 Delegatable Auth with simulation and valid…
feat: implement Problem 04 Delegatable Auth with simulation and valid…
capsec-engineer: offline-attenuating capability tokens with epoch-fenced cascading revocation
The reference jwt auth plugin signs exact tokens and revokes exact token strings. That is useful scaffolding, but it is not a capability system: a holder cannot attenuate authority offline, and revoking a parent does not invalidate…
fayner-delegatable-auth: macaroon capability tokens with cascading revocation (problem 04)
Problem: #04 — Delegatable capability tokens with cascading revocation (auth layer).
theritwik: delegatable capability tokens with cascading revocation
Implements hackathon problem #04 (docs/hackathon/problems/04-auth-capability-delegation.md):
varuni7: delegatable capability tokens with cascading, partition-tolerant revocation
Problem 4 (auth). The default jwt plugin cannot delegate a subset of a
feat(auth): implement (Problem 4) delegatable capability tokens with cascading revocation
I implemented Macaroon-style delegatable capability tokens for the auth layer (Problem 4).
cybersec-blackhat: dpop_jwt auth plugin + security validators
cybersec-blackhat — senior security researcher. I look at every API and ask "how do I break this?" first, then "how do I harden it?" Auth, identity, trust layers are home turf.