feat(tlsn): a proxy-mode prover, for callers that cannot dial the platform

[SupremaLex]

Why

prover_generic runs one commitment protocol: MPC-TLS, where the prover opens the connection to the server and the notary takes part in encrypting it. tlsn has a second, Proxy-TLS, where the notary opens that connection and the prover reaches it through the session mux. Nothing in libid-tlsn exposed it.

The OAuth Bridge needs it. Its contract (oauth-bridge.md, §GitHub token endpoint) has the notary address arrive in the request and the Bridge derive wss://{notaryAddress}/notarize-proxy from it — and /notarize-proxy is the notary's Proxy-TLS endpoint. Without a proxy prover the Bridge can only dial a configured address over the wire port, which is the "notary mapping or override" its contract says it must not maintain. See libid-org/libID-server-rs#8, the notaryAddress thread.

What

prover_proxy, with the same arguments and the same ProverResult as prover_generic. A caller states its transport by choosing a function rather than passing a value.

The two transports differ in exactly one place, and the change is shaped to keep it that way:

• Prover::commit is already generic over the protocol config (MpcTlsConfig / ProxyTlsConfig);
• a connected prover's future resolves to Prover<state::Committed> whichever way the connection was made.

So the branch covers the commit config and the connect call — MPC passes a socket it opened, Proxy passes none — and everything downstream is written once: the HTTP exchange, the disclosure the prover chooses through select_layout, the commitments as the complement of the reveals, the attested record. Those are the parts a verifier reads, and two copies of them would be two copies that can disagree about what a session proves.

prover_generic keeps its signature and its behaviour. Both callers (the Bridge, the JWKS keeper) are unaffected.

Verification

• cargo test --all — green (all existing suites)
• cargo clippy --all-targets --all-features -- -D warnings — clean
• cargo +nightly fmt --all -- --check — clean

Not exercised end to end here, on purpose. The proxy verifier lives in the notary service, and this repository's tests deliberately open no TLS (ceremony_end_to_end.rs: "It is not a network test"). The place for that test is notary's proxy_protocol_returns_attestation_on_the_reclaimed_websocket, which already drives this protocol from the client side with tlsn-server-fixture as the target.

🤖 Generated with Claude Code

https://claude.ai/code/session_01F9MSaibJ5zbBEBigjNjvca