Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.mnemom.ai/llms.txt

Use this file to discover all available pages before exploring further.

The canonical wire format for AAP attestation tokens. Mirrors mnemom-contracts/attestation-token/v1.yaml.

​
Envelope

JWS Compact Serialization (RFC 7515): 
<base64url(header)>.<base64url(payload)>.<base64url(signature)>
Fixed shape: 
{
  "alg": "EdDSA",
  "kid": "<key_id>",
  "typ": "AAP-Attestation/v1"
}
FieldConstraint
algAlways "EdDSA" (Ed25519).
kidKey identifier; matches a kid in /v1/.well-known/jwks.json.
typAlways "AAP-Attestation/v1". Mirrored in the payload for defense-in-depth.

​
Payload

JSON object conforming to JSON Schema 2020-12. All required fields below; additionalProperties: false.
FieldTypeRequiredDescription
typconst "AAP-Attestation/v1"yesMirrors the header typ.
issstring (URI)yesIssuer — always https://mnemom.ai for production. Verifiers reject other issuers.
substringyesSubject — the Mnemom agent_id (e.g., smolt-e2ca60ef).
iatinteger (Unix seconds)yesIssued-at, UTC. Verifiers reject iat > now() + clock_skew_grace (default 60s).
expinteger (Unix seconds)yesExpiry, UTC. Default TTL is iat + 3600 (1 hour).
content_hashstring (^[0-9a-f]{64}$)yesSHA-256 hex of the canonical card body at attestation time.
versioninteger (≥ 1)yesMonotone canonical-card version at attestation time.
composed_atstring (date-time)yesISO-8601 UTC timestamp at which the canonical card was composed.
card_kindenum "alignment" | "protection"yesWhich canonical card the token attests to.
smolt_idstring (^smolt-[a-z0-9]+$)noOptional convenience claim for consumers binding on smolt-id.
historic_backfillconst truenoPresent (and only true) on tokens minted by the one-shot backfill script for canonical cards that pre-date the transparency log.

​
Signature

Ed25519 signature over the byte string <base64url(header)>.<base64url(payload)>. Base64url-encoded; no padding, no whitespace, no line wrapping (per RFC 7515 §3.1).

​
Beyond expiry

Tokens are short-lived. After exp, the embedded token is no longer cryptographically valid for new use, but the transparency log preserves it indefinitely. Consumers wanting to verify a historic posture query the log via mnemom verify-card --at <ISO>; the JWS inside the log row continues to verify against the JWKS as long as the signing key remains in the JWKS (active or retired-within-window).

​
Editorial source

Schema authored at mnemom-contracts/attestation-token/v1.yaml. Runtime consumers:

​
See also