feat: the ceremony wire constructions — digest, PKCE, attested data, reveal layouts

.github/workflows/ci.yml

@@ -191,7 +191,7 @@ jobs:
           cargo publish --dry-run
           -p libid-crypto
           -p libid-transcript
-          -p libid-attestations
+          -p libid-ceremony
           -p libid-signer
 
   # ---------------------------------------------------------------------------

.github/workflows/scripts/publish-crates.sh

@@ -21,8 +21,8 @@ version="${1:?usage: publish-crates.sh <version>}"
 : "${CARGO_REGISTRY_TOKEN:?CARGO_REGISTRY_TOKEN must be set}"
 
 # Dependency order: crypto has no intra-workspace deps; transcript is
-# standalone; attestations depends on crypto; signer dev-depends on crypto.
-CRATES=(libid-crypto libid-transcript libid-attestations libid-signer)
+# standalone; ceremony depends on crypto; signer dev-depends on crypto.
+CRATES=(libid-crypto libid-transcript libid-ceremony libid-signer)
 
 # Sparse-index path for a crate name (all our names are >= 4 chars).
 index_path() {

Cargo.toml

@@ -23,18 +23,29 @@ repository = "https://github.com/libid-org/libid-rs"
 libid-crypto = { path = "crates/libid-crypto", version = "0.3.0" }
 libid-signer = { path = "crates/libid-signer", version = "0.3.0" }
 libid-transcript = { path = "crates/libid-transcript", version = "0.3.0" }
-libid-attestations = { path = "crates/libid-attestations", version = "0.3.0" }
+libid-ceremony = { path = "crates/libid-ceremony", version = "0.3.0" }
 
 alloy = { version = "1", default-features = false }
-alloy-primitives = { version = "1", features = ["serde"] }
-alloy-sol-types = "1"
 # KMS-backed signing. alloy's `signer-aws` feature re-exports
 # `alloy::signers::aws::AwsSigner`, but constructing one needs an
 # `aws_sdk_kms::Client`, so the SDK is a direct dependency too. Both are
 # pinned to the 1.x line so cargo unifies them with whatever alloy resolves.
 aws-config = "1"
 aws-sdk-kms = "1"
+# Pinned exactly: the encoded bytes are a signed preimage, so a layout change
+# in a patch release would change what every notary signs.
+bincode = { version = "=2.0.1", features = ["derive"] }
 hex = "0.4"
+# The ceremony profiles, generated in libid-contracts from the same
+# `profiles.json` its verifiers read. Zero dependencies of its own.
+libid-profiles = "0.9"
+# The generated handle table, for the test that keeps the platform names of
+# the ceremony profiles and the identity system from drifting apart. A
+# dev-dependency only: nothing published carries it.
+libid-identity = "0.9"
+# Chunk-size parsing. Hand-rolling it is how a malformed chunk becomes a short
+# body instead of an error.
+httparse = "1"
 http-body-util = "0.1"
 hyper = { version = "1.1", features = ["client", "http1"] }
 hyper-util = { version = "0.1", features = ["full"] }
@@ -51,6 +62,4 @@ tlsn = { git = "https://github.com/tlsnotary/tlsn", tag = "v0.1.0-alpha.15" }
 tokio = { version = "1", features = ["rt", "macros", "net", "io-util", "sync"] }
 tokio-util = { version = "0.7", features = ["compat"] }
 tracing = "0.1"
-# TS bindings codegen — opt-in via the `ts` feature of libid-transcript.
-ts-rs = { version = "10", features = ["serde-compat"] }
 webpki-root-certs = "1.0"

README.md

@@ -2,18 +2,18 @@
 
 Shared Rust crates for MPC-TLS / zkTLS infrastructure: run TLSNotary-style
 notarization sessions, carve selective-disclosure ranges out of TLS
-transcripts, build the Merkle/EIP-191 proof material, and produce the exact
-digests the libID on-chain verifiers check.
+transcripts, sign the EIP-191 material, and produce the exact attested-data
+record the libID on-chain verifiers check.
 
