Principal adapters
The current offline kernel contains 7 principal-method adapter crates:
auths-did-keri, auths-did-key, auths-did-web, auths-hsm-attested, auths-raw-key, auths-spiffe-x509, auths-webauthn
| Adapter | Offline claim |
|---|---|
auths-raw-key |
Self-certifying raw-key evidence |
auths-did-key |
Self-certifying did:key evidence |
auths-did-keri |
Bounded offline KEL replay with threshold and rotation commitments |
auths-did-web |
Locally pinned, bundled current or historical DID document evidence |
auths-webauthn |
Challenge, RP, origin, user-presence/verification, counter, and attestation policy |
auths-hsm-attested |
Verifier-pinned protection, device-chain, handle, and transaction binding |
auths-spiffe-x509 |
Bounded X.509-SVID path, URI SAN, EKU, trust-domain, validity, and local status |
Assurance differs
Section titled “Assurance differs”Adapter support is not a claim that all methods provide equal assurance. Configure trust and assurance policy explicitly for the deployment and action.
Acquisition is downstream
Section titled “Acquisition is downstream”These adapters verify static evidence. Live did:web resolution, WebAuthn
interaction, SPIFFE acquisition, and HSM/KMS operations belong in
auths-proof-apps.