OATS: verified evidence

OATS scores evidence about an OAS agent. It does not authenticate an incoming caller, prove runtime activity or grant application permissions. SDK 0.7.2 includes the verified-ingestion profile introduced in 0.2.0.

VerifiedOatsScorer requires an explicit trustedIssuers DID allowlist and verifyEvidence. It verifies every credential before returning an aggregate; one rejected credential rejects the whole batch. There is no public raw-unverified scoring API.

Concrete signature verifier

createOatsEvidenceVerifier supplies real OAS attestation signature verification. Its configuration requires a fixed delegation audience, IdentityVerifierConfig with authoritative resolveDelegations, and resolveIssuerAssertionMethods(did) returning the exact issuer's assertion-authorized public keys and controllers.

import {
  createOatsEvidenceVerifier, VerifiedOatsScorer,
  type OatsEvidenceVerifierConfig, type OatsCredential,
} from '@openagentid/sdk/oats';

export async function scoreEvidence(
  authorities: OatsEvidenceVerifierConfig,
  trustedIssuers: readonly string[],
  agentDid: string,
  credentials: readonly OatsCredential[],
) {
  const verifyEvidence = createOatsEvidenceVerifier(authorities);
  const scorer = new VerifiedOatsScorer({ trustedIssuers, verifyEvidence });
  return scorer.score(agentDid, credentials);
}

The host supplies real authoritative records; the scorer never promotes the submitted credential's key or declared lineage to authority. Signature validity and attester approval are separate decisions.

The concrete proof profile is the existing OAS Ed25519Signature2020 baseline: remove only top-level proof, serialize the complete remaining body as RFC 8785 JCS, and verify its raw Ed25519 signature encoded as z-prefixed base58btc. It requires the W3C VC and OAS contexts, assertionMethod, proof creation equal to issuance time, and a signed credential ID. This is not generic JSON-LD normalization or support for every external suite sharing that name. Native WebCrypto Ed25519 is required.

It resolves current issuer and subject identity chains and root authority, checks every revocation and the credential ID's revocation, and refuses stale/unavailable authority. Owned roots require the real owner path; self roots require explicit current approval. Submitted chain extensions cannot replace authoritative chain lookup.

Validation and score

DID, issuer, subject and credential IDs bind exactly, with no alias normalization. Evidence needs valid explicit UTC issuance, optional later expiry, one supported category, a proof and finite score values in [0,1]. Future issuance, expired evidence, impossible dates, contradictory types, malformed higher-priority score fields and duplicate IDs are refused rather than clamped or silently dropped.

For each category, the reference algorithm averages verified scores and decays the average using the category's latest evidence time with a 90-day half-life. Missing categories have zero score/count. Age is truncated to whole seconds before conversion to days. The weighted sum is the composite; confidence is 1 - exp(log(0.05) * evidenceCount / 100), based on count rather than an invented quality probability.

The legacy PublisherBond normalization is min(bondAmount / 200, 1) for strictly positive signed bond evidence (zero is refused). Its profile's legacy SIGIL denomination is not Base/ETH and does not establish an on-chain balance. A bond claim still needs signature, approved issuer, current identity and credential revocation checks.

The normative verified-ingestion profile records exact category declarations, score precedence, UTC parsing, proof context, confidence and reference Rust revision. OATS does not deploy an oracle, create a universal auditor list or make Base/EAS an automatic trust root.