Define and implement authenticated responses bound to an attested request #188

Parent tracker: agentrust-io/.github#41

Problem and scope

The reference transport authenticates the inbound handoff but does not bind its returned provenance record to the appraised callee and exact request. At 0d23276, send_task returns a parsed HTTP 200 body without such verification. The current response contains provenance, not confidential task output; response sealing was deliberately withdrawn in docs/spec/mutual-attestation.md. This is a proposal to extend that documented boundary.

Define the transport-independent response contract first, then implement one reference adapter. Preserve the distinction between readable authenticated evidence and confidential output.

Acceptance criteria

• Specify the responder key's binding to the appraised workload, protocol version, caller/recipient, exact request commitment, session/challenge, response kind and response contents. Specify canonical bytes and domain separation.
• Define authenticated success, authenticated denial, unauthenticated transport failure and unknown execution outcome separately. No retry may imply non-execution.
• A relying party requiring authenticated responses rejects missing proofs, changed bodies/status, wrong peer/request/session/recipient and replay; legacy behavior remains explicitly lower assurance.
• Authenticate before consuming result content. If confidential outputs are introduced, separately require recipient-bound encryption and metadata disclosure policy.
• Add positive twins and negative vectors, a real-HTTP integration test and a causal test that fails when response verification is removed.
• Document key rotation, replay-state lifetime, concurrent requests, wire compatibility and limits. No proof of business completion follows from a signed acknowledgement.

Relationships and first slice

Related: #168 owns signed execution lineage; this issue does not solve history substitution. agentrust-io/cmcp#567 owns MCP task/callback evidence. Merged PR #187 contains the handoff diagnostics and bounded response-authentication implementation.

First slice: document the exact current behavior and a response-binding acceptance matrix. Do not select a cryptographic wire format implicitly through a fixture.

Progress

• Requirements draft and 14-case acceptance matrix submitted in Authenticate live handoff responses and preserve timeout diagnostics #187, commit a770ca9; strict staged MkDocs build passed. The document is docs/spec/response-binding-requirements.md.
• Select the live-caller session-MAC profile: X25519 with the appraised peer key, HKDF/HMAC-SHA256, integer-only JCS, fresh request/recipient context and process-local one-use state. Portable signatures are not claimed.
• Implement and locally validate the contract in Authenticate live handoff responses and preserve timeout diagnostics #187 at 4f2fcab: 57 focused tests, 691 full-suite passes, two existing hardware-fixture skips; causal MAC/replay/deadline tests, lint/types/security and strict docs passed.
• Hosted CI completed at 4f2fcab: 12 successful checks, two main-only skips, none pending. https://github.com/agentrust-io/ca2a/actions/runs/35308724071
• Implementation merged in Authenticate live handoff responses and preserve timeout diagnostics #187 on September 18, 2026, as 762f329.
• Confirm review of the final integration at fc22c64; the approval at 4f2fcab was dismissed after that merge commit.

The implementation merged in #187 on September 18, 2026. Hosted checks passed at 4f2fcab; review confirmation of the final integration remains open. The profile authenticates readable responses to the live caller; it does not encrypt outputs, sign lineage, deduplicate server execution or establish fresh hardware evidence.