[Benoît Cortier (CBenoit)]

An enrollment or renewal decision applies the rules to one CSR key and one stored state, so it now carries what it was made from.
A decision to create an identity carries the token's use count it was decided from and the SPKI SHA-256 of the CSR key; a decision to issue a pending certificate carries the key's digest and the renewing identity.
Both IdentityCertificateIssuer.Issue overloads refuse a CSR whose key is not the decision's, so a certificate is issued only for the key that the rules were applied to.
The README states the host rules that the concurrency properties rest on: a unique index on the SPKI SHA-256 of every issued key, a use count updated only while it is below the limit, renewals of one identity serialized by a lock on it, and deciding again from the stored state, acting on the new decision, when the index or the count refuses the write.

RequestAuthenticator reads the clock again just before recording a nonce, refuses with clock_skew a request whose freshness window closed in between, and asks the store to keep the pair 60 s past the end of the window, so that a signature can no longer be accepted once its nonce record may be discarded.
The shared intent now states that retention period as a minimum.

IdentityConfig.Create refuses a non-ASCII agent_channel_url, which the contract reads as text like the token's u, and u holds only ASCII; both now share one check that points to the xn-- form.

The package version is 2026.10.27.
A host moving to it changes the following:

• Pass the request's validated CSR to RenewalRules.Decide(renewing, csr, keyMatch).
• Pass the RenewalDecision instead of the AuthenticatedIdentity to the renewal IdentityCertificateIssuer.Issue, and only an IssuePendingCertificate one.
• Pass both Issue overloads the CSR that the decision was made from.
• Keep a unique index on the SPKI SHA-256 of every issued key, and count a token use only while the stored count is still below MaxUses, or, stricter, still equals EnrollmentDecision.ExpectedIdentitiesCreated, in the transaction that creates the identity; when either refuses the write, decide again and act on the new decision.
• Store a renewal's pending certificate, insert its key and retire the identity's previous pending certificate in one transaction that first takes a write lock on the identity's record.
• Let an INonceStore keep pairs until 120 s after expires, instead of 60 s.
• Expect IdentityConfig.Create to throw for a non-ASCII agent_channel_url.

BREAKING CHANGE: RenewalRules.Decide takes the CSR, and the renewal IdentityCertificateIssuer.Issue takes the RenewalDecision instead of the AuthenticatedIdentity.

Issue: DGW-479
Security: yes

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[Benoît Cortier (CBenoit)]

Acceptance evidence

Checked at the pull request head with build.ps1 (0 warnings, warnings as errors), dotnet test on the solution, and ci/check-oracle-markers.ps1.

Check	Evidence
A creating enrollment decision carries the decided use count and the CSR key's SPKI SHA-256; refusals and replays carry neither	EnrollmentRulesTests.CreateIdentityCarriesTheCountOfIdentitiesItWasDecidedFrom, CreateIdentityCarriesTheSpkiSha256OfTheCsrKey, CarriesNoNewIdentityWhenCreatingNone
A renewal decision to issue carries the CSR key's digest; the other outcomes carry none	RenewalRulesTests.IssuePendingCertificateCarriesTheSpkiSha256OfTheCsrKey, and the empty-digest assertions in the replay and refusal tests
Both Issue overloads refuse a CSR with another key, and the renewal one refuses a decision of another outcome	IdentityCertificateIssuerTests
A request whose window closes before its nonce is recorded gets clock_skew and records nothing; one still inside it is accepted	RequestAuthenticatorTests.RequestWhoseWindowClosesBeforeItsNonceIsRecordedIsClockSkew, RequestInsideItsWindowWhenItsNonceIsRecordedIsAccepted
The nonce pair is kept until 120 s after expires	RequestAuthenticatorVectorTests.OkCaseRecordsItsNonceOnceUntilAfterItsWindowCloses
A non-ASCII agent_channel_url or token u is refused	UnacceptableUrls rows used by the IdentityConfig and EnrollmentToken tests
No change under docs/agent-identity/, intent files, contract files or crates/agent-identity-conformance	git diff --stat origin/master...HEAD on those paths is empty

Test run: 1805 passed, 0 failed.

Deviations and open questions

• Nonce retention vs. intent wording. The library asks the store to keep each nonce 60 s past the window, as a margin for the store call after the last clock reading. With the intent owner's approval, the shared intent now says it keeps each accepted nonce "at least until" 60 s after its signature expires (d16fa75).
• Invisible formatting characters in metadata and friendly names are not in this pull request: rejecting them changes the contract, the conformance suite and the agent, so it gets its own pull request.
• Decisions carry a digest, not the CSR. Holding the CSR itself on the decision would make a mismatch unrepresentable; the digest was kept because the host needs it for its unique index anyway, and the check makes a mismatch fail loudly.
• DVLS already counts uses with UsedCount < MaxUses and keys issued certificates by SPKI SHA-256, so it meets those two README rules; when it takes 2026.10.27 it needs the API changes listed in the description and, unless it already serializes renewals of one identity, the lock on the identity in its renewal transaction.
• Non-ASCII agent_channel_url. The contract reads it "as text like u", and u holds only ASCII, so the library refuses it, as the brief for this change asked. The agent's config parsing (crates/agent-identity/src/schedule.rs) applies u's text rules but not its ASCII rule, so it accepts such a URL and lets the url crate convert the host; either the agent or the contract wording needs aligning, outside this pull request.
• Use count. The README leads with the update that fails only at the limit and keeps the compare with ExpectedIdentitiesCreated as a stricter option, because the compare refuses every enrollment another one overtook, which makes many devices enrolling with one token decide again repeatedly.
• The renewal Issue overload takes the RenewalDecision rather than the AuthenticatedIdentity, so a renewal certificate, like an enrollment one, is issued only from a decision of the rules.

