archetech / archon / 34715935297

95%

push

github

fix: Name the relationship an operation exercises, and the suite it signs under (#1129)

Operations claimed proofPurpose "authentication", which DID Core defines as
proving you are the subject. An operation exercises control over a DID document,
which is what capabilityInvocation names -- the specification's own example for
that relationship is "the authorization to update the DID Document".

Neither value was ever decided: authentication came from #20, the commit that
introduced W3C-shaped proofs, alongside EcdsaSecp256k1Signature2019, and both
were shapes taken by appearance rather than read. It survived because nothing
consults it.

Both gatekeepers accept capabilityInvocation, and keep accepting authentication
and assertionMethod, since an operation carrying either may already be anchored
and every node replays its own history. Generated agent documents grant
capabilityInvocation, because a purpose the document does not grant is a
safeguard nothing can check.

The suite is renamed archon-ecdsa-secp256k1-jcs-2026. The old name echoed the
registered ecdsa-jcs-2019, which is defined for the two curves this suite exists
because the registry does not cover.

Known gap, recorded rather than migrated: a DID that has been updated resolves
with a controller-authored document that does not grant the relationship, and
will not pick it up later. Injecting it would have resolution return a document
the controller never signed.

Ships with #1127.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

4139 of 4757 branches covered (87.01%)

Branch coverage included in aggregate %.

4 of 4 new or added lines in 2 files covered. (100.0%)

8797 of 9234 relevant lines covered (95.27%)

763.68 hits per line