<commit_before>"""

-------------------
Protocol definition
-------------------

Client->Agent: please identify and assert my authenticity, also sign my ctx, the secrets 
               will be using, also give back or store my authz-tkns please

{
    #BEGIN authN request [All optional except 1st]

    "authn-tkn" : [ # authn_tkn type, mandatory, any combination of "basic", "binary", "execution", "proxyctx", "sysctx"
        "...",
        "..."
    ],

    #optional challenge from server, preferrable rand# + validity signed by server against replay
    "challenge" : "...", 
    
    #extra binaries need to hash and sign, if "binary" auth is req'd 
    "bin-hash" : [
         "path/to/exe-1" : "",
         "path/to/exe-2" : ""
    ],

    #environs need to retrieve and sign, if "execution" is req'd 
    "env-list" : [
         "name1" : "",
         "name2" : ""
    ],

    #optional app-ctxs need to sign, possible for any authn type
    "app-ctx" : [
         "name1" : "value2",
         "name2" : "value2"
    ],

    #sys-ctxs need to retrieve and sign, if "sysctx" is req'd
    "sys-ctx" : [
         "name1" : ""
         "name2" : ""
    ],

    #proxy ctx

    "proxy-ctx" : [ # proxy with the following authn_tkn characteristics can act on my behalf
        "app@host#user" : {
          "token_type: "..."
          "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...
          "srvs-list : [
                {
                    "srvs-id" : "app@host#user"
                    "srvs-proxy-ctx" : {
                        # srvs-proxy context specific to service   
                    },
                    "transitive" : "false"
                }
          ]  
        }
    ]


    #END authN request [All optional]

    #Sign my public keys if you will
    "key-sign" : [
          {
               "algo" : "...",
               "name" : "...",
               "pubk" : "...",
               "usage" : "..."
          }
    ],

    #Sign my certs (csr) if you will
    "cert-sign" : [
          "csr" : "...",
    ],

    #AuthZ tkn storage you may provide
    "authz-tkn" : [ 
          # GET
          [
              "srvs-id" : "service-00",
              "srvs-id" : "service-01",
          ],
          # PUT
          {
              "srvs-id" : "service-01",
              "authz-tk" : "tkn-in-b64"
              "ttl" : "in seconds"
          }
    ]
}

Agent->Client: here's my assertion for you, together with your ctx signed

{
    # Authn-tkn cert/pubK accessible to all, hence not it's included
    # Accessible via https from localhost or from local filesystem.

    # Each *-sig is calculated (sha1WithRSAencryption) with its applicable
    # items, the following two and challenge if prensented.

    "sig_salt" : "....",
    "validty"  : "from-to in seconds after unix epoc",  
    
    "authn-tkn" : [
          "subj" : "app@host#user" 
          "token_type" : [ # exactly as in req
          ],
          "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...
          "authn_algo" : "sha1-rsa"
          "authn-sig" : "b64 hash" of all three
    ]

    "bin-sig" : { 
	  "bin-hash" : "exe hex hash"
          "path/to/exe-1" : "",
          "path/to/exe-2" : ""
          "bin-sig"  : "...."
    },

    "exe-sig" : {
	  "bin-dir"  : "/home/jz/bin"
	  "cmd-arg  : "space seperated"
          "cwd" : "/"
          "root" : "/"
   	  "env-list" : { # only if req'd
              [
                  "name1" : "value2"
                  "name2" : "value2"
              ],
          "exe-sig" : "...."
    },
    
    "app-ctx-sig" : {
          "ctx-sig" : "....", # only if requested
    },
    
    "sys-ctx-sig" : { # only if requested
          [
              "name1" : "value2"
              "name2" : "value2"
          ],

          "sys-ctx-sig" : "....."
    }

    #proxy ctx

    "proxy-sig" : {
        [
            "app1@host1#user1" : "sig1",
            "app2@host2#user2" : "sig2"
        ]
    },

    #
    
    "key-sign" : [
          {
               "pubk" : "...",
               "sign" : "..."
          }
    ],

    "cert-sign" : [
          "cert" : "...",
    ],

    "authz-tkn" : [ 
          {
              "srvs-id" : "service-01",
              "auth-tk" : "tkn-in-b64"
          }
    ]
}

"""
<commit_msg>protocol refinement<commit_after>"""

-------------------
Protocol definition
-------------------

Client->Agent: please identify and assert my authenticity, also sign my ctx, the secrets 
               will be using, also give back or store my authz-tkns please

{
    #BEGIN authN request [All optional except 1st]

    "authn-tkn" : [ # authn_tkn type, mandatory, any combination of "basic", "binary", "execution", "proxyctx", "sysctx"
        "...",
        "..."
    ],