 ## Crates
 
 | Crate | crates.io | What it is |
 | --- | --- | --- |
-| `libid-crypto` | yes | Contract-agnostic primitives: keccak256, EIP-191 sign/recover (27/28 `v`, low-s), OpenZeppelin-compatible sorted-pair keccak Merkle tree (root, inclusion proofs, verify, double-hashed prefixed leaves), Ethereum address and hex-key helpers. Minimal deps: `k256`, `tiny-keccak`, `hex`. |
-| `libid-transcript` | yes | The tlsn-free half of the MPC-TLS toolkit. HTTP/JSON transcript range math for selective disclosure (header/body/chunked decoding, JSON field and `"key":"value"` snippet ranges, bare-number id snippets, anchored lookups, notary reveal ranges); the length-prefixed JSON wire protocol notary and prover speak after MPC-TLS closes; the `EvmProof` / `NotaryResponse` / `TlsHandshakeData` types. |
-| `libid-attestations` | yes | Contract-ABI-shaped digest builders, byte-pinned against the Solidity verifiers: chain-bound notary digest, JWKS-rotation notary digest (legacy 6-slot), backend digest, identity hash, and the XZkVerifier token/me attestation digests with their op-tags. |
+| `libid-crypto` | yes | Contract-agnostic primitives: keccak256, EIP-191 sign/recover (27/28 `v`, low-s) — the pair a notary signature is made and checked with — plus address derivation and hex-key parsing. Minimal deps: `k256`, `tiny-keccak`, `hex`. |
+| `libid-transcript` | yes | The tlsn-free half of the MPC-TLS toolkit. HTTP/JSON transcript range math for selective disclosure (header/body/chunked decoding, `"key":"value"` and bare-number member ranges); the per-session ceremony reveal layouts, built from the profile table generated in libid-contracts; the length-prefixed JSON wire protocol notary and prover speak after MPC-TLS closes; the `AttestationWire` type. |
+| `libid-ceremony` | yes | The attested-data record a notary signs: the types a Platform Profile pins, their big-endian fixed-width encoder, and the keccak256 over it that is the only preimage a notary signs. Also the GitHub Token Service request and response records with the bounds a served call must satisfy. |
 | `libid-signer` | yes | `ManagedSigner` — one signing identity over a local hex key or an AWS KMS key: EIP-191 claim signing (byte-compatible with `libid_crypto::sign_eth_claim`), bare prehash signing (the tlsn `Secp256k1Eth` format), alloy transaction wallets, public-key accessors, and `SignerSource::from_spec` shape-classified key-spec parsing (64-hex → local key, anything else → KMS). |
-| `libid-tlsn` | **no — git only** | The MPC-TLS session driver over the upstream `tlsn` crate: `prover` / `prover_generic` / `verifier` over any async socket, TLS 1.2 handshake-data extraction, WebPKI root store. |
+| `libid-tlsn` | **no — git only** | The MPC-TLS session driver over the upstream `tlsn` crate: `prover_generic` and `verifier` over any async socket, the attested-data record built from what a session was observed to be, WebPKI root store. |
 
 ## The tlsn git-dep caveat
 
@@ -27,16 +27,9 @@ libid-tlsn = { git = "https://github.com/libid-org/libid-rs", tag = "v0.3.0" }
 ```
 
 The crate split exists precisely so this caveat stays contained: everything
-that does not need `tlsn` types — range math, wire protocol, proof types,
-digests, signing — is published normally and never drags the git pin into
-your lockfile.
-
-## Feature flags
-
-* `libid-transcript/ts` — derives `ts_rs::TS` on `EvmProof` and
-  `NotaryResponse` for TypeScript bindings generation. Off by default so
-  production builds don't carry `ts-rs`.
-* `libid-tlsn` and everything else: no features.
+that does not need `tlsn` types — range math, reveal layouts, the attested-data
+record, wire protocol, signing — is published normally and never drags the git
+pin into your lockfile.
 
 ## Usage sketch
 
@@ -45,34 +38,50 @@ answers over the same socket:
 
 ```rust,ignore
 let result = libid_tlsn::verifier(socket).await?;
-// inspect result.partial_transcript / result.tls_transcript, build an
-// EvmProof with libid_crypto merkle + libid_attestations digests, sign it
-// with libid_signer::ManagedSigner, then:
+// describe the session as a libid_tlsn::attest::ObservedSession and build
+// the record with AttestedData::from_observed,
+// sign its digest with libid_signer::ManagedSigner, then:
 libid_transcript::write_msg(&mut result.recovered_io, &response).await?;
 ```
 
-A prover connects to a notary and fetches an authenticated endpoint,
-revealing only the chosen JSON snippets:
+A prover connects to a notary, sends one request inside MPC-TLS, and decides
+what of the exchange is revealed and what is committed. For a launch profile
+that decision is `libid_transcript::ceremony`'s, built from the profile table
+`libid-contracts` generates, so the prover and the on-chain verifier read one
+definition:
 
 ```rust,ignore
-let out = libid_tlsn::prover(
+use libid_tlsn::{Bytes, HttpBody, HttpRequest};
+use libid_transcript::ceremony::{profiles, Layout};
+
+let x = profiles::X.identity.expect("x notarizes an identity session");
+let request = HttpRequest::builder()
+    .method(x.session.method)
+    .uri(format!("https://{}{}", x.session.authority, x.session.path))
+    .header("authorization", format!("Bearer {access_token}"))
+    .header("accept", "application/json")
+    .header("host", x.session.authority)
+    .header("connection", "close")
+    .body(HttpBody::new(Bytes::new()))?;
+
+let out = libid_tlsn::prover_generic(
     socket,
-    access_token,
-    &libid_tlsn::UserInfoParams {
-        api_host: "api.x.com",
-        user_info_path: "/2/users/me",
-        username_field: "username",
-        id_field: Some(("id", true)),
-        user_agent: "my-prover/1.0",
+    request,
+    |sent, recv| {
+        let layouts = Layout::identity_request(sent)
+            .and_then(|s| Layout::identity_response(recv, &x).map(|r| (s, r)));
+        layouts.map_err(|e| libid_tlsn::Error::MpcTlsFailed { detail: e.to_string() })
     },
     |step| tracing::info!(?step),
 )
 .await?;
+// out.response_body, out.secrets, out.commitment_openings, out.recovered_io
 ```
 
-Unauthenticated full-reveal flows (e.g. notarizing a JWKS endpoint) use
-`prover_generic` with `bearer_token: None` and a closure returning
-`vec![0..recv.len()]`.
+The URI is absolute because the host names the server; the wire carries the
+origin-form request line the verifiers pin. A session that reads a public
+document and reveals all of it -- notarizing a JWKS endpoint --
+states its own layouts, revealing the whole of each direction.
 
 ## Versioning and releases