Size

	Added	Removed
Production (code and XML docs)	223	55
Tests	298	79
README	25	10

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

Intent drift audit: dotnet/Devolutions.Agent.Identity.Authority, a66a019d0..d16fa75ce

Audited against: dotnet/Devolutions.Agent.Identity.Authority/INTENT.md (4 statements), INTENT.agent-identity.md (statements the diff bears on: Security invariants 2, Request authentication 2, 8, 9; the rest out of scope), docs/agent-identity/CONTRACT.agent-identity.md §2 u, §2.1, §5.2 agent_channel_url, §5.3, §6.
No violations or partials.
Paths are relative to dotnet/Devolutions.Agent.Identity.Authority/Devolutions.Agent.Identity.Authority/ unless they start with README.md.

ID	Statement (abridged)	Status	Evidence	Note
CONTRACT.agent-identity.md#enroll-agent_channel_url	agent_channel_url is read as text like u (§2), so ASCII only	Conforms (fixed)	Protocol/BaseUrl.cs:25, Bodies/IdentityConfig.cs:100	was accepted before this change
INTENT.agent-identity.md#request-authentication-9	Keep each accepted nonce at least until 60 s after its signature expires	Conforms	Authentication/RequestAuthenticator.cs:318-320	kept 60 s longer, as a margin for the store call; the intent line now states a minimum
INTENT.agent-identity.md#request-authentication-2	A captured request authentication can't be replayed	Conforms (introduced)	Authentication/RequestAuthenticator.cs:310, :318-322	UNTESTED: at :306
CONTRACT.agent-identity.md#signatures-3	Step 3 window → else clock_skew; earliest failing step wins; step 6 only after 1–5	Conforms	Authentication/RequestAuthenticator.cs:225, :310-315	the re-check is step 3 at a later reading, after 4 and 5 passed
INTENT.agent-identity.md#request-authentication-8	Record a nonce only after signature and body digest are valid	Conforms	Authentication/RequestAuthenticator.cs:295-322
INTENT.md#authenticated-identity-1	Code acting for an identity takes it as a type only the signature check creates	Conforms (introduced)	Certificates/RenewalDecision.cs:52-69, Certificates/RenewalRules.cs:54, Certificates/IdentityCertificateIssuer.cs:324, :342	the renewal Issue now takes a decision only Decide makes from an AuthenticatedIdentity
INTENT.md#failure-details-1	Failure details hold no request value	Conforms	Authentication/RequestAuthenticator.cs:314, Certificates/IdentityCertificateIssuer.cs:347-354, Protocol/BaseUrl.cs:25-30
CONTRACT.agent-identity.md#token-rules-concurrency-1	Every issued key unique by SPKI SHA-256	Conforms (library part)	decisions carry the digest; Certificates/IdentityCertificateIssuer.cs:109, :339; README.md:46, :51	the index itself is the host's
CONTRACT.agent-identity.md#token-rules-concurrency-2	Never more than max_uses identities under concurrency	Conforms (library part)	Enrollment/EnrollmentRules.cs:104-108; README.md:48-49, :51	the conditional update is the host's
CONTRACT.agent-identity.md#token-rules-concurrency-3	Two concurrent same-key enrollments or renewals: one creates, the other replays	Conforms (judgement)	README.md:51-52, :93, :114	deciding again from the stored state yields the replay or the pending certificate; renewals of one identity take a write lock on it
CONTRACT.agent-identity.md#renew-4	A key never issued gets a new pending certificate, retiring the previous one	Conforms	Certificates/RenewalRules.cs:61-64, README.md:114
CONTRACT.agent-identity.md#enrollment-token-u	u holds only ASCII	Conforms	Protocol/BaseUrl.cs:25, Enrollment/EnrollmentToken.cs:95	check moved, not changed
INTENT.agent-identity.md#security-invariants-2	The CSR supplies only a verified public key	Conforms	Enrollment/EnrollmentRules.cs:104-108, Certificates/RenewalRules.cs:63	decisions take only the key's digest from the CSR
INTENT.md (purpose)	The library holds nothing about storage, hosting or management	Conforms (judgement)	README.md:46-52	the README states storage obligations the contract puts on every authority; the library stores nothing

Not covered by intent

• The 60 s size of the nonce retention margin, which assumes a store call completes within 60 s of the last window reading.
• New public surface: EnrollmentDecision.ExpectedIdentitiesCreated, EnrollmentDecision.SubjectPublicKeyInfoSha256, RenewalDecision.SubjectPublicKeyInfoSha256, and the RenewalRules.Decide and renewal Issue signatures.

Note

LLM-assisted content (no human feedback).

[Benoît Cortier (CBenoit)]

Untested properties

• RequestAuthenticator.AuthenticateAsync, the window re-check before step 6: it must stay the last clock reading and the last await before INonceStore.TryRecordAsync, because the 60 s retention margin covers only the store call. Work awaited between them would let a copy of the signature reach the store after its pair was discarded. When changing this code, keep the check immediately before the store call or widen the margin.

Note

LLM-assisted content (no human feedback).