Skip to content

Release Notes v0.9.0

Release Date: October 2026

Highlights

  • Challenge on the API call: a PS Authorization variant for a resource with no authorization endpoint, which answers the agent's call with 401 challenges (draft-11 §6.4, §6.5 and §11.6.2)
  • Real runs beside the protocol: the AAuth document says where each token travels and how the polls are matched, so pidl v0.10.0 can show a deployment's own messages beside each step

No breaking changes.

New Features

PS Authorization, Challenged on the API Call

ps-authorization-challenge in aauth/pidl/aauth_protocol.json is a variant of PS Authorization for a resource that publishes no authorization endpoint and challenges instead:

  1. The agent calls the API with its agent token.
  2. The resource answers 401 with AAuth-Requirement: requirement=person-token; the agent obtains a person token.
  3. The agent calls again. The resource answers 401 with requirement=auth-token and a resource token in the resource-token parameter.
  4. The agent presents the resource token to the person server, obtains an auth token, and repeats the call.

The AAuth Explorer shows it after PS Authorization.

Matching Real Runs

The AAuth document now carries what pidl's observed runs need to match a real deployment's messages to its steps:

  • Token carriage. Each JWT names the places it travels, with its typ: the jwt parameter of Signature-Key, the resource-token parameter of AAuth-Requirement, or a JSON body member. Tokens that share Signature-Key are told apart by typ (aa-agent+jwt, aa-person+jwt, aa-auth+jwt, aa-resource+jwt, jkt-s256+jwt).
  • Poll rules. The consent and resource-managed polls match any GET /pending/{id} and repeat, so every poll in a run belongs to the one step.

The test that validates the document now uses pidl v0.10.0, which checks both. Matched against a run of the AAuth Petstore flow on the aauth-go sandbox, every step of both scenario instances matches strongly and every token is identified by its type.

Documentation

  • New guide: Comparing an AAuth Run with the Protocol, on showing your deployment's messages beside the walkthrough, and trying it against the aauth-go sandbox with aauth-postman.
  • The AAuth Explorer loads @grokify/pidl-viewer 0.10.0, checked against its hash, and links the new guide. Regenerating its walkthrough needs pidl v0.10.0 or later.

Dependencies

  • github.com/grokify/pidl v0.9.0 → v0.10.0
  • github.com/grokify/oscompat v0.8.0 → v0.9.0
  • github.com/plexusone/omniobserve v0.12.0 → v0.12.1
  • Indirect dependencies updated, including google.golang.org/grpc v1.84.0 → v1.85.0

Installation

go get github.com/aistandardsio/[email protected]

See the changelog for every change.