    #optional challenge from server, preferrable rand# + validity signed by server against replay
    "challenge" : "...", 
    
    #extra binaries need to hash and sign, if "binary" auth is req'd 
    "bin-hash" : [
         "path/to/exe-1" : "",
         "path/to/exe-2" : ""
    ],

    #environs need to retrieve and sign, if "execution" is req'd 
    "env-list" : [
         "name1" : "",
         "name2" : ""
    ],

    #optional app-ctxs need to sign, possible for any authn type
    "app-ctx" : [
         "name1" : "value2",
         "name2" : "value2"
    ],

    #sys-ctxs need to retrieve and sign, if "sysctx" is req'd
    "sys-ctx" : [
         "name1" : ""
         "name2" : ""
    ],

    #proxy ctx

    "proxy-ctx" : [ # proxy with the following authn_tkn characteristics can act on my behalf
        "app@host#user" : {
          "token_type: "..."
          "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...
          "srvs-list : [
                {
                    "srvs-id" : "app@host#user"
                    "srvs-proxy-ctx" : {
                        # srvs-proxy context specific to service   
                    },
                    "transitive" : "false"
                }
          ]  
        }
    ]


    #END authN request [All optional]

    #Sign my public keys if you will
    "key-sign" : [
          {
               "algo" : "...",
               "name" : "...",
               "pubk" : "...",
               "usage" : "..."
          }
    ],

    #Sign my certs (csr) if you will
    "cert-sign" : [
          "csr" : "...",
    ],

    #AuthZ tkn storage you may provide
    "authz-tkn" : [ 
          # GET
          [
              "srvs-id" : "service-00",
              "srvs-id" : "service-01",
          ],
          # PUT
          {
              "srvs-id" : "service-01",
              "authz-tk" : "tkn-in-b64"
              "ttl" : "in seconds"
          }
    ]
}

Agent->Client: here's my assertion for you, together with your ctx signed

{
    # Authn-tkn cert/pubK accessible to all, hence not it's included
    # Accessible via https from localhost or from local filesystem.

    # Each *-sig is calculated (sha1WithRSAencryption) with its applicable
    # items, the following two and challenge if prensented.

    "sig_salt" : "....",
    "validty"  : "from-to in seconds after unix epoc",  
    "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...
    "authn_algo" : "sha1-rsa"
    "authn-sig" : "b64 hash" of all three
    
    "authn-tkn" : [

        "subject" : "app@host#user" 
        
        "bin-ctx" : { 
	        "bin-hash" : "exe hex hash"
            "path/to/exe-1" : "",
            "path/to/exe-2" : ""
        },

        "exe-ctx" : {
	          "bin-dir"  : "/home/jz/bin"
	          "cmd-arg  : "space seperated"
              "cwd" : "/"
              "root" : "/"
           	  "env-list" : [ # only if req'd
                   "name1" : "value2"
                   "name2" : "value2"
              ],
        },
        
        "app-ctx" : [ # exactly as requested
             "name1" : "value2",
             "name2" : "value2"
        ],
        
        "sys-ctx" : [ # only if requested
              
                  "name1" : "value2"
                  "name2" : "value2"
        ]

        "sig_salt" : "....",

        "validty"  : "from-to in seconds after unix epoc",  

        "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...

        "authn_algo" : "sha1-rsa"

        "authn-sig" : "b64 hash" of all three
    ]

    #proxy ctx

    "proxy-ctx-sig" : [ # proxy with the following authn_tkn characteristics can act on my behalf

        "app@host#user" : {

          "token_type: "..."
          "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...
          "srvs-list : [
                {
                    "srvs-id" : "app@host#user"
                    "srvs-proxy-ctx" : {
                        # srvs-proxy context specific to service   
                    },
                    "transitive" : "false"
                }
          ]
            
          "sig_salt" : "....",

          "validty"  : "from-to in seconds after unix epoc",  

          "authn_type" : "TPM", # TPM, HSM, PubK, SymK, 2F, ...

          "authn_algo" : "sha1-rsa"

          "authn-sig" : "b64 hash" of all three
  
        }
    ]

    #
    
    "key-sign" : [
          {
               "pubk" : "...",
               "sign" : "..."
          }
    ],

    "cert-sign" : [
          "cert" : "...",
    ],

    "authz-tkn" : [ 
          {
              "srvs-id" : "service-01",
              "auth-tk" : "tkn-in-b64"
          }
    ]
}

"""

{'fraction_non_alphanumeric': 0.16204194026689261, 'fraction_numerical': 0.010485066723151875, 'mean_word_length': 1.226072607260726, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3042393', 'n_tokens_mistral': 3312, 'n_tokens_neox': 3100, 'n_words': 723}