[xgreenx]

Stacked on #6 (feat/ws-attestations), which sits on #3.

The JWKS reading becomes an ordinary notarized session: the notary signs the section 9.1 record for it exactly as for a platform session and decides nothing about it. Deleted: the Merkle JwksRotationProof path (jwks/{notary,transcript,sol_types}.rs), the server-name dispatch, the jwks_enabled flag, and the deps only that path used.

What stays in jwks/: the constants, layout (reveal both directions whole, commit nothing), the prover (notarize_jwks returns the signed record), and a mock prover that synthesizes a byte-faithful session — the request as hyper writes it (pinned by a test that drives hyper's own encoder) and Google's real response framing (chunked by default) — for the keeper's end-to-end test. The wire struct is notary::NotarizedSession, an alias of libid-transcript's AttestationWire; serde field names unchanged.

On chain, GoogleJwtRoots (libid-org/libID-contracts#21) verifies the record through NotaryService and parses the JWKS itself.

examples/notarize_jwks.rs captures a real reading from a running notary as a JSON fixture (README: "Capturing a real reading"). The fixture committed to libid-contracts#21 came from it: a genuine MPC-TLS session with www.googleapis.com on 2026-09-03, origin-form request line on the wire, chunked body, four keys.

Pins: all libid-rs crates at the head of libid-org/libid-rs fix/origin-form-request-target (libid-rs#5) — the Rust prover was writing absolute-form request lines, which the verifiers refuse. Both pins return to a tag once that stack merges. Note for consumers: the [patch] of tlsnotary/tlsn in this manifest does not propagate; a crate depending on this library must repeat it (the keeper does).

Verification: cargo +nightly fmt --all -- --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all (16 passed, MPC and proxy smoke tests included).

---

Actualised against the moved base (2026-09-14)

The base gained libid-rs v0.3.0 (contains every rev this branch had pinned), the merged
notary#9 pins (libid-org/tlsn@550220e, libid-org/mpz@4db9454), and #6's rewrite of
server.rs and the browser bundle. This branch also carried five pre-force-push copies of that
work, which is why it showed as conflicting.

Resolved by a merge commit (no history rewrite): Hlib's files take the base wholesale; this
branch's intent — delete the Merkle path and the server-name dispatch, NotarizedSession, the JWKS
module, the example, the README paragraphs — is re-applied on top. One API move for v0.3.0:
attestation::tag(host) → AttestedData::authority_id_of(host).

So the pin paragraph above is now stale: all libid-rs crates are at tag v0.3.0, not a rev, and
notary#8 (which only moved those pins) is superseded.

Verified after the merge: cargo +nightly fmt --all -- --check,
cargo clippy --all-targets --all-features -- -D warnings, cargo test --all,
cargo build --example notarize_jwks.

[xgreenx]

Replaced by #10, rebuilt as one clean commit on the current feat/ws-attestations: this branch had accumulated pre-force-push copies of #6 and needed a merge commit to become mergeable. #10 goes further and removes the JWKS prover helpers from the notary entirely; they move to the keeper in libid-org/keeper#7, which drops the keeper\x27s dependency on this crate. Branch left in place until keeper#7 merges, since keeper\x27s feat/notary-service-rotation still pins 67dd1fe from here.