Package com.tnsai.identity

Record Class Attestation

java.lang.Object
java.lang.Record
com.tnsai.identity.Attestation
Record Components:
kind - format identifier; lowercase ASCII, hyphen-separated
value - opaque payload; format depends on kind
issuer - principal that signed / issued this attestation
issuedAt - when the issuer minted this attestation
notAfter - optional expiry; empty for non-expiring attestations
public record Attestation(String kind, String value, String issuer, Instant issuedAt, Optional<Instant> notAfter) extends Record
Cryptographic / external-system proof that an AgentPrincipal was issued by a trusted third party (TNS-298).

Attestation backends vary widely:

  • ERC-8004 — Ethereum on-chain attestation; kind = "erc-8004", value = transaction hash, issuer = contract address.
  • X.509 cert — signed certificate; kind = "x509", value = base64 of the cert, issuer = CN of the issuer.
  • AIUC-1 audit binding — insurance certificate id; kind = "aiuc-1", value = certificate id.
  • JWT — bearer token issued by an OIDC provider; kind = "jwt", value = the token string.

The framework treats value as opaque — it's the verifier's job (an AgentPrincipalProvider typically) to validate the attestation against its underlying trust root. The framework just carries it through audit records so external auditors can re-verify.

Since:
0.10.0 (TNS-298)

  • Constructor Details

    • Attestation

      public Attestation(String kind, String value, String issuer, Instant issuedAt, Optional<Instant> notAfter)
      Creates an instance of a Attestation record class.
      Parameters:
      kind - the value for the kind record component
      value - the value for the value record component
      issuer - the value for the issuer record component
      issuedAt - the value for the issuedAt record component
      notAfter - the value for the notAfter record component

  • Method Details

    • isExpired

      public boolean isExpired(Instant now)
      Returns:
      true when notAfter is set and falls before now; auditors and verifiers should reject expired attestations.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • kind

      public String kind()
      Returns the value of the kind record component.
      Returns:
      the value of the kind record component

    • value

      public String value()
      Returns the value of the value record component.
      Returns:
      the value of the value record component

    • issuer

      public String issuer()
      Returns the value of the issuer record component.
      Returns:
      the value of the issuer record component

    • issuedAt

      public Instant issuedAt()
      Returns the value of the issuedAt record component.
      Returns:
      the value of the issuedAt record component

    • notAfter

      public Optional<Instant> notAfter()
      Returns the value of the notAfter record component.
      Returns:
      the value of the notAfter record component