Skip to content

Release Notes v0.8.0

Release Date: October 2026

Highlights

  • AAuth Explorer: a documentation page that steps through each AAuth access mode one message at a time, generated from a new PIDL document for draft-hardt-oauth-aauth-protocol-11
  • AAuth and OAuth 2.0: a comparison against draft-11, with diagrams generated from PIDL and D2
  • ID-JAG vs AAuth: an infographic comparing enterprise-managed and agent-first authorization

No breaking changes.

New Features

AAuth PIDL Document

aauth/pidl/aauth_protocol.json describes AAuth draft-11 in one PIDL file:

  • The five resource access modes as scenarios: agent identity, resource-managed, person identity, PS authorization and federated authorization.
  • Shared fragments for obtaining the agent token and the person token, and for consent.
  • A narrative and an example message for every step, with decoded tokens, using one consistent set of keys, tokens and timestamps.

The document describes the protocol only. An implementation can add its own code samples when generating a walkthrough, with a pidl sample set, so the document names no implementation.

A test validates the document with pidl v0.9.0, pins its scenarios, and checks the one analyzer finding the document is meant to show: in federated access, the person server signs the request to the access server while the resource token it presents was delivered to the agent.

aauth/pidl/resource_managed.json also gains deferred consent: the person approving at the person server while the agent polls.

AAuth Explorer

The AAuth Explorer steps through each access mode one message at a time. The sequence diagram highlights the roles and the message, and the panels beside it show each request and response as HTTP or as a curl command, with each token decoded.

The page loads the @grokify/pidl-viewer script from jsDelivr at a pinned version, checked against its hash, and shows aauth.walkthrough.json beside it. Regenerate the walkthrough with:

docs/aauth/explorer/build.sh

The test above fails when the committed walkthrough no longer matches the document.

Documentation

  • AAuth and OAuth 2.0: goals, participants, the two halves of each flow, how tokens, endpoints and headers map, what OAuth drafts add and what stays missing, and how to run both together. Its diagrams are generated from PIDL and D2 sources by a reproducible build script.
  • An ID-JAG vs AAuth infographic, with its card definition and rendered SVG, PNG and GIF, in docs/diagrams/.
  • The PIDL D2 diagrams are regenerated with current pidl.
  • Links to files outside the documentation site are fixed, so the site builds in strict mode.

Dependencies

  • github.com/grokify/pidl v0.9.0 added, for the AAuth PIDL document test
  • github.com/grokify/oscompat v0.8.0 added, so that test passes on Windows checkouts
  • github.com/modelcontextprotocol/go-sdk v1.7.0 → v1.8.0
  • go.opentelemetry.io/otel, otel/metric and otel/trace v1.45.0 → v1.47.0
  • golang.org/x/oauth2 v0.36.0 → v0.37.0
  • Indirect dependencies updated

Installation

go get github.com/aistandardsio/[email protected]

See the changelog for every change.