This repository has been archived on 2026-10-08. You can view files and clone it. You cannot open issues or pull requests or push a commit.

naps62-yoloandClaude Opus 4.8 939d67615a fix(maestro): bind registry JWTs to issuer/audience to stop token confusion (NAP-266) ...

Cookie and pair-attach JWTs are signed with the same shared secret. Neither
verifier bound the token's purpose, so a token minted for one could in principle
validate as the other.

- Add a canonical `REGISTRY_ISSUER` to maestro-protocol; registry re-exports it.
- Auth cookies now carry `iss = maestro-registry` + a dedicated `aud =
  maestro-cookie`; `verify_cookie` binds both, so a pair-attach JWT (daemon-id
  audience) is rejected.
- `PairAttachVerifier::verify` now binds `iss = REGISTRY_ISSUER`, rejecting any
  token not minted by the registry.

Tests: pair-verifier rejects a foreign issuer; verify_cookie rejects a
pair-attach JWT. Existing cookie + broker e2e flows unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 22:44:25 +00:00

..

src

fix(maestro): bind registry JWTs to issuer/audience to stop token confusion (NAP-266)

2026-05-31 22:44:25 +00:00

Cargo.toml

feat(maestro): add maestro-protocol crate with wire types

2026-05-24 12:35:16 +00:00