AAuth -11: six access-mode diagrams

[dickhardt]

Six access-mode diagrams for AAuth -11, replacing four that describe a flow the protocol no longer permits.

Why

All four existing mode diagrams opened with HTTPSig w/ agent_token + POST /authorize. -11 does not permit that: an agent MUST present a person token at a resource's authorization endpoint, and a resource MUST have verified one before it issues a resource token. So every authorization flow now starts at the PS's person token endpoint, and every diagram that showed otherwise was teaching the wrong thing.

www is the public explanation of AAuth. A diagram here that contradicts the fleet is worse than no diagram.

The six

Diagram	Change
Identity Based	unchanged
Resource Managed	"AAuth Access Token" is now the session token — the one credential a resource issues for its own consumption. Returned in AAuth-Access, presented back in Authorization: AAuth, with authorization in the signature's covered components. Not DPoP, which the old copy claimed.
Person Identity	new. Person token from POST person_token_endpoint, presented via Signature-Key in place of the agent token; the resource serves on the person's identity alone. No resource token, no auth token.
Person Server Managed	POST /person first, /authorize signed with the person token, resource token carries ps/sub/person_token_jti, and the PS hop is POST /auth_token (the metadata field token_endpoint was renamed auth_token_endpoint).
Federated	same, plus the PS calling the AS's auth_token_endpoint.
Per-Call	new, from R3 -02. The resource challenges an r3_per_call invocation with a resource token whose r3_uri/r3_s256 reference a per-call proposal; the AS fetches it and evaluates the parameters, the PS puts them to the person, and the resource verifies the retry against what was approved.

Layout

Six diagrams push the shared diagram height from 516 to 644, which left a short diagram trailing 440px of dangling lifeline through the reserved space. Lifelines now stop just past the last message; the box stays one height so switching tabs does not shift the page.

llms.txt

Five access modes, not four, named as -11 names them; four token types plus the session token. Dropped the pin to draft-hardt-oauth-aauth-protocol-01 — -11 is not on the datatracker (404; -10 is latest), so this points at the document page and the editor's copy rather than pinning a revision that does not exist.

This is one coordinated wave

Twelve PRs across twelve repositories implement AAuth -11 and R3 -02, built in parallel worktrees that could not see each other and reconciled in one integration pass.

Merging any one alone breaks the others. For this repo the coupling is documentary rather than functional, which does not make it optional:

• Merging this before the fleet moves means aauth.dev documents a protocol that no live service speaks. The Person Identity and Per-Call diagrams describe flows only hellocoop/mockin can currently serve.
• Merging the fleet without this leaves four diagrams telling every reader to present an agent token at /authorize — the exact thing every resource in the wave now answers with 401 requirement=person-token.
• This is a Cloudflare connected repo: a push to main auto-deploys. There is no staging, and this is the public site.

The twelve PRs

Repo	PR	What it is
hellocoop/mockin	#6	The reference PS. The only thing issuing -11 person tokens — the gate on verifying everything else.
dickhardt/AAuth	#93	The specs: editorial corrections, plus six issues filed.
aauth-dev/packages-js	#16	The npm surface. @aauth/protocol 1.0.0 (new), @aauth/agent 3.0.0, @aauth/resource 2.0.0, five more.
aauth-dev/proxy	#2	@aauth/proxy 1.0.0 — the agent-proxy core.
hellocoop/aauth-proxy	#33	The 38-proxy fleet. Carries the flag day. Merging deploys.
hellocoop/proxy-mcp	#1	Tracks @aauth/proxy ^1.0.0; AP metadata cleanup.
aauth-dev/notes	#2	Reference R3 resource; implements the #90 retention pattern.
aauth-dev/whoami	#1	Agent identity + the new person-identity path.
aauth-dev/web-agent-demo (playground)	#5	Browser walkthrough; handles the 202 deferred path.
aauth-dev/playground-popup	#2	Popup-flow variant.
aauth-dev/registry	#6	Five access modes; three-rung login.
aauth-dev/www	#7	Six access-mode diagrams.

Related and already open: aauth-dev/explorer #5 reworks the explorer for -11 / R3 -02.

Background: AAUTH-11-INTEGRATION.md (the integration ledger) and AAUTH-11-PACKAGE-CONTRACT.md (the pinned interface contract the parallel work packages were built against).

Ordering constraints for the wave

1. @aauth/protocol 1.0.0 needs a manual first publish — npm will not register a trusted publisher for a name absent from the registry.
2. @aauth/proxy 1.0.0 must publish before the fleet serves access_mode: person-token. 0.4.0 hard-fails on an unrecognized value.
3. HelloCoop/Wallet svr/issuer/sign.js:32 must ship Ed25519 in the same window. const alg = useEdDSA ? 'EdDSA' : 'RS256', useEdDSA = isAAuthType(typ), so every aa-auth+jwt and aa-person+jwt person.hello.coop issues today is EdDSA. Every verifier in this wave rejects it. RS256 stays for OIDC.

Not covered

There are no tests here — it is a Svelte site. Two things a reviewer should know:

• The diagrams are the only artefact in the wave that describes the whole flow end to end, and nothing in the wave has been verified end to end against a live PS, because none issues -11 person tokens yet. hellocoop/mockin is the only thing in the world that does. So these diagrams are drawn from the specification and the implementations, not from an observed trace.
• Missions appear nowhere in these diagrams, correctly: mission_endpoint is unimplemented by agreement across the wave, and mission_s256 travels only inside PS-issued tokens.

Known-deferred, recorded so it is not lost

• src/lib/walkthrough.md still narrates the -10 three-party flow. Left alone deliberately — rewriting it would describe events that @aauth/fetch and whoami.aauth.dev do not emit yet. It should be revisited once the fleet is live on -11.
• +page.svelte ~737–758 nests an <a> inside an <a>, throwing node_invalid_placement_ssr on every render. Pre-existing and unrelated to -11 — noted here only so a reviewer seeing it in the logs does not attribute it to this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	aauth-dev	e1d7224	Aug 12 2026, 01:32 PM