Generate a new Ed25519 key pair for signing OpenWorkProof objects.

Returns the private key as a hex string and the public key as base64url, along with the derived key_id.

Compute the OpenWorkProof key_id for a given Ed25519 public key.

Args: public_key_b64url: The raw public key bytes encoded as unpadded base64url (43 characters).

Sign a canonical OpenWorkProof payload with an Ed25519 private key.

Args: object_type: One of the allowed signed domains (call owp_list_domains to see the list). payload: JSON string of the unsigned payload object. private_key_hex: The Ed25519 private key as a hex string.

Returns: The signed payload dict with signature_alg, signer_key_id, digest, and signature fields added.

Verify an Ed25519 signature on a signed OpenWorkProof payload.

Args: object_type: The canonical domain of the object. signed_payload: JSON string of the signed payload (must contain signature_alg, signer_key_id, digest, and signature). public_key_b64url: The signer's public key as base64url.

Returns: {"valid": true} if the signature is valid, {"valid": false} otherwise.

Compute the canonical SHA-256 digest of an OpenWorkProof payload.

The digest is computed over the RFC 8785 JCS canonicalisation of {"domain": "openworkproof/<object_type>/v0.1", "payload": <payload>} (with digest and signature fields stripped from the payload at the top level).

Args: object_type: One of the allowed canonical domains. payload: JSON string of the payload object.

Verify a WorkOrder's identity bindings and maintainer signature.

Args: work_order_json: JSON string of the WorkOrder object.

Returns: {"valid": true} if all six key bindings are well-formed, distinct, and the maintainer's signature is valid.

Verify a nested claim (AgentRequest or HumanDecision) against a WorkOrder.

This checks that:

• The WorkOrder identity bindings are valid.

• The claim's work_order_digest matches the WorkOrder.

• The claim's actor is bound to a matching key in the WorkOrder.

• The claim's Ed25519 signature is valid.

Args: claim_json: JSON string of the AgentRequest or HumanDecision. work_order_json: JSON string of the parent WorkOrder.

Returns: {"valid": true} if the nested claim passes all checks.

List all allowed canonical domains for OpenWorkProof objects.

Returns: A dict with canonical_domains (all 9) and signed_domains (8 — excludes sidecar-event which cannot be signed).

Replay an OpenWorkProof ledger and return its authoritative state.

Args: ledger: Path to the SQLite ledger file.

Forward a run-tests execution to the ledger coordinator.

Args: ledger: Path to the SQLite ledger file. payload: JSON string of the run-tests execution payload (must include the signed AgentRequest and typed arguments).

Forward a repo-read execution to the ledger coordinator.

Args: ledger: Path to the SQLite ledger file. payload: JSON string of the repo-read execution payload.

Get the authoritative JSON Schema for an OpenWorkProof object type.

Args: object_type: One of work-order, capability-grant, action-receipt, acceptance-receipt, acceptance-rejection-receipt. version: Schema version (default 0.1).

Get the frozen SHA-256 digest of an authoritative JSON Schema.

This digest is a protocol-review anchor: changing it requires an explicit version-bump decision.

Args: object_type: One of the five schema-bearing object types. version: Schema version (default 0.1).

Analyse a repository's structure: file count, languages, dependencies.

Args: source: Local path or remote Git URL to the repository. clone_enabled: If True and source is a URL, clone it to a temporary directory first (default True).

Returns: Repository analysis including file entries, language stats, line counts, and dependency information.