Class ChallengeResponse

src/orgkernel/schemas/agent_identity.py:387–418

Response to a challenge — agent signs the nonce with its private key. The verifier checks: 1. challenge_id matches the request 2. agent_id matches 3. Signature verifies against the agent's public key in the certificate

class ChallengeResponse(BaseModel):
    """
    Response to a challenge — agent signs the nonce with its private key.

    The verifier checks:
        1. challenge_id matches the request
        2. agent_id matches
        3. Signature verifies against the agent's public key in the certificate
    """
    challenge_id: str = Field(
        description="ID of the challenge being responded to.",
    )
    agent_id: str
    signature: str = Field(
        description="Ed25519 signature over nonce using agent's private key.",
    )
    public_key: str = Field(
        description="Ed25519 public key (for verification without DB lookup).",
    )
    certificate_id: str = Field(
        description="Certificate ID (agent_id) being used.",
    )
    issued_at: datetime = Field(default_factory=_now_utc)

    @field_validator("signature")
    @classmethod
    def _validate_signature(cls, v: str) -> str:
        if not _B64URL_SIG_RE.match(v):
            raise ValueError(
                "signature must be a 86-88 char Base64url Ed25519 signature (64 bytes)."
            )
        return v


class ChallengeVerificationResult(BaseModel):